Security consultant Paul Moore in November last year found Anker’s Eufy brand security camera in the case of disabled cloud storage, but still, upload some data. In a recent statement to foreign tech media outlet The Verge, Anker admitted that Eufy Cameras previously did not offer end-to-end encryption, but has now fixed the problem and promises to continue to improve.
Eufy officially acknowledges that the security camera did not provide end-to-end encryption locally and provided unencrypted video streams through the Eufy portal, although officials say the issue has now been fixed.
Users who previously visited eufy.com and logged into our secure web portal could enter debug mode and use the web browser’s DevTool to locate the live stream, which allows them to play, and share the video to others. Others can play it outside of our secure system after clicking on the relevant link.
However, sharing the link is optional for users, and they need to log in to the eufy portal before they can access the link.
Based on industry feedback and out of an abundance of caution, the eufy Security web portal has disabled users from debug mode since today, and the code has been hardened and obfuscated.
In addition, the video stream content is encrypted, which means that these streams can no longer be played on third-party media players such as VLC.
I should point out that only 0.1% of daily users currently use the secure web portal feature on eufy.com. The majority of our users use the eufy Security application to watch live streams. Either way, there were issues with the previous design of our web portal that have been addressed.
Video stream requests from the Eufy portal will be encrypted end-to-end in the future, just like the Eufy application, which Anker says is the primary way Eufy users access camera streams.
Every Eufy camera will be updated to use WebRTC with default encryption, Anker said, and it will no longer be possible to play Eufy video streams through third-party applications.
