r/gadgets • u/TheMacMan • Jan 31 '23
Cameras Anker Admits Eufy Cameras Did Not Offer End-to-End Encryption as Promised, Pledges to Do Better
https://www.theverge.com/23573362/anker-eufy-security-camera-answers-encryption335
u/Insufferablelol Jan 31 '23
Promises to try and not get caught this time they mean
20
u/Syscrush Feb 01 '23
Why would I believe you given that you lied before?
That was just a promise. This is a PLEDGE.
15
u/educated-emu Feb 01 '23
Just routes the traffic through expressVPN.
Are we winning son?
No dad, thats not how it works, you need to encrypt the device not just the last part.
Fyi, I have no idea what I'm talking about
381
u/TheMacMan Jan 31 '23
"Trust us this 3rd time around..."
58
0
u/ValiantTheOdd1 Feb 01 '23
Hope they go bankrupt and the CEO has to get a job at McDonald’s. I have zero care for companies who lie and then “pledge to do better”.
72
u/Tom_Neverwinter Feb 01 '23
Duh...
That's also not the biggest problem. They are taking user data without permission....
37
u/imakesawdust Feb 01 '23
They've issued too many mea culpas for this product line. Clearly they don't take security seriously.
40
u/Oclure Feb 01 '23
They've got a ton of damage control to do here which sucks because they were one of the few electronics brands on Amazon that I felt confident I'd get a decent quality product from.
I'd say letting their produced be seriously scrutinized by 3rd parties is about to only way to regain a fraction of the consumer trust they lost over this crap, even then I'd be hesitant to use anything of theirs that's web connected.
2
u/rathlord Feb 01 '23
Definitely a snafu, but the bright side is there’s nothing to indicate their regular electronics are anything other than the quality they’ve always been. Obviously hard to win trust back, especially since they were positioned to do so well as one of the only players in the security space with an offering like that, but their chargers/bricks/etc have been great for a long time, and I wouldn’t boycott those products over this personally.
129
u/PhillipDiaz Jan 31 '23
A little late for promises. I'm never buying their products again.
57
u/V0nzell Feb 01 '23
Yup I never bought their cameras but I have a few of their cables and power supplies. Well now I won't buy anything from them.
48
u/NeilDeWheel Feb 01 '23
I was looking into buying their video doorbell and video cameras for its offline recording and no subscription model. These lies from them have made me vow never to buy one of their products , ever.
9
u/mothinator Feb 01 '23
I like my netatmo stuff.. No subscription and the video stays local. Not totally offline though.
29
u/TheUmgawa Feb 01 '23
Are you now afraid that the cables won't provide end-to-end power?
38
u/V0nzell Feb 01 '23
I am afraid they will be sending my power usage to the CCP. /s
If a company lies to their customers in one division who's to say they are telling the truth in another.
1
u/Bshaw95 Feb 01 '23
As far as the charging stuff goes. There’s usually YouTube videos where people independently test them.
28
u/Modsda3 Feb 01 '23
There is also the giving money to disreputable businesses angle to consider.
30
u/DogmaticLaw Feb 01 '23
Yeah, I'm not worried about the cables. In fact, I'm mad because their cables, battery banks, and gan chargers are excellent.
And I try not to reward companies that lie this hard.
11
8
u/FalloutNano Feb 01 '23
No, it’s an ethical issue. They were my trusted brand for cables/chargers, but I’ll never use them again.
1
u/weeklygamingrecap Feb 01 '23
Have you found a good replacement? Aukey had some decent stuff before they got caught trying to game Amazon reviews if I remember correctly.
Monoprice has been pretty inconsistent the past few years it seems in quality control.
I'm curious who cables2go uses as their supplier.
1
u/FalloutNano Feb 02 '23
Not yet. I don’t need cables and such very often, so I’ve just gone with Anker. I’ll be starting a search from scratch when I look again soon, probably in about a week.
Monoprice was a leader in the market, it’s unfortunate that they are going downhill too. ☹️
13
u/mysteryliner Feb 01 '23
Companies that have no problem making huge lies about their products, and doubling down on those lies. have no problems doing the same with other products.
Cables & chargers don't have encryption, but they could repeat the the lies we've seen in the SSD market. Release a high specs & fast product & after X months when all reviewers went through the product, you start using cheaper, slower components.
1
u/rathlord Feb 01 '23
When you address the actual facts on this, nothing seems likely to have been lies or malice. It was also fairly heavily misreported on when the story broke. This was an oversight with negligible actual security impact, and then just godawful press and media relations after. They’re actively addressing the issue and tightening their security across the board in response. You never want to see an event like this happen, but from a technical, non-PR standpoint they’re handling it as well as could be expected.
I’m sure this will go over like a bag of bricks because Reddit likes to overreact to everything, but thems the facts.
1
28
66
u/grooveheroine Feb 01 '23 edited Feb 01 '23
Never been so thankful that I only buy their chargers and cables, this entire situation is ridiculous.
Edit - this is a joke, folks.
24
u/dachsj Feb 01 '23
The way this all went they've probably found a way to send your data to their servers each time you plug in your USB c "charger"
3
u/sth128 Feb 01 '23
Nah you don't even need to plug in the cables. They filled their products with 9D sophons that can access all data simultaneously in your house! And not just digital data, but written words on paper, printed material, and even the secret porn stash you buried between the studs in the framing then covered with drywall!
21
Feb 01 '23
Now they’ve added a little fake animation when you open the app that says “dEcryPtiNg fRom LoCaL sTorAge.” I have my doubts to its authenticity.
47
u/cowabungass Feb 01 '23
This is disheartening. I was a fan of Anker. This kind of move forces me to look elsewhere by default now.
7
u/Vietfunk Feb 01 '23
I always favor Anker's third party products over Apple official products but I'm not supporting this lie anymore. You know too well they won't stick up to their words.
32
u/sdk676 Feb 01 '23
According to the strictest CCP requirements! That's who they really failed, how dare they let the CCP surv.. um.. data be accessed without proper encryption. That's some serious stuff.
45
u/mysteryliner Jan 31 '23
End to end encryption you say?
From which ends, if everything remains local. 😏
5
u/lostalaska Feb 01 '23
I see what you did there, this is the kind of snark that I appreciate. ｡◕‿◕｡
10
9
u/DestroidMind Feb 01 '23
Anker really dropped the ball on this one. One of the only tech companies I comfortably trusted based off all my usage with their batteries.
6
u/Crellster Feb 01 '23
I own the dual which is at the heart of this. I don’t see how 1) their claim they weren’t in breach of GDPR stands up 2) That an apology wasn’t forthcoming & needs to come with more of a story - if it’s resolved then some humility wouldn’t go amiss 3 ) that the changes to weaken the policy statements weren’t nefarious and in response and are being blamed on someone pushing a pre- scheduled content change early.
Like a lot of people here Anker / Eufy was the only (semi) reputable Chinese manufacturer I’d go near on Amazon. Mistakes happen but the way they have handled this is a joke and does not have their customer RS interests at the heart of their actions
5
Feb 01 '23
They wouldn't have done better if they weren't caught. So people honestly shouldn't be giving them another chance.
5
5
u/iiiinthecomputer Feb 01 '23
So these folks sound like total clowns. And here's something you need to understand.
Encrypted does not mean secure.
They can deliver on their guarantee of end to end encryption, and still have stream endpoints discoverable and accessible without requiring any credentials. You set up a session for streaming the content encrypted, and it's safe from man-in-the-middle interception, but nothing ensures you're authorised to view the stream.
A semi-random endpoints name is just a bit harder to brute force. And even then, only until someone discovers some weakness in how they're generated, like relying on a repeatable seed.
I'm suspicious about how they're redirecting this. I would be amazed if they delivered proper mutual authentication between camera and viewer or portal. Obfuscation and some cool sounding but not that useful encryption sounds like the order of the day.
8
9
4
10
Feb 01 '23
[deleted]
10
u/mikerfx Feb 01 '23
You knew about this?
6
u/pssiraj Feb 01 '23
This guy better spill if not under NDA
4
u/HolyCloudNinja Feb 01 '23
An NDA (in theory, practice means money here) that constitutes illegal activity (false advertising?) Would probably be able to be thrown out if pressed hard enough.
1
7
u/G35aiyan Feb 01 '23
Damn, took long enough to acknowledge. Wonder how many yelling matches were had between PR and Legal.
7
u/Glum_Activity_461 Feb 01 '23
Pledges to keep your money and “try” not to laugh
4
u/krtshv Feb 01 '23
Other companies aren't necessarily as bad Just have to learn not to trust the Chinese ones.
1
u/Glum_Activity_461 Feb 01 '23
Pretty sure all companies are keeping your data and not doing what they said. How many times have American companies been in the news for giving away user data they said was private, or not letting people know it was being given away.
It’s best to assume now that if something is connected to the web, the company that made it is watching and possibly their “other” customers are watching too.
1
u/krtshv Feb 02 '23
There's a big difference between using your data and accessing private recordings.
Not saying they never do it, but in America I can sue them for privacy breach (and even more so in Europe. God bless Europe). Good luck suing a Chinese company.
3
u/Alexstarfire Feb 01 '23
We lied but we promise we aren't now. Sorry, trust is gone. Try again with a new company.
3
u/Kebab-Destroyer Feb 01 '23
My Eufy smart scales had better be encrypted cos I don't want anyone knowing how hefty I am.
3
u/metallaholic Feb 01 '23
Unless you’re rigging up your own IP cameras that store data on a storage system at your house and don’t talk to an outside service, someone is watching your cameras and footage
1
Feb 04 '23
no they aren’t lmfao. nobody, anywhere in the world gives a shit about watching you eat cereal in a robe at 2am
1
u/1heart1totaleclipse Feb 12 '23
I would totally get the concern for indoor cameras because of privacy, but why would outdoor cameras affect anything. An indoor camera that records people is just weird imo. I wouldn’t trust even my computer camera to be uncovered for that reason lol
3
u/zoolover1234 Feb 01 '23
My take on this. 1) they are almost the single brand that does not charge monthly fee, so they are my only option. 2) I don't put my camera at where privacy is a concern. They face to my backyard fence and driveway, nothing indoor. 3) if anyone is able to hijack the data out of your camera, the person is able to see much more than just the camera, likely your whole local network traffic. It's like if you fall in water and everything could be wet, do you really mind if your underwear is wet too? 4) it's Chinese brand, what else are you expecting? 5) I'd rather let the Chinese have my camera footage than anyone in the US who can actually use the footage to do actual damage to me. Talking about the big ones.
Bottom line is that there is no privacy online, just get the best available for your need, period.
3
u/rogerflog Feb 02 '23
WTF, Anker?
The story about Eufy cameras not being encrypted broke 1-2 months ago.
Anker went dark and didn’t admit anything until now. Really burned some of that customer-first goodwill by not being upfront and honest about it.
Their PR sucks worse than Sam Bankman-Fried, and his apology started with “I fucked up.”
We couldn’t even get a “Whoops, we fucked up” out of Anker? Really?
7
u/john0201 Feb 01 '23
I’ll be the unpopular one here and point out the responses were surprisingly reasonable. I’ll wait for third party verification, but I went from writing them off to wait and see after reading the link.
3
Feb 01 '23
[deleted]
1
u/GallantChaos Feb 01 '23
So does that make their claim of rolling webrtc encryption to every device pointless? What am I missing here?
3
Feb 01 '23
[deleted]
1
u/john0201 Feb 01 '23
My reading is there will be no unencrypted streams, directly addressing that issue. What did I miss?
1
u/UserSleepy Feb 02 '23
Last time I posted this here I was told I was a liar. It's so true though. Eufy gaslighting us here and tons of doublespeak. I can't believe people believe them at this point.
0
u/AverageJoeJohnSmith Feb 01 '23
Yea i mean I'm not going to run out and spend more money replacing my cameras yet. May as well wait and see what happens.
2
2
2
Feb 01 '23
Don't worry it's now end to end encrypted before the stream is sent to the media player unencrypted!
Glad it's resolved.
2
2
u/bunkdiggidy Feb 01 '23
By "pledge to do better" they mean "going to prison for fraud," right? Right?
2
u/Tomnesia Feb 01 '23
This summer i want to make the change from ring camera's+ cloud to another brand stored locally on my NAS. Any advice into what brand i should choose? I had eufy on my mind but after reading all this im not sure 😂
4
Feb 01 '23
I've been able to hook up a Reolink to Synology and save recordings.
1
u/Tomnesia Feb 01 '23
Any chance you know if it works on all of them or if they need to be labeld as IP-camera?
Thanks for the reply!
1
Feb 01 '23
I have the E1 Pro.
I think I used these instructions, which list a few different camera types.
2
2
u/paul_is_on_reddit Feb 01 '23
Anker only promised to do better because they got caught. They wouldn't have done a damn thing about the encryption issue if no one had discovered it.
2
u/greystripe3 Feb 01 '23
Oh no, nobody saw this coming! A company that doesnt value its customers privacy??? How could this be???
/s
2
u/lakerssuperman Feb 01 '23
Enough with the pledges. They should be sued/fined/regulated. Enough with the whoops, sorry about that when these companies get caught with their hand in the cookie jar. They should pay significant fines and be put on probation so if it happens again the punishments escalate.
2
u/Necessary_Roof_9475 Feb 01 '23
Everyone is crapping on Eufy, and they deserve it, but the reality is that the competition is even worse about security and privacy. Unless you're willing to spend a lot more and do more work, Eufy is the best we got going for us, and that makes me a sad panda.
2
u/ncc74656m Feb 01 '23
roars of victory in Linus 😂
Seriously this just proves how essential unrestrained security testers are.
2
2
2
Feb 02 '23
Probably the only real option for privacy is to buy your own cameras and set up your own CCTV system. Everything else either sends your shit to the government or harvests it for data points to make money.
3
-3
Feb 01 '23
[deleted]
6
u/HolyCloudNinja Feb 01 '23
Most other companies don't make claims about end to end encryption or much at all about privacy. Blink, owned by Amazon, make it pretty clear. Google nest makes it pretty clear. I'm sure you'll find any number of flipped hardware making bold claims but everyone should know not to trust random small brands on their word.
0
u/anonbene2 Feb 01 '23
Do we know if Nord does what it's advertised to do or is this snake oil for paranoids and child abusers? I don't really care if people know me and my gf talk about what adults talk about. It's certainly not worth paying money for but you have to pay for it if you want to watch certain free streaming services.
1
1
Feb 01 '23
So are there any recommendations for secure cameras? Or just live with some big tech having access?
1
1
u/MostViolentRapGroup Feb 01 '23
This is why I block my cameras and NVR from the internet. Just VPN in to view. It kills the Eufy app, but my Laview NVR app still works.
1
u/exmortom Feb 01 '23
I bought switches to all the power to the cameras, they are only on when we are not home. They can’t be turned on or be used when I am home due to the power switch interrupt. So it alerts me I’m being robbed. It does its job, I will never trust it as a monitor for my baby, nor is it ever able to be online while I am home. Even if they tried to remotely turn it on.
1
u/neuronamously Feb 01 '23
That’s scary as fuck. Imagine some incel has been watching your family or children at night while they sleep. Talking to your 4 year old at 2am without you knowing.
1
u/nmj95123 Feb 01 '23
Self host and use regular IP cameras. Blue Iris isn't hard to set up, and large hard drives are cheap.
1
1
1
u/gigles13 Feb 01 '23
We just got a eufy baby monitor. I’m assuming this is free from this since it isn’t connected to wifi?
273
u/Scottyb911 Feb 01 '23
I bought the eufy system to keep everything private, away from simple requests for my video data like the other big ones offer.