Eufy has released an update for its Security app. Users can now receive notifications without photos being sent to the cloud.
YouTuber Paul Moore exposed a serious privacy issue in Eufy’s systems in November. Anker’s subsidiary brand claims to store all data offline on its product pages, but according to Moore it still sends photos to its cloud service. The photos taken with the security cameras are visible via the Eufy web interface. Through a message in the Security app for security cameras, Eufy is now notifying its customers about this cloud storage of thumbnails, ZDNet notes.
Specifically, Eufy explains that it sends these photos to cloud storage to enable push notifications. Then the thumbnails are only temporarily stored on its servers. Those who wish to use the system completely offline from now on will also be given the option to do so. The Security app now offers an option for text-only notifications. It does not send any data to its servers for this. The option for push notifications with thumbnails will continue to be available, and will continue to run through Eufy servers. The setting in the app now also offers additional explanation.
Eufy-camerastreams via VLC
Users reacted shocked to Moore’s story, including via Reddit. The company insisted in its marketing stories that it does not send data to the cloud. Even at this point, you can read on Eufy’s product pages that “no cloud” is required to use its products.
However, the privacy issue surrounding Eufy cameras did not stop there. Moore’s research shows that camera streams from Eufy security cameras can be accessed via VLC without authentication. Users only need to connect via VLC to the url of such a stream. The user then does not have to enter any authentication data. Eufy refuted this claim, stating that the images are sent encrypted.
The Verge nevertheless managed to confirm Moore’s claims; the images of Eufy streams are – provided you know how to collect the url – visible to everyone. It is unknown whether the Anker subsidiary brand is working on an update for its Security service. In any case, the update notes of the recent update for the platform do not mention a solution.
