{"id":24120,"date":"2022-12-16T21:41:50","date_gmt":"2022-12-16T21:41:50","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/16\/instead-of-fixing-its-privacy-debacle-eufy-changed-the-terms-of-the-deal-review-geek\/"},"modified":"2022-12-16T21:41:50","modified_gmt":"2022-12-16T21:41:50","slug":"instead-of-fixing-its-privacy-debacle-eufy-changed-the-terms-of-the-deal-review-geek","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/16\/instead-of-fixing-its-privacy-debacle-eufy-changed-the-terms-of-the-deal-review-geek\/","title":{"rendered":"Instead of Fixing It\u2019s Privacy Debacle, eufy Changed the Terms of the Deal \u2013 Review Geek"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
\"An
eufy<\/span><\/figcaption><\/figure>\n

In late November, security experts<\/a>\u00a0found that eufy camera footage can be streamed through VLC\u2014no authentication required. This is an awful vulnerability, especially for a camera brand that\u00a0supposedly<\/em> keeps everything off the cloud. Now, instead of facing this mess head-on, eufy is deleting some of its old promises.<\/p>\n

As reported by\u00a0The Verge<\/em>\u2018s Sean Hollister, eufy deleted at least 10 promises<\/a> from its \u201cPrivacy Commitment\u201d page. This deletion happened sometime between December 8th and December 15th, as indicated by an archived version<\/a> of the commitment page.<\/p>\n

Here are five promises that were deleted from eufy\u2019s website:<\/p>\n

    \n
  • \u201cThere is no online link available to any video.\u201d<\/li>\n
  • \u201c[Y]our recorded footage will be kept private. Stored locally. With military-grade encryption. And transmitted to you, and only you.\u201d<\/li>\n
  • \u201cWith secure local storage, your private data never leaves the safety of your home, and is accessible by you alone.\u201d<\/li>\n
  • \u201cYou need to use Eufy software and your account to decrypt the clips for viewing. No one else can access or read this data.\u201d<\/li>\n
  • \u201cAll recorded footage is encrypted on-device and sent straight to your phone\u2014and only you have the key to decrypt and watch the footage. Data during transmission is encrypted.\u201d<\/li>\n<\/ul>\n

    These now-deleted promises explain the benefits of local encrypted storage. And, of course, they mainly center around privacy\u2014your data doesn\u2019t leave your home, nobody else can see it, and so on.<\/p>\n

    Of course, none of these promises turned out to be true. You can stream unencrypted video from an eufy camera if you obtain its serial number, UNIX timestamp, and hex key. The process requires a lot of technical know-how, but nonetheless, it\u2019s a critical vulnerability that could harm customers.<\/p>\n

    And we still have no idea what eufy thinks about this situation. Public statements from eufy and its parent company, Anker, either ignore or deny that the vulnerability exists. All we know is that, behind the scenes, eufy is quietly scrubbing these ironic promises from its website.<\/p>\n

    As we stated on December 2nd, eufy\u2019s response to this vulnerability is completely unacceptable<\/a>. The company should have admitted its mistake and provided some transparency for customers. Instead, it\u2019s spent the last 15 days throwing a temper tantrum.<\/p>\n

    We\u2019ve reached out to eufy for comment on this story. To be clear, we no longer recommend buying eufy cameras\u2014not because of the vulnerability, but because of eufy\u2019s alarming response. Old\u00a0Review Geek<\/em> articles that mention eufy cameras have been edited to reflect our stance.<\/p>\n

    Source: The Verge<\/a><\/small><\/p>\n<\/div>\n