Eufy’s “local storage” cameras can be streamed from anywhere, unencrypted

Article note: I have a whole meme-media library in my head that goes off when I read about IoT bullshit being bullshit. The "You plugged it in to the phone didn't you, if you screw up again you won't get into college" bit from the beginning of Hackers, the explaining no networked computers bit from the new/rdj/2004/good Galactica, and James Mickens' "Not Even Close: The State of Computer Security" NDC talk from NDC 2015, specifically "all the membranes beast" from the "YOUR HOUSE ON INTERNET OF THINGS" slide. All playing at once. Every time I read about another piece of garbage that shouldn't have an external network connection, but does because fuck you.

Enlarge / Eufy's camera footage is stored locally, but with the right URL, you can also watch it from anywhere, unencrypted. It's complicated.

When security researchers found that Eufy's supposedly cloud-free cameras were uploading thumbnails with facial data to cloud servers, Eufy's response was that it was a misunderstanding, a failure to disclose an aspect of its mobile notification system to customers.

It seems there's more understanding now, and it's not good.

Eufy didn't respond to other claims from security researcher Paul Moore and others, including that one could stream the feed from a Eufy camera in VLC Media Player, if you had the right URL. Last night, The Verge, working with the security researcher "Wasabi" who first tweeted the problem, confirmed it could access Eufy camera streams, encryption-free, through a Eufy server URL.