[aritmo]

The media transfers are encrypted. But he uses the Developer Tools of the browser, so he sees the content of the encrypted packets.

It is obvious that any cloud-based security camera has to send the media to the cloud! There is no other way.

The marketing people at Eufy made a long series of mistakes. It is a marketing problem.

[nathan_phoenix]

Eufy markets their cameras as privacy focused, using local storage and local processing without using cloud storage so I'm not sure how you concluded against their marketing that it's cloud based.

Also he opens the link in a new private session which doesn't have the auth cookies. Furthermore, he later explains that there is no auth happening. Lastly The Verge confirmed it by watching the camera stream using plain VLC.

[paranoidrobot]

> There is no other way.

That's not true, or at least not always.

Plex manages this just fine with my media content.

Plex Media Server reaches out to my router and punches an inbound port to itself. When I'm then watching from outside my home network, the traffic is going direct to my home IP.

[kodah]

Eufy isn't cloud-based.

[haswell]

The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset.

The reality is, even if the cameras are not configured to save video to Eufy's cloud service, thumbnails are still transmitted to Eufy for the purpose of facilitating push notifications (confirmed by Eufy), and the researcher who discovered this claims to have found a way to access camera feeds without authentication as well (this is not confirmed, and one of the most questionable claims).

I own several of these cameras but have them configured as HomeKit devices, and while I'm not terribly concerned about the transmission of thumbnails since this is the name of the game if you want a preview in a push notification, I've always felt a little weird about the fact that these cameras require a Eufy account to configure, and you can access the live streams by logging into that account, even after the cameras have been configured as HomeKit cameras.