Anker Apologizes for Eufy Security Cameras Not Being Fully Encrypted

Anker has finally broken its silence on the eufy Security fiasco. eufy is Anker’s privacy-centric smart home security brand, which landed in scalding hot water after its always-encrypted, local storage-only surveillance cameras were found to be streaming unencrypted live footage that could be accessed through a simple media player.

Responding to many calls for answers from The Verge, Anker has now spoken up about the situation (after the publication gave Anker an ultimatum to respond or it would publish a story about the company’s lack of answers).

In a series of emails to The Verge, Anker has finally admitted its Eufy security cameras are not natively end-to-end encrypted — they can and did produce unencrypted video streams for Eufy’s web portal.

During The Verge‘s original testing of the issue, the publication was able to access unencrypted video streams from Eufy cameras from across the U.S., using nothing but a media player app.

Anker admitted in its response that eufy’s security cameras are not fully end-to-end encrypted. While any and all footage that went through eufy’s mobile app was encrypted, streams requested through the eufy web portal weren’t. Instead, the web portal only requires the user to login to their account.

“It is very clear to all of us that encryption protocols should have been designed into this solution from the very beginning,” said Eric Villines, global head of communications at Anker.

However, the company said that this has now largely been fixed. All video streams served through eufy’s web portal will now be end-to-end encrypted as well. In addition, eufy is now also updating every single one of its cameras to use WebRTC, which is encrypted by default.

Anker also apologized for the lack of communication on its part and promised to do better. The company confirmed that it is engaging third-party security and penetration testing companies to audit eufy’s practices.

“We will do whatever is in our power to make things right and keep our customers happy,” Villines said in response to one of The Verge‘s questions. Anker will issue an update to its users in early February to better explain the eufy situation and also provide a “more thoughtful” apology backed up by a real plan.

“Reading between the lines, though, it seems that these cameras could still produce unencrypted footage upon request,” The Verge cautioned.

You can read Anker’s full statement on the matter and responses to questions over on The Verge.