4 ms·

The streaming of video has been confirmed by multiple sources including the Verge and Linus Tech Tips

haswell 4y ago
Sort of, but with caveats. From The Verge: > This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud. Missing is how they connected "VLC can play a stream" to "Anker has a way to bypass encryption". The ability to open a stream in VLC does not automatically imply it is encryption-free. > There is some good news: there’s no proof yet that this has been exploited in the wild, and the way we initially obtained the address required logging in with a username and password before Eufy’s website will cough up the encryption-free stream. (We’re not sharing the exact technique here.) Things continue to be fuzzy and it's not clear what they believe "encryption-free" means. Since everyone is being understandably cautious about releasing the actual details, all of this is still frustratingly incomplete information. On the LTT side, they went full rage mode in their coverage and it became difficult to take them seriously based on how they were discussing the thumbnail issue. We desperately need an end-to-end review and summary from a reputable security person.
- Godel_unicode 4y ago
  I wish LTT was better at the research and testing side things. The production value is pretty good but man do they get it exactly wrong a lot.
- 0x6c6f6c 4y ago
  I wonder how much confusion is around people thinking "authentication" when saying or hearing "encryption"
  - donmcronald 4y ago
    A lot. Several comments here even get it wrong.
  - haswell 4y ago
    The researcher's claim is about both authentication and encryption, so there's at least some distinction baked into the claim. I suspect the disconnect is regarding transport encryption vs. data encryption. There seems to be an assumption that transport encryption is a given, but I don't believe that to be true.
- donmcronald 4y ago
  > The ability to open a stream in VLC does not automatically imply it is encryption-free. Yes it does, doesn’t it? Unless you’re loading keys that are used for decryption into VLC you’re streaming unencrypted data. The URL might be authenticated, but that’s not encryption. The transport (https) might be encrypted, but that’s not what anyone cares about. The data (aka video) should be encrypted with a client owned key.
  - haswell 4y ago
    Yes, I’m crystal clear on the difference between authentication and encryption. > The transport (https) might be encrypted, but that’s not what anyone cares about. I was referring to transport encryption. Paul was rather vague about what he meant by unencrypted, and if there’s no transport encryption this is a breathtakingly big issue. So I’d argue that people do/should care about this. Data encryption would obviously be ideal, but in my mind, that wasn’t even the initial bar to clear after a claim of “unauthenticated and unencrypted”. The biggest issue with all of the communication up to this point has been a lack of precision/specificity, and that has led to multiple interpretations of the findings and plenty of misunderstanding.

Sort of, but with caveats. From The Verge: > This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud. Missing is how they connected "VLC can play a stream" to "Anker has a way to bypass encryption". The ability to open a stream in VLC does not automatically imply it is encryption-free. > There is some good news: there’s no proof yet that this has been exploited in the wild, and the way we initially obtained the address required logging in with a username and password before Eufy’s website will cough up the encryption-free stream. (We’re not sharing the exact technique here.) Things continue to be fuzzy and it's not clear what they believe "encryption-free" means. Since everyone is being understandably cautious about releasing the actual details, all of this is still frustratingly incomplete information. On the LTT side, they went full rage mode in their coverage and it became difficult to take them seriously based on how they were discussing the thumbnail issue. We desperately need an end-to-end review and summary from a reputable security person.

Godel_unicode 4y ago
I wish LTT was better at the research and testing side things. The production value is pretty good but man do they get it exactly wrong a lot.
0x6c6f6c 4y ago
I wonder how much confusion is around people thinking "authentication" when saying or hearing "encryption"
- donmcronald 4y ago
  A lot. Several comments here even get it wrong.
- haswell 4y ago
  The researcher's claim is about both authentication and encryption, so there's at least some distinction baked into the claim. I suspect the disconnect is regarding transport encryption vs. data encryption. There seems to be an assumption that transport encryption is a given, but I don't believe that to be true.
donmcronald 4y ago
> The ability to open a stream in VLC does not automatically imply it is encryption-free. Yes it does, doesn’t it? Unless you’re loading keys that are used for decryption into VLC you’re streaming unencrypted data. The URL might be authenticated, but that’s not encryption. The transport (https) might be encrypted, but that’s not what anyone cares about. The data (aka video) should be encrypted with a client owned key.
- haswell 4y ago
  Yes, I’m crystal clear on the difference between authentication and encryption. > The transport (https) might be encrypted, but that’s not what anyone cares about. I was referring to transport encryption. Paul was rather vague about what he meant by unencrypted, and if there’s no transport encryption this is a breathtakingly big issue. So I’d argue that people do/should care about this. Data encryption would obviously be ideal, but in my mind, that wasn’t even the initial bar to clear after a claim of “unauthenticated and unencrypted”. The biggest issue with all of the communication up to this point has been a lack of precision/specificity, and that has led to multiple interpretations of the findings and plenty of misunderstanding.