Anker’s Eufy lied to us about the security of its security cameras | Hacker News Reader

Anker’s Eufy lied to us about the security of its security cameras

theverge.com

105 pointsmfiguiere7 comments

Every time I start wondering if I’m too dogmatic about avoiding smart home products…

My hard rule is I refuse to buy any “Smart Home” product that is IP addressable, or can directly connect to a host outside my own network. Any new device gets tossed into a super restricted VLAN, and monitored. If it tries to reach the outside world on its own, it gets returned and refunded.

So this limits me mostly to things like outlets, switches, alarms/alerts and temperature and air quality sensors. It means I need to use an app that communicates only through networking technology like Bluetooth or Thread or a secured API. So everything comes through something like HomeKit and/or Thread.

Cameras are different. They get VLANd, and they only send video to my own storage which is accessible by my own applications. That footage gets backed up offsite through normal means. Cameras don’t talk to anything outside my network because they don’t need to.

But… that still accomplishes everything I need, so that’s fine. I use open source tools to aggregate, dashboard and handle the integration between devices myself. After initial setup, it’s been set and forget.

I quite like how ikea did it. You can control everything with local wireless remotes and be completely unnetworked. Or you can buy the hub which gives you app control on the local network only. No servers involved. And finally you can connect the hub to Apple/google services for full internet access.

It’s truely the best, everyone gets what they want.

It’s called zigbee (soon to be Thread). It’s wonderful. And if you set something up like home assistant with ZHA or zigbee2mqtt, then you can use most zigbee products together with just the one coordinator (instead of being tied to only ikea or only hue, etc. or using multiple hubs).

>You can control everything with local wireless remotes and be completely underworked. Or you can buy the hub which gives you app control on the local network only.

Yep, as I described: ” It means I need to use an app that communicates only through networking technology like Bluetooth or Thread or a secured API.”

As mentioned by someone else, that’s what Zigbee and Thread allows, and Apple jumped on it with HomeKit pretty fast. There’s a lot of open source tools to help tie your Zigbee, Thread, HomeKit and other things together very easily, and where nothing is reaching out to the net, nor can the net reach back in.

Playing devil’s advocate, I suspect this might not be as bad as it sounds. Just like the previously discussed flaw [1] it starts with logging in to the cloud dashboard. Presumably when you open a stream, it uses your current session to derive the decryption key, and then provide a URL to stream the video (how else would you do this in the browser?). This is a non-guessable URL with a short expiry.

tl;dr you won’t be accessing anyone’s camera feed anytime soon unless you obtain their credentials.

In normal usage, without the web UI, hopefully there is no streaming to the cloud at all. Should be easy to verify by watching network traffic, but this is where one would hope Anker to step in and communicate clearly… why would they not?

[1] https://news.ycombinator.com/item?id=33721304

I have one of these cameras, but I run it using HomeKit Secure Video, and that seems to completely change the behaviour.

I wonder if that’s a sufficiently different way of operating them that it’s safe?

Reply on news.ycombinator.com