LTT has already replied to this, and no, it's still very much a problem. https://youtu.be/Luz82RG5PqA?t=160

I mean it's not that debunked, I was able to confirm that the homebase will send unencrypted video to mediaserver-usa3.eufylife.com (hosted in ec2 at the time of writing) when I request a video stream while logged into mysecurity.eufylife.com in about half an hour most of which was deciding the best place to packet capture.

Its very much sending video data to the cloud upon request.

Thanks for the video. That is well-done.

Not sure it's deliberate clickbait, though. That speaks to intent.

This video is full of questionable stuff. Images within notifications don't need to be hosted on an internet-facing service without authentication, for example, they can use authentication just fine. They don't even need the cloud for anything but basic signalling (thanks, Apple and Google, for forcing your proprietary notification servers on every app). Authenticated peer to peer protocols (and failing that, end-to-end encrypted protocols) are everywhere and most of us use them every day. The reliance on cloud stuff isn't because it's impossible to live up to the claims on their website, it's because doing what they claim to be doing is hard and piping everything through Amazon is easy.

The video also seems to confirm that content is in fact mirrored on the internet, which Eufy promised not to do. It also claims that Eufy chose to not do local-only processing for facial recognition for performance reasons, which is entirely valid were it not for the local-only promises.

The GDPR regulations do not necessarily apply to user content in the context of account deletion; content, which by the promises of the seller's website, should've never left the device in the first place. The 30 day limitation of deletion requests is not related to deleting files, it's merely the maximum response time for the company upon receiving a correction or deletion request. If the GDPR were involved at all, Amazon should be listed as a data processor in the privacy policy, which it isn't, so that would be illegal. Even still, "we legally have the right to keep your data even longer" is a dickish excuse for not quickly throwing out the access keys/encryption keys/data for deleted accounts/files.

The video completely glosses over the complete breach of trust Eufy committed by saying "some parts of the initial reporting are exaggerated". Eufy did in fact lie about the security of its product and they lied about how it works. This is a huge blemish on the good name of Anker.