Anker’s Eufy cameras send images to servers to show users thumbnail push notifications, says owner Anker. Eufy has been discredited in recent days because a YouTuber showed that the images can be accessed via the web.
YouTuber Paul Moore showed that Eufy thumbnails can be viewed in the service’s web interface. Also, he didn’t enable the option to save images online, accessing his system only through the web interface. The web interface made a “get_all_history_record” API call to find the images. It turned out that there were also fields for facial recognition.
In a second video shows that the thumbnails remain accessible, even if he has cleared the notifications from his phone and they no longer appear via the api call: the url remains valid and the image remains visible. The link expires after 24 hours.
According to Eufy, saving thumbnails is necessary for push notifications to work without cluttering users’ phones with screenshots of those notifications. According to users, Eufy has removed the API call from its web interface, but it is unknown if the company will do anything else. Eufy promises users on its site that the images will stay stored locally. “Your recorded footage remains private. Stored locally. With military-grade encryption. And sent to you, and only you.”