The Local Security Camera That Still Left the House
Eufy promised camera footage would never leave the house. In November 2022 The Verge still watched live streams through a cloud address anyway.
Did Eufy security cameras keep footage only inside the house?
No. In November 2022 The Verge watched live video from its own Eufy cameras through a cloud address, in an ordinary media player, from across the United States. Eufy had promised local storage and footage that never leaves the home.
A home security camera is sold as peace of mind. In late 2022, one of the brands that sold that peace of mind hardest was caught with a live view that did not stay in the house. The Verge reported on 30 November 2022 that Eufy, owned by Anker, had promised local storage, footage that "never leaves the safety of your home," end-to-end encryption, and video sent "straight to your phone." Reporters then watched live pictures from their own cameras through a cloud address.
That is the story worth keeping next to any camera you would put in a hallway. A card in the device is not the same thing as a camera that cannot phone out. The household product aimed at the second claim is dldeploy.com. The mesh those boards join, instead of a vendor cloud, is MATA Home. The field notes are dldeploy in the wild and ESP-32 devices on MATA Home.
The promise Eufy made about local storage
Eufy built a reputation on not being another camera subscription. The pitch, as The Verge restated it, was privacy: your video stays on hardware you hold, encryption is end to end, and the path is from the camera to your phone. People bought that pitch because they had already watched other brands turn the hallway into someone else's archive.
Footage that never leaves the house
"Never leaves the safety of your home" is a topology claim. It means the bytes that matter are on a base station or a card in the room, and a stranger, including the company, cannot open a live picture from somewhere else. Local storage is the part you can see. The part you cannot see is whether the camera still has a vendor address it will answer.
What The Verge actually watched
Security researchers, including Paul Moore and a researcher known as Wasabi, said a Eufy camera could be played through the company's cloud without the encryption the ads described. Anker's senior PR manager, Brett White, told The Verge it was not possible to start a stream and watch live footage in a third-party player such as VLC. The Verge then said it repeatedly watched live footage from two of its own Eufy cameras that way, from across the United States. Ars Technica, on 1 December 2022, reported the same finding: local storage on the device, and a cloud URL that could still show the feed.
This note will not repeat how that address was built. The fact that matters for a buyer is smaller. A company that said the feed could not leave the house had a way to show it somewhere else, and a reporter could use it.
Why a cloud address defeats a local camera
Local storage answers "where does the recording sit when I am home." It does not answer "who else can ask the lens to send a picture." Those are different products. Eufy was marketing the first and operating a version of the second.
The vendor can still open the stream
If the camera will start a live view because a server the company runs asks it to, the company is in the room whenever that path works. Encryption that the app uses on a happy path does not erase a second path that skips it. The Verge's point was not that every owner was being watched that week. The point was that the architecture allowed a live view the advertising had ruled out. Later statements from Anker argued about web-portal fixes and what "end to end" covered. The original sentence customers heard was about footage that never leaves. A cloud player is that sentence failing.
Thumbnails made the same shape of promise smaller and easier to miss. Follow-up reporting the same month said Eufy uploaded preview images, including faces, so push notifications could fire. A thumbnail is still a picture of the room. "We only sent a little of it, briefly, for a notification" is not "it never left."
What Remade cameras are built to refuse
dldeploy.com states the opposite topology in public. Porch cameras, baby monitors, and presence sensors talk on the LAN, keep bytes in the house, and answer to a key the household holds. No daily phone-home. The See brick is cameras and video that stay on the LAN. Under that name, rusty_esp_video and rusty_esp_image are the Remade crates for frames that do not need a vendor decode cloud. Connect is rusty_esp_iroh, the mesh endpoint that replaces a cloud IoT broker and joins MATA Home so local ESP-32 boards find the house, not a landlord. The human frame is why Digital Freedom needs Rust.
A bedroom camera with a speaker is a different failure, and it is the sibling note: a bedroom camera that let a stranger speak. One story is a company that could still open the picture. The other is an account that let a stranger use the microphone. Both end at the same product test.
What a household camera should do instead
Buy, or build, a camera whose only peers are in the house. One user-visible sentence: the feed stays home. One mesh story: the orbs find each other. One crate list you can name under See and Connect. Filter Learn by In The Wild, and read The Importance of Remade With Rust when you want the program rather than the hallway.
The Monday test
Read the camera's page and circle every sentence that says local, private, or end to end. Then ask one question: can a server the company runs still request a live view? If the honest answer is yes, the local card is a storage feature and the cloud is still the product. Open dldeploy.com and ask the same question of See. Open mata.network and ask whether MATA Home is the peer, or whether the board still needs an account before the hallway exists. Flashing from the DLDeploy site and ready-to-go boards are called out as coming next. The crate graph under the camera is already the build target.
Where to look next
The Verge, 30 November 2022, Ars Technica, 1 December 2022, dldeploy in the wild, ESP-32 on MATA Home, the bedroom-camera note, product home dldeploy.com, mesh home mata.network.
FAQ
Quick answers for builders evaluating this technology.
What did Eufy promise about local storage?
Eufy said footage was stored locally, that it never leaves the safety of your home, that streams used end-to-end encryption, and that video went straight to your phone. The Verge reported those promises on 30 November 2022.
What did reporters actually see?
The Verge said it repeatedly watched live footage from two of its own cameras using VLC, from across the United States, after a company spokesperson had said that was not possible. Ars Technica reported the same class of unencrypted remote viewing the next day.
Does a local SD card mean the camera has no cloud?
Not by itself. A card in the camera can still sit next to a vendor address that can open a live view. Local storage is a place the bytes rest. It is not a promise that no one else can ask the camera to send them.
What should a household camera do instead?
Keep frames on the LAN, skip the vendor account, and join the other sensors in the house. That is the DLDeploy claim, built on Remade Edge crates and a MATA Home path that does not need a cloud broker.
Where do I read the original reporting?
Start with The Verge, 30 November 2022, and Ars Technica, 1 December 2022. Then read the DLDeploy field notes if you want the local ESP-32 alternative.