ftp upload to private server over eye-fi servers?

[Flix Flux]

hello all,

2 questions concerning security and ftp. i hope, this is the right place to ask.

1)
i want to use the ftp-upload feature to upload images to my private ftp-server.

therefore i need to know, if the files are uploaded *directly* to my private ftp-server, or are they beeing transfered to somewhere else and then transfered to my ftp-server?


2)
where are the ftp-username and ftp-password stored?


cheers,

[MikeV]

If you are sharing your pictures to any internet service, including FTP, the pictures will be uploaded to Eye-Fi's servers, then Eye-Fi's servers will send the pictures to the site.

Only Eye-Fi can answer info about username and password storage... I would imagine that they are stored securely on their servers...

However, it should be noted that FTP is inherently insecure, so even if the username and password were encrypted to the highest level possible on Eye-Fi's servers, they are still transmitted in plain-text form when the connection to your FTP server is made.

[Flix Flux]

Thank you MikeV for your answers. I'm aware of the FTP-Protocol and of its handling with passwords.
What i do not know, is, how eye-fi is handling security.

Saving (encrypted) passwords for my private ftp-server or other web-services on the card is fine with me. saving them on a server, is not what i'd like to do, unless i know how the operating company try to keep m data save&secure.

Only Eye-Fi can answer info about username and password storage...

oh,
I assumed, this is an eye-fi forum and the staff is reading *and answering* here too.

so i will i contact them via support-mail to get a reliable answer to this security issue.

i read some security-realated threads here at the forum and they're very interesting but mostly written by the users, not by the staff.
also, they were quiet old postings, and i'm sure, something has changed the last time.

cheers,

[MadDawgJ]

http://support.eye.fi/what-is-the-eye-f ... cy-policy/

(Short and sweet since I am on a plane getting bounced around in turbulence right now)

[Flix Flux]

Thank you MadDawgJ and a good arrival at the destination airport.

http://support.eye.fi/what-is-the-eye-fi-privacy-policy/

i've read those term before, but they do not answer my specifiy question(s). wether on this topic (), nor this. (or maybe i do not understand)

thesis1:
as far as i understand from the answers of you users here (thank you, btw):
the username/password to write files on my private ftp-server are stored within the eye-fi servers (somewhere within my user-account-data, i guess) to allow the eye-fi-server to transfer those images, which the eye-fi card sent just about, to my ftp-server.

the username/password to write files on my private ftp-server are not stored on the eye-fi-card itself.


thesis2:
i take a photo at home, where the eye-fi-card uses my configured wireless-network to send this photo straight to the eye-fi-server, which send the photo straigth to my ftp-server.

are those two theses true?

[jinjorge]

thesis1:
as far as i understand from the answers of you users here (thank you, btw):
the username/password to write files on my private ftp-server are stored within the eye-fi servers (somewhere within my user-account-data, i guess) to allow the eye-fi-server to transfer those images, which the eye-fi card sent just about, to my ftp-server.

the username/password to write files on my private ftp-server are not stored on the eye-fi-card itself.

correct

[Flix Flux]

thanks a lot!
any answer to my second thesis?

thesis2:
i take a photo at home, where the eye-fi-card uses my configured wireless-network to send this photo straight to the eye-fi-server, which send the photo straigth to my ftp-server.

[randhirv]

therefore i need to know, if the files are uploaded *directly* to my private ftp-server, or are they beeing transfered to somewhere else and then transfered to my ftp-server?

The files go from the Eye-Fi card over your Wi-Fi network to the Eye-Fi servers and then to your FTP server. This is the same path as when you are sending photos to an online sharing site.

[Flix Flux]

summarized, i now know, that *all* the (maybe more or less private) photos i take with my cam go to the eye-fi servers.
ok, thank you all.

[flibbertigibbet007]

unless you don't use websharing this is correct.
I had a similar concern about the privacy policy, since it does not state directly that the photos are not their property, like most sites will say that it is. Nor is there any statement about security or encryption of photos on their servers. Potentially, any eyefi employee can view your uploaded photos at their discretion, without that clause. Or if you want to go one step further, their servers if hacked, from what is not disclosed in the privacy policy, all your photos are available to any hacker if they breach their outlining security.
My concern is more on the lines with their own employees, and the privacy of my data... last I looked at the policy, is no mention of security measures on their servers to protect the data from their prying eyes.

[Flix Flux]

unless you don't use websharing this is correct.
I had a similar concern about the privacy policy, since it does not state directly that the photos are not their property, like most sites will say that it is. Nor is there any statement about security or encryption of photos on their servers. Potentially, any eyefi employee can view your uploaded photos at their discretion, without that clause. Or if you want to go one step further, their servers if hacked, from what is not disclosed in the privacy policy, all your photos are available to any hacker if they breach their outlining security.
My concern is more on the lines with their own employees, and the privacy of my data... last I looked at the policy, is no mention of security measures on their servers to protect the data from their prying eyes.

thanks,
i just wait some years and see what happens on the market.
until then, i return the card and keep in mind, that the hardware and the idea is really great, but the privacy issues are far away from a reasonable using.

funny thing, everyone, i presented the wireless transfer of photos looked surprised and gave a "wow!", until i told them, the terms for transfering (that the pictures are only private, until you transfer them at home directly to your own computer). which makes the card useless for most of them, because if they're at home, they mostly have cables/cardreaders and stuff next to the computer to transfer the data. and if they're out on the field, they surely dont want their pictures saved on a server where nobody knows the admin.

anyway, thank you all here who helped me figuring out the important stuff.

cheers,

[flibbertigibbet007]

Uh, you can buy a license to use "hotspots" meaning you upload from any programmed wireless access point.
May not be the upload from anywhere you're looking for. But the card suits my need, and was well worth the 50$ a year, plus 200gb google storage. I've got a keeper.

I reread your last post, yes my concern is about the privacy too, but I've got written letter stating that they do have securities in place.
Take a minute to voice your concerns to their privacy dept. Privacy@eye.fi make them update their privacy policy.

also it doesn't matter if you upload them at home or not, if you use the webshare service, it's going to their servers. (the point you were trying to make)
No the card does not act as a client to an FTP server, it can to their servers, using hotspot as I understand.
But when you're using hotspotting, you should have more of a concern about the access of your data over insecure networks, not some company like eye.fi taking your pictures. It's also against the law in most states to use any processing power of any technological device that is not yours, or you have permission to use, so if you use the eye.fi card to hotspot to a AP that isn't yours, you should have bigger concerns than eye.fi.

[Flix Flux]

I reread your last post, yes my concern is about the privacy too, but I've got written letter stating that they do have securities in place.
Take a minute to voice your concerns to their privacy dept. Privacy@eye.fi make them update their privacy policy.

i had sent an email over the contact formular stating that i had some questions about privacy and an employe answered one of the questions.
as far (and shortly) i can see, eye-fi does not comment a lot of the security related questions, nor the concerns of the users.
i made the link and if they are interested in the users opinion, they read the postings here and make their descisions upon then.
i cannot and do not need to make them update their privacy policy. there is not need (at least for me) to change anything they do.
i just bring back the card, tell the seller (and my friends), why i am not satisfied with the product and won't buy any other product from a company, which does not fit my needs. (surely, its "try and error"). thats all i can do. thats all i will do :-) i'm happy with that :-D

thanks again for your help and opinion,
cheers,

[flibbertigibbet007]

I reread your last post, yes my concern is about the privacy too, but I've got written letter stating that they do have securities in place.
Take a minute to voice your concerns to their privacy dept. Privacy@eye.fi make them update their privacy policy.

i had sent an email over the contact formular stating that i had some questions about privacy and an employe answered one of the questions.
as far (and shortly) i can see, eye-fi does not comment a lot of the security related questions, nor the concerns of the users.
i made the link and if they are interested in the users opinion, they read the postings here and make their descisions upon then.
i cannot and do not need to make them update their privacy policy. there is not need (at least for me) to change anything they do.
i just bring back the card, tell the seller (and my friends), why i am not satisfied with the product and won't buy any other product from a company, which does not fit my needs. (surely, its "try and error"). thats all i can do. thats all i will do i'm happy with that

thanks again for your help and opinion,
cheers,

But whatever you want to do is fine.

[edited for language]

[Flix Flux]

and this is your attempt to get those postings deleted which cover information which is not found anywhere else (on the companies site) and could help people make descicions on their own, while using offensive language? pretty impressive ;-) hopefully, your written letter about the privacy covered a bit more of good cases.
cheers,

[flibbertigibbet007]

and this is your attempt to get those postings deleted which cover information which is not found anywhere else (on the companies site) and could help people make descicions on their own, while using offensive language? pretty impressive hopefully, your written letter about the privacy covered a bit more of good cases.
cheers,

You're probably from the UK, huh? Sounds like something they'd do.

[edited for language, keep it clean folks]

[MadDawgJ]

Potentially, any eyefi employee can view your uploaded photos at their discretion, without that clause.

Since we do not store your images this actually is not possible. Besides we are kinda busy and don't really have time, or a desire, to look at photos uploaded through our servers

[Flix Flux]

Potentially, any eyefi employee can view your uploaded photos at their discretion, without that clause.

Since we do not store your images this actually is not possible. Besides we are kinda busy and don't really have time, or a desire, to look at photos uploaded through our servers :D

i honestly belive you are telling the truth :-)
but
a) it is possible, because storing process is not encrypted with a secure-key mechanism or something. (where i have the key)

b) files are stored for as long as the upload to the webservice is completed, so, if flickr is unavailable for 3 days, or, i changed my flickr password on the flickr website, without changing it in the eye-fi manager too, images are available as long as they're be uploaded, which can take a while

c) technically you just add some codes to the script which prepares/deletes the images, to copy them anywhere before uploading/deleting them.

d) you wouldnt tell, if you had a desire to look :-))

hey, no offence meant and i really do not believe, that my images are so important for you working at eye-fi people to have any worries,
but there is too less transparency in the process/progress for me as a secure-aware-user.

i simply find it very unusual to be forced to upload my images to the eye-fi servers when trying to upload them to my private ftp-server.

i can understand, that you kinda need the files for uploading them to all the other real webservices, like flickr, etc.

also for statistical surveys its quite a good thing to see how many users are uploading images when and what time and to where/which service, and so on...

so its all understandable, but i simply do not like intransparent security policies (where no technical information is given, nor the user can decide his favored method of storing)

basicly its plain simple: you tell the user, he has 2 options. secure, where he has to live with some limitations. unsecure, where everything is possible he ever dreamt of :-)

anyway,
i think, its all said and i will check your services in some years to see what changed. if. :-)
thank you.

[dmourati]

unless you don't use websharing this is correct.
I had a similar concern about the privacy policy, since it does not state directly that the photos are not their property, like most sites will say that it is. Nor is there any statement about security or encryption of photos on their servers. Potentially, any eyefi employee can view your uploaded photos at their discretion, without that clause. Or if you want to go one step further, their servers if hacked, from what is not disclosed in the privacy policy, all your photos are available to any hacker if they breach their outlining security.
My concern is more on the lines with their own employees, and the privacy of my data... last I looked at the policy, is no mention of security measures on their servers to protect the data from their prying eyes.

As the administrator for the Eye-Fi servers, let me take a moment to try to address your privacy concerns. While I have little (read no) control over the language of our privacy policy, I have considerable control over the safety of our servers. As the topic of this thread relates to our recently-announced FTP service, this discussion will assume you have that feature enabled for the photos in question.

As your photos are uploaded from your card/manager to our systems, they are temporarily stored on a disk system we maintain. From there, they are uploaded to their final FTP destination and deleted. If the FTP system is not available, they are held until such time as they can be transferred and then deleted. The final step is always deletion.

As for your assertion that any Eye-Fi employee could retrieve and view your photos, this is simply not true. While select employees technically could do so, it would only be done in response to a question initiated by you as the customer or as part of troubleshooting. Otherwise, I can assure you, we have more important things to do. This is a time-consuming and involved process.

I have been copied on and following several emails addressed to the privacy contact address. Our responses have been accurate and appropriate. The best analogue I can make to the privacy of your photos is email. Any email you send crosses over at least two mail servers and the administrators of either server could potentially read your email either in transit or from the destination mailbox. Again, the administrator would need a good reason, like troubleshooting, in order to investigate further.

[Flix Flux]

hello and thank you for showing us some more info about "behind the scenes".

in fact, i don't have any concern about the staffs options to peek some pictures. and we don't need to discuss this any more.

but, as an administrator, you probably can explain, why it is necsesary to submit images to an eye-fi server when i only want to transfer them to my private ftp-server.

[dmourati]

in fact, i don't have any concern about the staffs options to peek some pictures. and we don't need to discuss this any more.

OK. Thanks for helping us put those concerns to rest.

but, as an administrator, you probably can explain, why it is necsesary to submit images to an eye-fi server when i only want to transfer them to my private ftp-server.

The reason comes down to where is it possible for us to manage uploads from a software and configuration perspective. We periodically add new upload functionality, such as the FTP-style uploads we are presently discussing. Suffice it to say adding this to a server is more straightforward than trying to change core card functionality. We will continue adding new features and functionality to the service in response to user requests such as these.

Thanks.

[berend]

but, as an administrator, you probably can explain, why it is necsesary to submit images to an eye-fi server when i only want to transfer them to my private ftp-server.

Suffice it to say adding this to a server is more straightforward than trying to change core card functionality. We will continue adding new features and functionality to the service in response to user requests such as these.

And, to add to Demetri's point, believe it or not even something as "standard" as the FTP protocol is nightmare of interoperability when you put all types of FTP servers and options into the mix and those types of problems are far more satisfactorily addressed (from an end-user perspective) using rich clients that can run on servers (as Perl, PHP, etc. extensions) than within the extreme confines of a highly-embedded and resource-constrained firmware environment.

Berend

[Hammertime]

Did you know that when you hide your IP address, you are protecting your identity against piracy? Not even a few people want to go out of their online identity to thank you for identity theft.

those who need your IP to be stolen will find the way to do it((

[nitebrain]

I disagree with the claims made in the admin explanations. If you had built the firmware correctly the first time, you would not have needed to require users to go through your relay servers. And if your excuse is that you want to add new functionality, then it is a weak argument. With 8 gb of space, you could have provided proper software/firmware to enable the users to define their own FTP server accounts, and connect directly with the FTP server of their choice, without having to go through your gatekeeper system. So either you deliver poorly written or incomplete firmware, or you have another motive for requiring the FTP relay proxy.

You are expecting users to trust you when it is not functionally necessary that they enter such a relationship. 100's of FTP client software exists that does not require a relay proxy. If it is a firmware issue, then issue updates that provide the additional functionality. But FTP has been around for decades. There is no reason the technology can't sit on an 8GB card without requiring the middle man approach.

I just wanted to state what I see as an obviously bogus argument presented by the company server admin and others that support the need for the middle man relay approach. Your argument does not hold water.

[nitebrain]

Furthermore, this is a serious privacy / security issue. As stated by others, there is no transparency as to the storage, policies and procedures, guarantees, encryption, restrictions, etc... other than the very lame comments from the administrators such as "we don't have time to look at your pictures" or "we are not interested in looking at them" etc.

Bad apples are everywhere, and I am sure there are / can be / will be some at EyeFi at some point.

This device would be amazing if the FTP was a direct link and did not relay through EyeFi. However, without a direct FTP client, this is just another encumbered bit of kit that is laden with intrusive, unnecessary entanglement with private user data. I suspect the reason for the relay requirement has more to do with mining the data, collecting demographics and selling the data to third parties. After all, this is the Apple era of the "curated user experience".

Another piece of poorly engineered proprietary crap.

[leweq]

I fixed up the previous perl server (eyefitools) a few days ago and got it working with the newer firmware.
IThe perl one I fixed does the card credential validation. The key point is that the card credentials have a slightly different way of being calculated.
The 60 seconds I spent poking at the INTEGRITYDIGEST didn't lead me to seeing how it was calculated, so anything you find in that area would be great.

[MikesTooLz]

This does pose a security issue.

As for your assertion that any Eye-Fi employee could retrieve and view your photos, this is simply not true. While select employees technically could do so, it would only be done in response to a question initiated by you as the customer or as part of troubleshooting.

So basically no employee's could possible looks at our pictures, but if we ask them to... sure they can go right a head a check them.

Photographs we take belong to us. Many people make a living from these very photographs and would not want anyone other than themselves to have original copies of the files. There should be some sort of security measure in place and the details made available. If not, at the very lease there should be something warning users that the pictures are not securely uploaded/stored.

If anyone, I don't care if its only one person at the company can look at our data without requiring some sort of key or authentication directly from the user, The data is not secure from being potentially stolen or viewed by unwanted persons.

We should have the option to transfer media securely while away from the local network of our main PC running Eye-Fi Center.



I think the best way to achieve this while sticking to the same type of implimentations that you are currently using would be to offer users the option to enable a setting in the Eye-Fi Center/SD Card to shift away from Eye-Fi servers and transfer everything directly to the computer running Eye-Fi Center. All data transfers directly from the Eye-Fi Card directly to my Eye-Fi Center Computer securly keeping all data in my control and the Eye-Fi Center then relays the pictures/videos to my final destination. I would then not have to provide my FTP login info to the Eye-Fi servers witch is not stored securely because if it was stored securly the eye-fi servers would not know how to pass along my login credentials to the FTP servers.


That then opens up another security concern that not only can our pictures/videos be looked at by employee's but now all of my FTP login credentials are potentially open for prying eyes of employee's or if the eye-fi servers ever get hacked the attackers could have FTP credentials for all Eye-Fi customers where they could have access to a lot more than just pictures/videos.

[wlsuzuki]

Hi,
The line of privacy violation is so blurry when concerned to personal online data, that every technology company trying to provide digital social experience is facing problems. See Path's recent case: search in Wired site for "Path CEO: ‘We Thought We Were Doing This Right’". No need to remember Facebook or Google+ Search.
So, when Eye-fi's employees argue that our images are deleted from their servers after upload, it sound like a too simplistic answer for a complex question.

I am trying to submit my post, but I receive the message "Your post looks too spamy for a new user, please remove off-site URLs.". Thank you, Eye-fi...

William

[tellytart]

I can actually completely understand the need for the eye-fi card to upload to an intermediate server before going to the final destination.

The eye-fi card draws power from the camera. If the card itself was trying to do FTP connections to remote servers you've defined, the card would have to draw power all the time it's transferring via FTP. Now, as it stands this is no different to going via eye-fi's servers.

However, consider this scenario - your FTP server is under heavy load, or you ISP is suffering s DDOS attack. Your own FTP server response would be very very slow, even perhaps dropping connections. This will mean your camera has to power the eye-fi card a lot longer than usual, draining your camera battery more quickly.

If, however, the card simply transfers to eye-fi's managed servers, they're monitoring the servers to ensure they're responding properly. Your card completes the upload, and no longer draws power from the camera. Eye-fi's servers then do all the hard work of doing the transfer to your FTP site, no matter how many retries it may take, or how slowly the transfer is going.

The intermedia server is there for speed of transfer and to minimise power use of the eye-fi card. The servers cost money to run, eye-fi wouldn't have bothered using an intermediate server like this without thinking about it, and the privacy implications.

And there's another reason too - some wifi hotspots may not allow FTP connections at all, only HTTP. I'm not sure what eye-fi uses to upload to their servers, it's probably HTTP traffic, to ensure compatibility with the majority of WiFi hotspots/firewalls etc.

[pma]

I have to say that I was disappointed that an upload to an FTP site has to be made via the eye-fi servers. It would be less of an issue for me if my online destination was one of the social media sites, but it isn't. How are the files transfered to the eye-fi servers in the first place, ftp??

In the above posts there is mention of the original files being deleted from the eye-fi servers once they are uploaded to the online destination but there isn't any mention of the thumbnail files? As far as I can see you have to manually delete these using the eye-fi center, is there an option to stop the thumbnail creation altogether?

Cheers
Phil