6 ms·

What will happen is some high profile company that has a few Amazon devices on their network will have these devices exploited to gain network access and get hi

by shiado 5y ago

What will happen is some high profile company that has a few Amazon devices on their network will have these devices exploited to gain network access and get hit with some ransomware/data theft/etc... and then there will be a big legal battle between Amazon and the hacked company and this whole idea will be shut down and consumers will get a $10 class action settlement for each device.

rudyfink 5y ago
Maybe not? Most consumer arbitration agreements these days ban asserting class claims. This has been on the rise since 2011: https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepcion https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepc.... In my opinion, this legal change is a huge sleeper story that is behind a number of changes in how customers are getting treated. Since customers can no longer economically avail themselves of the courts to protect themselves en-masse, certain companies find it in their interest to exploit that asymmetry for profit. In other words, a company could always impose a harm on all of its customers for its profit. But, now, if that that company imposes a class ban through arbitration, those customers cannot, collectively, seek recourse for that harm.
- csharptwdec19 5y ago
  It's amazing to watch companies admit they abuse this pattern. A couple years ago I got into it with Comcast over an Identity fraud issue. When I threatened to take them to court for harrassment (I'd sent them more than what was needed to prove I never resided at the address in question) they tried to throw the 'binding arbitration' clause out there... When I told them I never was or would be a customer of theirs and thus wasn't held to their arbitration, they didn't quite know what to say next.
  - 1123581321 5y ago
    Was this a conversation with their legal department?
- zdragnar 5y ago
  Is that really enforceable? Maybe. I suspect that customers are better off not going through class claims anyway, as few of them actually yield amounts close to the harm done, and lawyers walk away with absurd amounts. "Collective" is merely a tool for not clogging courtrooms; there really isn't any other benefit to consumers here.
  - giantg2 5y ago
    Civil and criminal court systems are very overwhelming and just broken in general in my opinion.
- alpha_squared 5y ago
  Another story on the front page right now[0] from the WSJ[1] seems to imply that arbitration clauses fall apart when faced with a mountain of arbitration demands (75k+). Amazon is now seeking to remove its own arbitration clause for customers so that these can be consolidated into a class action lawsuit. [0] https://news.ycombinator.com/item?id=27356550 https://news.ycombinator.com/item?id=27356550 [1] https://www.wsj.com/articles/amazon-faced-75-000-arbitration-demands-now-it-says-fine-sue-us-11622547000 https://www.wsj.com/articles/amazon-faced-75-000-arbitration...
  - jquery 5y ago
    absolutely brilliant
  - tzs 5y ago
    Something like that happened to Doordash a little over a year ago [1] [2]. Workers wanted to start a class action, Doordash used their arbitration clause to stop that. Over 5000 workers then asked for arbitration, which would have cost Doordash around $10 million in arbitration fees. Doordash then tried to get a judge to make it a class action. The judge felt that this Doordash was in this mess due to their own hypocrisy and declined their request. [1] https://www.theverge.com/2020/2/12/21135474/doordash-workers-forced-arbitration-william-alsup https://www.theverge.com/2020/2/12/21135474/doordash-workers... [2] https://www.courthousenews.com/doordash-ordered-to-pay-12m-to-arbitrate-5000-labor-disputes/ https://www.courthousenews.com/doordash-ordered-to-pay-12m-t...
    - fapjacks 5y ago
      I interviewed at Doordash when they were just starting. I think I would have been like employee number twelve or something. To this day, I have not interviewed with a founder that repelled me more.
- setr 5y ago
  I believe there was a successful recent strategy for dealing with this clause by submitting a new lawsuit for each harmed user, to overwhelm everything (courts, company lawyers, etc).
- thathndude 5y ago
  Some attorneys are starting to specialize in consumer arbitration. The attorneys will eventually find a way to put the squeeze on these companies as they try to change the rules.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- adrr 5y ago
  Depends who clicked the agreement and what the company bylaws of who can agree to terms. Some low level IT person will not have the authority to bind the company into an agreement and the injured party is the company. https://www.binadox.com/blog/clickwrap-held-unenforceable-national-auto-lenders-inc-v-syslocate-inc-2010/ https://www.binadox.com/blog/clickwrap-held-unenforceable-na...
- deleted 5y ago
  [deleted]
- kergonath 5y ago
  > Most consumer arbitration agreements these days ban asserting class claims. This really ought to be illegal.
shoto_io 5y ago
I would assume that Amazon has looked into this problem from a legal risk perspective before doing this. Generally, when it comes to risks, you can do 4 things: ARAT (a) Accept the risk (b) Reduce the risk (c) Avoid the risk (d) Transfer the risk (e.g. buy insurance) I guess they do a mix of (a) and (b), since they have deep pockets.
buildbuildbuild 5y ago
This could be somewhat mitigated by VPN tunneling all traffic through Amazon’s edge, not sure of their implementation here but I highly doubt that Amazon overlooked this threat model. The exploit attack vector mentioned is already a risk to any device connected to a sensitive network. VLAN your consumer devices, conference room screens, at minimum.
- mikem170 5y ago
  I'm more worried about this amazon mesh network being used for access by other internet devices. For example, it's not easy to get a dumb TV. If I had one I wouldn't want it online. It appears that Amazon would sell access to the TV manufacturer so that it could spy on me via my neighbours Amazon Sidewalk device. To me this is new threat vector. I don't take kindly to corporations spying on me.
  - m463 5y ago
    5G is the same kind of thing. You can relay traffic through 5G devices that have internet connectivity.
- katbyte 5y ago
  huh i didn't even think about that, plug an amazon device into your network and this mesh allows anyone to connect to it - exploit it and now they are on your internal "Secure" network. brilliant.
mercora 5y ago
this is not different for any other internet connected device on your network. although i doubt its about connectivity to the internet but about connectivity to some backend over the internet. I think it is quite common to assume these risks to be your own problem as is mitigating them. I mean i would probably like it if there is some responsibility for manufactures to make sure it does not happen but i doubt we are even close to something like that.
billh 5y ago
>consumers will get a $10 class action settlement for each device. Worse, it would likely be settled in the same way the Ticketmaster case was settled ... with a 10% off coupon for a Prime membership.
twiddling 5y ago
$10? Ha. How about another year of credit monitoring!
dv_dt 5y ago
More likely, telecom will think, this is against our residential TOS and we can use that to get a slice of the Amazon’s mesh revenue. Especially because most of the telecoms offer side access to wireless routers of their customer for other customers of theirs too. Maybe this is a play by Amazon to be in a better position in this set of future negotiations - one which the average consumer is really a bystander for all the input they have.
jl2718 5y ago
Sidewalk is a separate network that only allows encrypted links back to the AWS cloud. It should not be possible to interact with the host network without two malicious devices, one Trojan with access to the network already, and the other in control of the attacker. Even then, the host would have to give the Trojan access. https://m.media-amazon.com/images/G/01/sidewalk/final_privacy_security_whitepaper.pdf?ots=1&tag=w050b-20&linkCode=w50 https://m.media-amazon.com/images/G/01/sidewalk/final_privac...

by shiado 5y ago

rudyfink 5y ago

Maybe not? Most consumer arbitration agreements these days ban asserting class claims. This has been on the rise since 2011: https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepcion https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepc.... In my opinion, this legal change is a huge sleeper story that is behind a number of changes in how customers are getting treated. Since customers can no longer economically avail themselves of the courts to protect themselves en-masse, certain companies find it in their interest to exploit that asymmetry for profit. In other words, a company could always impose a harm on all of its customers for its profit. But, now, if that that company imposes a class ban through arbitration, those customers cannot, collectively, seek recourse for that harm.

csharptwdec19 5y ago
It's amazing to watch companies admit they abuse this pattern. A couple years ago I got into it with Comcast over an Identity fraud issue. When I threatened to take them to court for harrassment (I'd sent them more than what was needed to prove I never resided at the address in question) they tried to throw the 'binding arbitration' clause out there... When I told them I never was or would be a customer of theirs and thus wasn't held to their arbitration, they didn't quite know what to say next.
- 1123581321 5y ago
  Was this a conversation with their legal department?
zdragnar 5y ago
Is that really enforceable? Maybe. I suspect that customers are better off not going through class claims anyway, as few of them actually yield amounts close to the harm done, and lawyers walk away with absurd amounts. "Collective" is merely a tool for not clogging courtrooms; there really isn't any other benefit to consumers here.
- giantg2 5y ago
  Civil and criminal court systems are very overwhelming and just broken in general in my opinion.
alpha_squared 5y ago
Another story on the front page right now[0] from the WSJ[1] seems to imply that arbitration clauses fall apart when faced with a mountain of arbitration demands (75k+). Amazon is now seeking to remove its own arbitration clause for customers so that these can be consolidated into a class action lawsuit. [0] https://news.ycombinator.com/item?id=27356550 https://news.ycombinator.com/item?id=27356550 [1] https://www.wsj.com/articles/amazon-faced-75-000-arbitration-demands-now-it-says-fine-sue-us-11622547000 https://www.wsj.com/articles/amazon-faced-75-000-arbitration...
- jquery 5y ago
  absolutely brilliant
- tzs 5y ago
  Something like that happened to Doordash a little over a year ago [1] [2]. Workers wanted to start a class action, Doordash used their arbitration clause to stop that. Over 5000 workers then asked for arbitration, which would have cost Doordash around $10 million in arbitration fees. Doordash then tried to get a judge to make it a class action. The judge felt that this Doordash was in this mess due to their own hypocrisy and declined their request. [1] https://www.theverge.com/2020/2/12/21135474/doordash-workers-forced-arbitration-william-alsup https://www.theverge.com/2020/2/12/21135474/doordash-workers... [2] https://www.courthousenews.com/doordash-ordered-to-pay-12m-to-arbitrate-5000-labor-disputes/ https://www.courthousenews.com/doordash-ordered-to-pay-12m-t...
  - fapjacks 5y ago
    I interviewed at Doordash when they were just starting. I think I would have been like employee number twelve or something. To this day, I have not interviewed with a founder that repelled me more.
setr 5y ago
I believe there was a successful recent strategy for dealing with this clause by submitting a new lawsuit for each harmed user, to overwhelm everything (courts, company lawyers, etc).
thathndude 5y ago
Some attorneys are starting to specialize in consumer arbitration. The attorneys will eventually find a way to put the squeeze on these companies as they try to change the rules.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
adrr 5y ago
Depends who clicked the agreement and what the company bylaws of who can agree to terms. Some low level IT person will not have the authority to bind the company into an agreement and the injured party is the company. https://www.binadox.com/blog/clickwrap-held-unenforceable-national-auto-lenders-inc-v-syslocate-inc-2010/ https://www.binadox.com/blog/clickwrap-held-unenforceable-na...
deleted 5y ago
[deleted]
kergonath 5y ago
> Most consumer arbitration agreements these days ban asserting class claims. This really ought to be illegal.

shoto_io 5y ago

I would assume that Amazon has looked into this problem from a legal risk perspective before doing this. Generally, when it comes to risks, you can do 4 things: ARAT (a) Accept the risk (b) Reduce the risk (c) Avoid the risk (d) Transfer the risk (e.g. buy insurance) I guess they do a mix of (a) and (b), since they have deep pockets.

buildbuildbuild 5y ago

This could be somewhat mitigated by VPN tunneling all traffic through Amazon’s edge, not sure of their implementation here but I highly doubt that Amazon overlooked this threat model. The exploit attack vector mentioned is already a risk to any device connected to a sensitive network. VLAN your consumer devices, conference room screens, at minimum.

mikem170 5y ago
I'm more worried about this amazon mesh network being used for access by other internet devices. For example, it's not easy to get a dumb TV. If I had one I wouldn't want it online. It appears that Amazon would sell access to the TV manufacturer so that it could spy on me via my neighbours Amazon Sidewalk device. To me this is new threat vector. I don't take kindly to corporations spying on me.
- m463 5y ago
  5G is the same kind of thing. You can relay traffic through 5G devices that have internet connectivity.
katbyte 5y ago
huh i didn't even think about that, plug an amazon device into your network and this mesh allows anyone to connect to it - exploit it and now they are on your internal "Secure" network. brilliant.

mercora 5y ago

this is not different for any other internet connected device on your network. although i doubt its about connectivity to the internet but about connectivity to some backend over the internet. I think it is quite common to assume these risks to be your own problem as is mitigating them. I mean i would probably like it if there is some responsibility for manufactures to make sure it does not happen but i doubt we are even close to something like that.

billh 5y ago

>consumers will get a $10 class action settlement for each device. Worse, it would likely be settled in the same way the Ticketmaster case was settled ... with a 10% off coupon for a Prime membership.

twiddling 5y ago

$10? Ha. How about another year of credit monitoring!

dv_dt 5y ago

More likely, telecom will think, this is against our residential TOS and we can use that to get a slice of the Amazon’s mesh revenue. Especially because most of the telecoms offer side access to wireless routers of their customer for other customers of theirs too. Maybe this is a play by Amazon to be in a better position in this set of future negotiations - one which the average consumer is really a bystander for all the input they have.

jl2718 5y ago

Sidewalk is a separate network that only allows encrypted links back to the AWS cloud. It should not be possible to interact with the host network without two malicious devices, one Trojan with access to the network already, and the other in control of the attacker. Even then, the host would have to give the Trojan access. https://m.media-amazon.com/images/G/01/sidewalk/final_privacy_security_whitepaper.pdf?ots=1&tag=w050b-20&linkCode=w50 https://m.media-amazon.com/images/G/01/sidewalk/final_privac...