9 ms·

In wake of data breach – Samsung forcing users to accept T&CS or risk their data

147 points by dddavid 4y ago

metadat 4y ago
tl;dr: > Whether or not Samsung’s updated terms affect you, you’ll have to accept them in order to get the reassurance that no-one has logged into your Samsung account, and is currently monitoring your whereabouts using the “find my device” feature, checking out your frequent locations in “Places”, or using your profile pic to create fake accounts elsewhere. If you don’t want to accept terms and conditions foisted on you with the barest nod towards consent, well, that’s tough really. Android users might unknowingly be victims of location monitoring by a hacker, and users are forced to accept new ToS just to verify whether this is or isn't happening. Yuck, what a user-hostile privacy+security mess. A total failure on the "Keep-Users-Safe" front.
- kramerger 4y ago
  I think this is just the legal department going crazy, probably has no connection to reality. Anyway, I deleted my Samsung account mostly because of the annoying ToS updates I received frequently. Kind a shame really, I very much liked Samsungs voice assistent. That was actually the main reason I created the Samsung account...
cryptonector 4y ago
> One new aspect which may scare Samsung customers is: > “We respect the intellectual property rights of others. We may suspend or delete an account or stop providing all or part of our Services to an account if we reasonably believe that such an account has repeatedly infringed intellectual property rights.” > The terms don’t say what constitutes reasonable belief. You have no digital rights. And yes, it's a private company, blah blah blah. But you still have no digital rights. And most everything happens on the Internet now. Think.
- googlryas 4y ago
  The terms also don't define "intellectual property". Or "respect". Or "that". Reasonable belief is a well understood concept. It doesn't need a definition in the terms of service. A judge reviewing a complaint by a party against Samsung will understand what "reasonable belief" means. > But you still have no digital rights. I think you're confused. It seems like you want Samsung to not have digital rights. You have digital rights, but not to use someone else's system in a manner which they don't want. If they operate a system, they have a right to specify how users can and can't utilize the system. You have the same rights.
  - deleted 4y ago
    [deleted]
  - cryptonector 4y ago
    The problem here is that due process is extremely expensive to obtain. Let's say you have reverse engineered something, but the IP holder claims you stole it, so the provider shuts you down, and now you're losing money and you have to file a lawsuit in a possibly-hostile, far flung jurisdiction, and it may take weeks to get injunctive relief (if you get it), and months or years to settle the case, and all of this while having lost your income and having to foot hefty legal bills. Few will bother. The effect is chilling. Thus, "reasonable belief", while a legal term of art, is pretty meaningless to users. > It seems like you want Samsung to not have digital rights. I wrote nothing of the sort. But now that you put me on the spot, I'll tell you what I want: either that users get better access to due process, or that common carriers to have less power over what they carry (not zero power, just less), or both. While it's true that there are expensive, abusive users out there, we need to strike a better balance for all the users who aren't.
    - googlryas 4y ago
      What would "access to due process" look like to you?
      - 4y ago
kmeisthax 4y ago
>They also remove the prohibition against class action lawsuits, and allow disputes to be settled in court instead of through arbitration. This is actually good news for litigation-minded Samsung customers - especially in light of certain recent data breaches and unnecessary delays in reporting them. Fun fact: much of this is because lawyers started telling people how to launch arbitration en-masse, and it turns out you cannot legally compel arbitration without also offering to pay for it. And since there's no class-action provision with most arbitration companies, it was actually more expensive to compel arbitration than to just take the class-actions.
- dataflow 4y ago
  Companies have started prohibiting mass arbitration in their ToS in response. Edit 1: Since people requested an example, here's Adobe's: > The Notice of Claim must provide Adobe with fair notice of your identity, a description of the nature and basis of your Claim, and the relief you are seeking, including the specific amount of any monetary relief you are seeking, and cannot be combined with a Notice of Claim for other individuals. Edit 2: Here's Venmo's, which is more comprehensive (https://venmo.com/legal/us-user-agreement/ https://venmo.com/legal/us-user-agreement/): > You and PayPal agree that each of us may bring claims against the other only on an individual basis and not as a plaintiff or class member in any purported class or representative action or proceeding. Unless both you and PayPal agree otherwise, the arbitrator may not consolidate or join more than one person's or party's claims and may not otherwise preside over any form of a consolidated, representative or class proceeding. Also, the arbitrator may award relief (including monetary, injunctive and declaratory relief) only in favor of the individual party seeking relief and only to the extent necessary to provide relief necessitated by that party's individual claim(s). Any relief awarded cannot affect other PayPal or Venmo customers.
  - AlexandrB 4y ago
    How do you prohibit something like that? "Disputes are solved through arbitration, unless a bunch of other people want to do it too, then..."?
zeristor 4y ago
My LG TV has a new Agreement. I guess I’ll just unplug the network table, assuming it can’t tunnel back up the HDMI cable to my Apple TV.
- WithinReason 4y ago
  How would it be able to? Does the TV, the cable and the Apple TV all support Ethernet over HDMI?
  - GauntletWizard 4y ago
    Who knows? As you said, there's a pretty clear channel for it, and would be advertised as a feature for all those devicves.
  - wtallis 4y ago
    Has anything ever supported Ethernet over HDMI?
- nerdponx 4y ago
  Just wait until TVs have 5G built in and you won't have the ability to turn it off.
  - preisschild 4y ago
    The real dangers of 5G :)
kleiba 4y ago
And if you created your account before September 2021, Samsung is under no obligation to notify you when those terms change - unless you attempt to log into your online account, that is. Wouldn't that depend on which legislation you live in?
- Tijdreiziger 4y ago
  I live in the Netherlands, created my account before September 2021, and Samsung keeps sending notifications to my phone urging me to accept their new terms.
  - kramerger 4y ago
    Yeah, those are really annoying (and they change their terms every 3-4 months). I latsed 6 months, then deleted the Samsung account out of frustration. If anyone from Samsung is reading this: please don't let the legal department have control over these kind of user-facing things.
    - Tijdreiziger 4y ago
      Yeah, I need to replace my phone soon and then I'm getting rid of the account too. I created it when I set up my current phone, but I'm not sure if it even adds anything over a Google account.
walrus01 4y ago
> the new terms are instead, “governed and construed in accordance with the laws of the jurisdiction where you are a resident.” This could be good or bad, depending on where you live. I'd like to see what happens when someone in Afghanistan with a late-model Samsung android phone files a lawsuit against them in the Taliban's local sharia law court.
- gambiting 4y ago
  Absolutely nothing because obviously they won't show up, Samsung doesn't have any presence in Afganistan, and Taliban do not have any ability to enforce their rulings outside of Afganistan.
- HarryHirsch 4y ago
  You may laugh, but the local sharia judges generally have a reputation of being impartial and of not taking bribes. Apparently it's not uncommon to agree to have a dispute arbitrated by a kadi both parties agree on. Regular court is just hopelessly corrupt.
- vorpalhex 4y ago
  I know this is tongue-in-cheek, but one of the reasons why the Taliban was tolerated in many areas is because they had very comprehensive courts that took cases quickly and gave justice swiftly (but probably not very fairly). There is a story of a taliban fighter who had stolen from a local. The local opened a case at the local taliban court. Judge agreed with the local and whacked off the fighters hand right there. Anyways, Samsung v Owner in a taliban court would be entertaining for sure.
  - int_19h 4y ago
    I talked to a refugee from Afghanistan sometime back in 2005. He said that Taliban were extremist fanatics, but also claimed that they were the only faction under whom stable living was possible at the time, because, harsh as their laws were, they at least had laws and enforced them more or less consistently. OTOH, he claimed that Northern Alliance was little more than looters and rapists in practice, regardless of declared goals. I found that an interesting take, and perhaps it explains why Taliban could take over so quickly once US moved out (given that the US-backed Afghan govt was effectively the continuation of the Northern Alliance).
systematical 4y ago
I'm more interested to see how this guys raspberry pi server holds up.
- walrus01 4y ago
  Probably pretty well, as the content seems to be static HTML, any sensible apache2 or nginx configuration (And linux kernel storage-to-ram caching) will keep the frequently-accessed HTTP GET requests in RAM. And a raspberry pi with 4 or 8GB of RAM has enough resources for quite a lot of simultaneous threads.
- dddavid 4y ago
  Past experience with articles making it to HN FP show it can handle up to around 3K visits /hour without too much trouble. Maybe more, but my Matomo analytics instance tends to give up around then. Right now it's pulling maybe 700 visits/ hour. If it starts looking bad, I'll move the site onto a VPS
- Macha 4y ago
  A pi 4b is more power than the basic 1 vcpu, 1gb or 2gb VPSes a lot of personal blogs on this site use. If it's a static site (and it appears to be, meta generator=Jekyll) then a pi 4b should be plenty for HN.
dimensionc132 4y ago
The hack shows, that users data is at risk regardless of whether users accept the T&Cs.....how moronic to think that accepting new T&C will somehow negate another hack or data breach. I guess normies will believe it ... :(
DanAtC 4y ago
Samsung is such a trash company with garbage products. Why people are willing to pay them a premium is beyond me.
chris_wot 4y ago
Well, that's good. In Australia, we have some pretty tough privacy laws.

147 points by dddavid 4y ago

tl;dr: > Whether or not Samsung’s updated terms affect you, you’ll have to accept them in order to get the reassurance that no-one has logged into your Samsung account, and is currently monitoring your whereabouts using the “find my device” feature, checking out your frequent locations in “Places”, or using your profile pic to create fake accounts elsewhere. If you don’t want to accept terms and conditions foisted on you with the barest nod towards consent, well, that’s tough really. Android users might unknowingly be victims of location monitoring by a hacker, and users are forced to accept new ToS just to verify whether this is or isn't happening. Yuck, what a user-hostile privacy+security mess. A total failure on the "Keep-Users-Safe" front.

kramerger 4y ago
I think this is just the legal department going crazy, probably has no connection to reality. Anyway, I deleted my Samsung account mostly because of the annoying ToS updates I received frequently. Kind a shame really, I very much liked Samsungs voice assistent. That was actually the main reason I created the Samsung account...

cryptonector 4y ago

> One new aspect which may scare Samsung customers is: > “We respect the intellectual property rights of others. We may suspend or delete an account or stop providing all or part of our Services to an account if we reasonably believe that such an account has repeatedly infringed intellectual property rights.” > The terms don’t say what constitutes reasonable belief. You have no digital rights. And yes, it's a private company, blah blah blah. But you still have no digital rights. And most everything happens on the Internet now. Think.

googlryas 4y ago
The terms also don't define "intellectual property". Or "respect". Or "that". Reasonable belief is a well understood concept. It doesn't need a definition in the terms of service. A judge reviewing a complaint by a party against Samsung will understand what "reasonable belief" means. > But you still have no digital rights. I think you're confused. It seems like you want Samsung to not have digital rights. You have digital rights, but not to use someone else's system in a manner which they don't want. If they operate a system, they have a right to specify how users can and can't utilize the system. You have the same rights.
- deleted 4y ago
  [deleted]
- cryptonector 4y ago
  The problem here is that due process is extremely expensive to obtain. Let's say you have reverse engineered something, but the IP holder claims you stole it, so the provider shuts you down, and now you're losing money and you have to file a lawsuit in a possibly-hostile, far flung jurisdiction, and it may take weeks to get injunctive relief (if you get it), and months or years to settle the case, and all of this while having lost your income and having to foot hefty legal bills. Few will bother. The effect is chilling. Thus, "reasonable belief", while a legal term of art, is pretty meaningless to users. > It seems like you want Samsung to not have digital rights. I wrote nothing of the sort. But now that you put me on the spot, I'll tell you what I want: either that users get better access to due process, or that common carriers to have less power over what they carry (not zero power, just less), or both. While it's true that there are expensive, abusive users out there, we need to strike a better balance for all the users who aren't.
  - googlryas 4y ago
    What would "access to due process" look like to you?
    - 4y ago

kmeisthax 4y ago

>They also remove the prohibition against class action lawsuits, and allow disputes to be settled in court instead of through arbitration. This is actually good news for litigation-minded Samsung customers - especially in light of certain recent data breaches and unnecessary delays in reporting them. Fun fact: much of this is because lawyers started telling people how to launch arbitration en-masse, and it turns out you cannot legally compel arbitration without also offering to pay for it. And since there's no class-action provision with most arbitration companies, it was actually more expensive to compel arbitration than to just take the class-actions.

dataflow 4y ago
Companies have started prohibiting mass arbitration in their ToS in response. Edit 1: Since people requested an example, here's Adobe's: > The Notice of Claim must provide Adobe with fair notice of your identity, a description of the nature and basis of your Claim, and the relief you are seeking, including the specific amount of any monetary relief you are seeking, and cannot be combined with a Notice of Claim for other individuals. Edit 2: Here's Venmo's, which is more comprehensive (https://venmo.com/legal/us-user-agreement/ https://venmo.com/legal/us-user-agreement/): > You and PayPal agree that each of us may bring claims against the other only on an individual basis and not as a plaintiff or class member in any purported class or representative action or proceeding. Unless both you and PayPal agree otherwise, the arbitrator may not consolidate or join more than one person's or party's claims and may not otherwise preside over any form of a consolidated, representative or class proceeding. Also, the arbitrator may award relief (including monetary, injunctive and declaratory relief) only in favor of the individual party seeking relief and only to the extent necessary to provide relief necessitated by that party's individual claim(s). Any relief awarded cannot affect other PayPal or Venmo customers.
- AlexandrB 4y ago
  How do you prohibit something like that? "Disputes are solved through arbitration, unless a bunch of other people want to do it too, then..."?

zeristor 4y ago

My LG TV has a new Agreement. I guess I’ll just unplug the network table, assuming it can’t tunnel back up the HDMI cable to my Apple TV.

WithinReason 4y ago
How would it be able to? Does the TV, the cable and the Apple TV all support Ethernet over HDMI?
- GauntletWizard 4y ago
  Who knows? As you said, there's a pretty clear channel for it, and would be advertised as a feature for all those devicves.
- wtallis 4y ago
  Has anything ever supported Ethernet over HDMI?
nerdponx 4y ago
Just wait until TVs have 5G built in and you won't have the ability to turn it off.
- preisschild 4y ago
  The real dangers of 5G :)

kleiba 4y ago

And if you created your account before September 2021, Samsung is under no obligation to notify you when those terms change - unless you attempt to log into your online account, that is. Wouldn't that depend on which legislation you live in?

Tijdreiziger 4y ago
I live in the Netherlands, created my account before September 2021, and Samsung keeps sending notifications to my phone urging me to accept their new terms.
- kramerger 4y ago
  Yeah, those are really annoying (and they change their terms every 3-4 months). I latsed 6 months, then deleted the Samsung account out of frustration. If anyone from Samsung is reading this: please don't let the legal department have control over these kind of user-facing things.
  - Tijdreiziger 4y ago
    Yeah, I need to replace my phone soon and then I'm getting rid of the account too. I created it when I set up my current phone, but I'm not sure if it even adds anything over a Google account.

walrus01 4y ago

> the new terms are instead, “governed and construed in accordance with the laws of the jurisdiction where you are a resident.” This could be good or bad, depending on where you live. I'd like to see what happens when someone in Afghanistan with a late-model Samsung android phone files a lawsuit against them in the Taliban's local sharia law court.

gambiting 4y ago
Absolutely nothing because obviously they won't show up, Samsung doesn't have any presence in Afganistan, and Taliban do not have any ability to enforce their rulings outside of Afganistan.
HarryHirsch 4y ago
You may laugh, but the local sharia judges generally have a reputation of being impartial and of not taking bribes. Apparently it's not uncommon to agree to have a dispute arbitrated by a kadi both parties agree on. Regular court is just hopelessly corrupt.
vorpalhex 4y ago
I know this is tongue-in-cheek, but one of the reasons why the Taliban was tolerated in many areas is because they had very comprehensive courts that took cases quickly and gave justice swiftly (but probably not very fairly). There is a story of a taliban fighter who had stolen from a local. The local opened a case at the local taliban court. Judge agreed with the local and whacked off the fighters hand right there. Anyways, Samsung v Owner in a taliban court would be entertaining for sure.
- int_19h 4y ago
  I talked to a refugee from Afghanistan sometime back in 2005. He said that Taliban were extremist fanatics, but also claimed that they were the only faction under whom stable living was possible at the time, because, harsh as their laws were, they at least had laws and enforced them more or less consistently. OTOH, he claimed that Northern Alliance was little more than looters and rapists in practice, regardless of declared goals. I found that an interesting take, and perhaps it explains why Taliban could take over so quickly once US moved out (given that the US-backed Afghan govt was effectively the continuation of the Northern Alliance).

systematical 4y ago

I'm more interested to see how this guys raspberry pi server holds up.

walrus01 4y ago
Probably pretty well, as the content seems to be static HTML, any sensible apache2 or nginx configuration (And linux kernel storage-to-ram caching) will keep the frequently-accessed HTTP GET requests in RAM. And a raspberry pi with 4 or 8GB of RAM has enough resources for quite a lot of simultaneous threads.
dddavid 4y ago
Past experience with articles making it to HN FP show it can handle up to around 3K visits /hour without too much trouble. Maybe more, but my Matomo analytics instance tends to give up around then. Right now it's pulling maybe 700 visits/ hour. If it starts looking bad, I'll move the site onto a VPS
Macha 4y ago
A pi 4b is more power than the basic 1 vcpu, 1gb or 2gb VPSes a lot of personal blogs on this site use. If it's a static site (and it appears to be, meta generator=Jekyll) then a pi 4b should be plenty for HN.

dimensionc132 4y ago

The hack shows, that users data is at risk regardless of whether users accept the T&Cs.....how moronic to think that accepting new T&C will somehow negate another hack or data breach. I guess normies will believe it ... :(

DanAtC 4y ago

Samsung is such a trash company with garbage products. Why people are willing to pay them a premium is beyond me.

chris_wot 4y ago

Well, that's good. In Australia, we have some pretty tough privacy laws.