7 ms·
Roku says hackers gained access to 576k accounts in latest data-breach incident
- goodklopp 3y agohttps://archive.ph/fY3JN https://archive.ph/fY3JN
- ChrisArchitect 3y agoOfficial post referenced: https://www.roku.com/blog/protecting-your-roku-account https://www.roku.com/blog/protecting-your-roku-account
- cjk2 3y agoArrr another one up for the pirates. Privacy it is!
- SketchySeaBeast 3y agoIf we trust what the company says, it seems like it's another one for using a password manager.
- kalaksi 3y agoNo need for passwords if there's no need for an account
- notatoad 3y agoi mainly use my roku to watch pirated tv shows. not sure how this is a win for pirates. (other than i don't really give a damn if somebody hacks my roku account)
- Razengan 3y ago[flagged]
- deleted 3y ago[deleted]
- hiddencost 3y agoAbsolutely not. You need to lay off the conspiracy theories. Why would you risk an $8.6 billion dollar company for $10,000 of data?
- barbazoo 3y agoHow did you arrive at $10,000?
- duxup 3y agoWhy would they need to cover it up?
- jameshart 3y agoNever ascribe to malice what can easily be explained by carelessness.
- jkic47 3y agoI cancelled my account after the last ToS update, and my Roku is going into the next e-waste collection event. Fortunately, that password was never reused
- AnotherGoodName 3y agoFor those who read even the first paragraph it's a credential stuffing attack. As in people used the same username/password combinations that were leaked or phished. Use a password manager people.
- bdcravens 3y agoThe issue for smart devices, like TVs, is that you often have to type credentials in a tedious way without access to your password manager (other than transcribing it from your phone).
- jameshart 3y agoMost TV apps seem to use the ‘enter this code in a web browser’ auth model which gets around that limitation and allows you to use your browser’s password manager support.
- zamadatix 3y agoYep, or just "scan this QR code on your phone" and auth becomes the same as anything else on your phone.
- bdcravens 3y agoIt's becoming common enough, but I've set up enough smart TVs in the past 2 years to realize it's not universal.
- dylan604 3y agoThe Hulu app on my ATV4k refuses to activate the keyboard input on my other devices like the other apps on my ATV do. I know this because it recently started asking me to re-login for whatever reason, and I have been trying to get my password manager password into the app without using the dumb remote. It just will not do it. Long winded way of saying that other devices do it as well
- sanitycheck 3y ago
- bdcravens 3y agoI have 2 Roku TVs, and I suppose I should be deeply concerned, but at this point, I'm just like "meh". By this time my info has been in enough data breaches of supposedly more secure companies like Adobe and others that I feel like "defensive Internetting" is the only real answer (password managers, single-use credit card numbers when you can, etc)
- lagniappe 3y agomy roku has had a forgotten password for years. does this mean there might be a record of it somewhere so i can get it?
- fecal_henge 3y agoMakes me happy I used a 1 hour throw away email address to satisfy Rokus insane demand that I create an account just to watch TV.
- dylan604 3y ago[flagged]
- LadyCailin 3y agoWhat a terrible attitude. Wanting nice things, even small luxuries, that suit your need is entitlement? This is dark ages thinking.
- fecal_henge 3y agoI have a Roku branded TV. It was a budget option to replace my very old set. When I turned it on would not let me watch anything without creating a Roku account. I am only gathering from your comment that people actually buy a Roku as a device or something? Not entirely sure where buying a cheap tv and avoiding data harvesting equates to entitlement. Seems like keyboard warrior passive agression is quite liberating for you though.
- suck-my-spez 3y agoRoku have turned into a really shitty company. Did they not just update their terms to prevent folk suing? Seems convenient…
- financetechbro 3y agoHow convenient for Roku to announce this breach soon after they forced an arbitration clause change in their ToS
- lolinder 3y agoNo one was going to sue them for failing to stop a credential stuffing attack. There are things they could have done to mitigate it, but between the low damages (someone got to stream some stuff on my account for a few days, maybe?) and the fact that sufficiently protecting against credential stuffing is vanishingly rare as an industry practice, there was never going to be a profitable class action lawsuit coming out of this "breach".
- skybrian 3y agoIf the stock goes down, maybe it’s securities fraud? No arbitration agreement there.
- gessha 3y agoIf it is, we’ll probably heard about it from Matt Levine’s newsletter.
- faeriechangling 3y agoI feel 23andMe's feet deserved to be held to the fire over a credential stuffing attack, not just because of the sensitivity of the data, but because of how they allowed accounts using insecure authentication methods to access data from other accounts. Roku though? The data stored in a Roku account is not totally insensitive, but it's not seriously sensitive. A lax security posture is justifiable. I would personally not care a bit if somebody infiltrated my Roku account and I don't believe most people would. The accounts mostly exist for Roku's purposes more than their customers. My only concern might be people using my account to authorise charges I did not approve to rent movies, but I don't see why anybody would actually want to do that, since it's a lot more cumbersome than piracy.
- dboreham 3y agoThis doesn't sound like a "breach". Rather Roku failed to detect use of weak/compromised passwords by users by attackers who successfully authenticated. Obviously some user data could be leaked but presumably the attackers were selling the accounts for use by others to watch TV?
- faeriechangling 3y agoIt is a breach and credential stuffing attacks can be strongly mitigated with well known security measures. Such as using banned password lists, or measures to detect and block malicious attempts to access accounts by guessing passwords.
- throwaway984393 3y agoAs a consumer I'm sick of seeing these data breaches. The market is not solving this problem. We need legislation to force businesses to do security audits of their products if they collect PII, and fix the bugs in a reasonable time frame. If they don't they need major penalties that are recurring and increase over time. This way a whistleblower can report their company if they fail to properly perform an audit or fail to fix the bugs. This may seem toothless, but avoiding shame and fines is a big motivator for companies in industries where data privacy regulation exists. If we can force them to start investing in security, that reduces the likelihood of security holes sticking around forever, leading to breach.
- deleted 3y ago[deleted]
- blackeyeblitzar 3y agoI have noticed an increasing trend of companies FORCING users into accepting aggressive terms of service by denying them the usage or ownership they're already entitled to. Roku did this famously, but so did Activision Blizzard AKA Microsoft (you can't access your games via Battle.net unless you accept terms), and so did TP Link (you can't access the admin interface for your router unless you accept terms). It's also getting worse in terms of ownership - Ubisoft recently shut down servers for a game called The Crew and then silently started deleting the game from players' libraries (https://www.rockpapershotgun.com/the-crew-has-started-disappearing-from-game-libraries-after-its-closure-last-month https://www.rockpapershotgun.com/the-crew-has-started-disapp...). People think they did this deletion to prevent some kind of workaround to use the game files and play the game locally, but either way, it is a huge violation of the notion of ownership. This will keep continuing until there are consequences for executives and companies - meaning fines, including retroactive ones, and jail time. For now, we need to keep spreading awareness and then pressure lawmakers to do something about it. But techies can just stop paying these companies any more money too.
- spxneo 3y agoside note: not your CDs, not your game.
- tooltower 3y agoEven the CDs these days will often refuse to play without an internet connection.
- kevin_thibedeau 3y agoI'd put that more on the player trying to connect to Gracenote for metadata, cover art, and invasive tracking. CDExtra is dead and no OS will autoplay them so there isn't a way for redbook audio discs to execute code.
- mikestew 3y agoUmm, the topic is game CDs, not music.
- tedunangst 3y agoI wonder how people will react when Netflix starts enforcing two factor auth for logins. You know, industry best practice to stop cred stuffing.
- NoPicklez 3y agoI've seen this article floating around over the last few weeks. It is strange to me that a company would put out a "data breach" notice due to detected credential stuffing attacks. From a reputational perspective I see people reacting thinking their data has been stolen, whilst not realising that this was due to credential stuffing. If I was Roku I wouldn't have said the words "Data Breach" at all, I would just email customers recommending them that they change their password.