5 ms·
For those who read even the first paragraph it's a credential stuffing attack. As in people used the same username/password combinations that were leaked or phi
by AnotherGoodName 3y ago
For those who read even the first paragraph it's a credential stuffing attack. As in people used the same username/password combinations that were leaked or phished.
Use a password manager people.
- bdcravens 3y agoThe issue for smart devices, like TVs, is that you often have to type credentials in a tedious way without access to your password manager (other than transcribing it from your phone).
- jameshart 3y agoMost TV apps seem to use the ‘enter this code in a web browser’ auth model which gets around that limitation and allows you to use your browser’s password manager support.
- zamadatix 3y agoYep, or just "scan this QR code on your phone" and auth becomes the same as anything else on your phone.
- bdcravens 3y agoIt's becoming common enough, but I've set up enough smart TVs in the past 2 years to realize it's not universal.
- dylan604 3y agoThe Hulu app on my ATV4k refuses to activate the keyboard input on my other devices like the other apps on my ATV do. I know this because it recently started asking me to re-login for whatever reason, and I have been trying to get my password manager password into the app without using the dumb remote. It just will not do it. Long winded way of saying that other devices do it as well
- sanitycheck 3y agoFunnily enough, Roku now explicitly disallows this and will reject any paid app on their platform that tries to use it. (Although Netflix, Amazon, etc can do what they like as usual.)
- Larrikin 3y agoThe keyboard on phone is now on every smart TV platform, Roku included. There's no situation where I wouldn't want to go and fetch my phone instead of hunting down the on screen letters for my username and password.
- bdcravens 3y agoWithout setting up the TV partially and downloading an app? You can also add a bluetooth keyboard to most TVs as well.
- carlosjobim 3y agoNot to the Roku. And many casual watchers are allergic to the thought of using a keyboard with the TV.
- Larrikin 3y agoWhat is the situation where the smart tv doesn't have the internet where you need to log in? My wifi password is specifically easy to input on any device. If you're already buying a smart tv device and putting it on your network, downloading an app that gives you better control over it doesn't seem like a step too far. Especially with phone permissions being more finely grained than whatever the box itself is doing.
- bdcravens 3y agoFor the typical HN user, but my original point was that the users likely to get breached via credential stuffing are going to take as many shortcuts as possible.
- prmoustache 3y agothe use passphrases that you can easily read from your password manager and type it.
- paxys 3y agoYou can create a password that consists entirely of lowercase letters that is easy to enter on such a keyboard and also secure. The point is to not reuse it on your other accounts.
- tmpz22 3y ago> that is easy Anyone who has supported digital devices for friends and family (especially elderly ones) knows it is in fact not easy. These accounts exist for the commercial benefit of companies. They could tie authorization to the hardware if they wanted to, like it used to be before the internet, but they don't. The idea that consumers need to do data and security management for the commercial benefit of corporations has gotten absurd. We're doing their IT for them, and still getting hacked even when we do it right. Remember Equifax? Pepperidge farms remembers Equifax.
- bdcravens 3y agoall lower case won't pass many password requirements. That said, it's possible to come up with an easy to remember scheme and is unique (like {ServiceName}@{houseNumber} or the like).
- suzzer99 3y agoMy mom did this with the name of the website and her birthday. Amazingly, hackers figured out her cypher.
- barfbagginus 3y agoThat's not too amazing if we're cracking a leaked password database. In that case, we generate passwords and try them against every (hash, salt) pair in the database. We can usually crack 60 percent of a database this way, and more if we use AI driven cracking (PassGAN, 2017). It makes sense to try variants of "netflix{birthday}" early on, since that uncovers a significant portion of the database. Your mom would have just been unlucky to be part of that low-hanging cohort.
- bdcravens 3y ago
- oezi 3y agoI hate how Chromecasting is being phased out by Google over GoogleTV (or whatever they call it now). Just playing from your mobile phone alleviated this issue perfectly. Now Netflix for instance hijacks your cast command to force a login on Samsung TVs
- gessha 3y agoGoogle will never come up with a branding and stick to it. They could’ve built a better walled garden than Apple but chose not to because it doesn’t align with their financials currently and their org is basically 100 startups in a trench coat all funded by ads.
- ajross 3y agoChromecast isn't being phased out, not sure what you mean? Your issue with Netflix is how the Netflix app works, it wants a second layer of authentication, and the nature of the framework (it's not just streaming video from a device, it's basically an app that gets beamed over so the device can do the streaming itself) is that they can put up whatever they want. Do the same thing with Youtube and it's seamless. Try it with AppleTV and there's no support at all (beyond trickery like casting a browser window). Big Tech can't agree on this stuff and never will as long as there's a garden wall to build.
- oezi 3y agoI just meant that Google is focusing more on their AndroidTV/GoogleTV way of doing things (apps on the TV) than continuing working towards casting from mobile devices onto the TV. This lack of focus on Casting is certainly causing it feel like it is becoming obsolete. For instance many Android apps now have bugs when it comes to casting (stuttering video or the cast button only showing up when restarting the app).
- cdurth 3y agoI received the email saying i was included. I use a PW manager.
- noiv 3y agoDon't like all eggs in one basket.
- nickburns 3y agosome baskets are more secure (e.g. an encrypted database) than others (e.g. your head).
- jwagenet 3y agoMy head is more secure than any database, but it is lossy.
- nickburns 3y agohead lacks sufficient memorization capacity lending to proneness to credential reuse—which, in this specific context, makes it inherently less secure. but i would agree head is safer than any other basket, definitely.