3 ms·

How convenient for Roku to announce this breach soon after they forced an arbitration clause change in their ToS

lolinder 3y ago
No one was going to sue them for failing to stop a credential stuffing attack. There are things they could have done to mitigate it, but between the low damages (someone got to stream some stuff on my account for a few days, maybe?) and the fact that sufficiently protecting against credential stuffing is vanishingly rare as an industry practice, there was never going to be a profitable class action lawsuit coming out of this "breach".
- skybrian 3y ago
  If the stock goes down, maybe it’s securities fraud? No arbitration agreement there.
  - gessha 3y ago
    If it is, we’ll probably heard about it from Matt Levine’s newsletter.
- faeriechangling 3y ago
  I feel 23andMe's feet deserved to be held to the fire over a credential stuffing attack, not just because of the sensitivity of the data, but because of how they allowed accounts using insecure authentication methods to access data from other accounts. Roku though? The data stored in a Roku account is not totally insensitive, but it's not seriously sensitive. A lax security posture is justifiable. I would personally not care a bit if somebody infiltrated my Roku account and I don't believe most people would. The accounts mostly exist for Roku's purposes more than their customers. My only concern might be people using my account to authorise charges I did not approve to rent movies, but I don't see why anybody would actually want to do that, since it's a lot more cumbersome than piracy.
  - kevin_thibedeau 3y ago
    The Video Privacy Protection Act is one of the few data protection laws Americans get to enjoy. Legally, video history is more sensitive than things like location tracking data and electronic purchase records. Roku can't adopt a lax security posture in their line of business.
- nickburns 3y ago
  one imagines thorough lawyers always recommend a belt-and-suspenders approach to even the slightest liability potential. and "low damages" (to/for whom?) don't typically inform the feasibility of a class action. it's generally presumable that individual damages are insufficient to justify most individual action—hence class formation/certification. but the 'profitability' of attorneys' fees awards certainly do.
- deleted 3y ago
  [deleted]

No one was going to sue them for failing to stop a credential stuffing attack. There are things they could have done to mitigate it, but between the low damages (someone got to stream some stuff on my account for a few days, maybe?) and the fact that sufficiently protecting against credential stuffing is vanishingly rare as an industry practice, there was never going to be a profitable class action lawsuit coming out of this "breach".

skybrian 3y ago
If the stock goes down, maybe it’s securities fraud? No arbitration agreement there.
- gessha 3y ago
  If it is, we’ll probably heard about it from Matt Levine’s newsletter.
faeriechangling 3y ago
I feel 23andMe's feet deserved to be held to the fire over a credential stuffing attack, not just because of the sensitivity of the data, but because of how they allowed accounts using insecure authentication methods to access data from other accounts. Roku though? The data stored in a Roku account is not totally insensitive, but it's not seriously sensitive. A lax security posture is justifiable. I would personally not care a bit if somebody infiltrated my Roku account and I don't believe most people would. The accounts mostly exist for Roku's purposes more than their customers. My only concern might be people using my account to authorise charges I did not approve to rent movies, but I don't see why anybody would actually want to do that, since it's a lot more cumbersome than piracy.
- kevin_thibedeau 3y ago
  The Video Privacy Protection Act is one of the few data protection laws Americans get to enjoy. Legally, video history is more sensitive than things like location tracking data and electronic purchase records. Roku can't adopt a lax security posture in their line of business.
nickburns 3y ago
one imagines thorough lawyers always recommend a belt-and-suspenders approach to even the slightest liability potential. and "low damages" (to/for whom?) don't typically inform the feasibility of a class action. it's generally presumable that individual damages are insufficient to justify most individual action—hence class formation/certification. but the 'profitability' of attorneys' fees awards certainly do.
deleted 3y ago
[deleted]