5 ms·

This is becoming the norm: A company gets hacked so they immediately put the responsibility on their customers, and then them off at the knees with arbitration

by Ajay-p 2y ago

This is becoming the norm: A company gets hacked so they immediately put the responsibility on their customers, and then them off at the knees with arbitration demands for any recourse. A reason to NOT buy a Roku.

bnabholz 2y ago
I agree with you that the timing is very coincidental, and it irritates me that you agree to once set of ToS for a device you purchased, and then the company can say "accept the new terms or stop using the device you already paid for." It's crap. However, I don't understand the outrage about this particular incident, and every headline I've seen about it is disingenuous and makes it sound like Roku was breached. If some other service "XYZ" gets hacked and they steal your password, AND that's the same password you use with Roku, AND you didn't bother to turn on 2FA ahead of time, what exactly was Roku supposed to be doing to protect you? If this is Roku's fault, then every service in existence should mandate 2FA with the assumption that their users are reusing a single password on every site. In which case, they might as well ditch the passwords completely and use only an SMS or e-mail verification for login ("magic link").
- eviks 2y ago
  > what exactly was Roku supposed to be doing to protect you? Prevent mass infiltration Especially with close monitoring > start monitoring account activity more closely in March, it said, and this monitoring led to the discovery of a second incident a
- toomuchtodo 2y ago
  Yes, 2FA should be mandatory if you’re not using passkeys. This is straightforward to implement. https://passkeys.directory/ https://passkeys.directory/
m463 2y ago
I think there are other things going on. Companies love to gather a phone number for 2FA. I remember when gas stations were sued because they collected the the zip code at the pumps for security, but then used them for marketing purposes. (I don't know, does roku already require a phone number?)
faeriechangling 2y ago
shrug the inconvenience of 2FA is more a consequence of having accounts in the first place. If something isn't worth using 2FA on it's probably not worth using.

by Ajay-p 2y ago

bnabholz 2y ago

I agree with you that the timing is very coincidental, and it irritates me that you agree to once set of ToS for a device you purchased, and then the company can say "accept the new terms or stop using the device you already paid for." It's crap. However, I don't understand the outrage about this particular incident, and every headline I've seen about it is disingenuous and makes it sound like Roku was breached. If some other service "XYZ" gets hacked and they steal your password, AND that's the same password you use with Roku, AND you didn't bother to turn on 2FA ahead of time, what exactly was Roku supposed to be doing to protect you? If this is Roku's fault, then every service in existence should mandate 2FA with the assumption that their users are reusing a single password on every site. In which case, they might as well ditch the passwords completely and use only an SMS or e-mail verification for login ("magic link").

eviks 2y ago
> what exactly was Roku supposed to be doing to protect you? Prevent mass infiltration Especially with close monitoring > start monitoring account activity more closely in March, it said, and this monitoring led to the discovery of a second incident a
toomuchtodo 2y ago
Yes, 2FA should be mandatory if you’re not using passkeys. This is straightforward to implement. https://passkeys.directory/ https://passkeys.directory/

m463 2y ago

I think there are other things going on. Companies love to gather a phone number for 2FA. I remember when gas stations were sued because they collected the the zip code at the pumps for security, but then used them for marketing purposes. (I don't know, does roku already require a phone number?)

faeriechangling 2y ago

shrug the inconvenience of 2FA is more a consequence of having accounts in the first place. If something isn't worth using 2FA on it's probably not worth using.