Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mystery tracks being 'forced' on your Spotify

bbc.co.uk

Post reply on HN
Print view View original

21–30 of 65 posts

Re: Mystery tracks being 'forced' on your Spotify

#21

Post by Illniyar »

bostik wrote: post #8

Funny, to me this sounds like a hash collision. (For a map key, not the cryptographic kind.) Knowing only that Spotify is a large distributed system, and seeing that the mystery tracks are short in title and length, as well as plentiful, it feels like a these tracks are ending up as collisions in a distributed hash table. From there it'd be a matter of bubbling up top due to sorting order properties.

Are you suggesting that spotify is somewherre using a hash-table without a collision resolution method (like a linked list).

Is that something that is done in some industries? Hash collisions to me has always been a performance problem not a correctness one.

Re: Mystery tracks being 'forced' on your Spotify

#22

Post by dingaling »

TeMPOraL wrote: post #15
kingosticks wrote: post #12

Earlier quoted context omitted.

One guy quoted in the article claims he changed his password a bunch of times and since he's a 'cybersecurity graduate' I'd expect him not to have reused passwords.

I wouldn't put much faith in anything that involves the word "cybersecurity".

I wouldn't put much faith in any graduate, frankly, regardless of discipline. Until they've had a decade to mis-apply what's in their head and make mistakes.

Re: Mystery tracks being 'forced' on your Spotify

#23

Post by y04nn »

aks232 wrote: post #6

Reused passwords that appears in breaches maybe?

It was the case for me last year. I never changed the weak password that I used to create a free account. And the email address was breached in the 2012 LinkedIn hack. The attacker changed the account email to a temporary one and removed all my playlists.

Spotify reacted rapidly and restored my account in few days. But it looks suspicions to me that the attacker was able to change my email without Spotify sending me a confirmation first (my email account was not broken). Also Spotify is missing 2FA that would have prevented this.

Re: Mystery tracks being 'forced' on your Spotify

#24

Post by Sendotsh »

aks232 wrote: post #6

Reused passwords that appears in breaches maybe?

Yup sounds to me like someone got a list of valid Spotify accounts from the recent big breaches, then installed an authorised app to play fake artist songs they generated, to reap in some Spotify profits?

Re: Mystery tracks being 'forced' on your Spotify

#25

Post by maslam »

tikkabhuna wrote: post #20

Very interesting! I had something that sounds similar to this a couple of years ago. My Spotify had a new music "Device" listed with a weird name. Frequently the device would be selected and a song I'd never heard of would start playing, with no sound as it went to the rogue music device. On my Spotify account I could see a new linked application that I hadn't ever setup. I deleted it, kicked out any logins that Spot…

This literally happened to me. Unfortunately with both FB and Alexa. It's concerning to say the least

Re: Mystery tracks being 'forced' on your Spotify

#26

Post by marbletiles »

Accounts are unquestionably being exploited (often via reused passwords). I, along with others I know, have found mystery people squatting in my family plan. I had assumed they were also what were contributing to these weird artists in my history, but perhaps not.

Why does Spotify still not have 2FA? I get that legacy connected devices will be a problem for them, but there are ways around that.

Re: Mystery tracks being 'forced' on your Spotify

#27

Post by joeberon »

This reminds me of a brief period (1 to 2 months) that I went through with Spotify where I'd always open my Spotify to find it playing some random music that I'd never heard of before. Usually some generic "Ibiza mix" stuff or something.

Yet, I tried everything to stop it, assuming I had my account compromised: I logged out all devices, changed my password, but nothing changed until one day it randomly stopped.

They did not change anything at all on my Spotify account, it's as if they just used my account to play music somewhere else. They also never hijacked it while I was using it to try and play their music, it was only when I'd log on it would be playing some other music.

Re: Mystery tracks being 'forced' on your Spotify

#28

Post by kingosticks »

HelenePhisher wrote: post #17
egoisticalgoat wrote: post #10

Earlier quoted context omitted.

Doesn't seem to be the case, as people have already tried changing their password. From the article: >On Reddit, Callum Dixon wrote: "The same Bergenulo Five keeps being played on my account and I've tried everything - changed my password, logged out of everywhere. I can't stop it!"

Sounds like he enabled a shady 3rd party app on Spotify. Access tokens do not change when the password is changed.

Is that normal? Shouldn't they all be redacted when you change your password or is it a convenience feature that they are not?

Re: Mystery tracks being 'forced' on your Spotify

#29

Post by flurdy »

bostik wrote: post #8

Funny, to me this sounds like a hash collision. (For a map key, not the cryptographic kind.) Knowing only that Spotify is a large distributed system, and seeing that the mystery tracks are short in title and length, as well as plentiful, it feels like a these tracks are ending up as collisions in a distributed hash table. From there it'd be a matter of bubbling up top due to sorting order properties.

Definite hash collision, or similar id mismatch. And being included in more aggregated cohort data of suggested music by being overplayed.

I recently tried to play a track and it kept playing a completely different artist and track instead every time I clicked on it. I moaned on Twitter [1] and Spotify replied that the Linux client is not supported... Which is true, just not very helpful, when all I tried was to help them.

[1] https://twitter.com/flurdy/status/1072134634828390400

Re: Mystery tracks being 'forced' on your Spotify

#30

Post by qzy »

maslam wrote: post #25
tikkabhuna wrote: post #20

Very interesting! I had something that sounds similar to this a couple of years ago. My Spotify had a new music "Device" listed with a weird name. Frequently the device would be selected and a song I'd never heard of would start playing, with no sound as it went to the rogue music device. On my Spotify account I could see a new linked application that I hadn't ever setup. I deleted it, kicked out any logins that Spot…

This literally happened to me. Unfortunately with both FB and Alexa. It's concerning to say the least

Well, concerning... I mean, it's Spotify, not your email account.
Post reply on HN