Live data from Hacker News

Roku data breach: Over 15k accounts affected

claimdepot.com

71–80 of 95 posts

Re: Roku data breach: Over 15k accounts affected

#71
> potentially affecting 15,363 individuals in the United States, including 76 in the state of Maine.

Odd that Roku singles out the 0.5% of users affected within the state of Maine. Must be related to some sort of Maine data breach law? I didn't dig too deeply, but not seeing anything explicitly called out in their statutes [0].

[0] https://legislature.maine.gov/legis/statutes/10/title10sec13...

Re: Roku data breach: Over 15k accounts affected

#72
Is this not just credential stuffing?

The article cites these two sources[1][2] which say

> Unauthorized individuals using account credentials believed to have been obtained from third-party source(s) were used to access individual customer accounts

[1] https://apps.web.maine.gov/online/aeviewer/ME/40/e9cc298b-37...

[2] https://oag.ca.gov/system/files/Template%20Notification%203-...

Re: Roku data breach: Over 15k accounts affected

#73

This is absolutely glorious. Days after forcing it's users into mandatory arbitrations this comes out. Would be awesome if holding someone's TV hostage until they agree to not sue you was illegal.

I hope some regulators ask for proof that the breach was “after” and not “the cause of”. It would not shock me to learn that this was the same playbook 23andme used.

Re: Roku data breach: Over 15k accounts affected

#74
post #42
post #7

Related: Ask HN: Fighting back against Roku's forced arbitration? https://news.ycombinator.com/item?id=39503941 (2024-02-25)

It's related as in they are both things about Roku but it's too early to tell if these two events are actually related in some more meaningful way.

The timing is sort of hard not to be suspicious of though, right?

Re: Roku data breach: Over 15k accounts affected

#75

One after the other, can we all assume now that a data breach for any company is not an "if" anymore, just a "when"?

Yeah, this sort of thing must make business harder to do. At least, I try to avoid putting my card into any service I can avoid.

Card won’t be charged during the free trial? Don’t need another copy out there!

Re: Roku data breach: Over 15k accounts affected

#76
This just looks more like Roku had identified significant amounts of credential stuffing across customer accounts. As opposed to someone breaking into the back end of Roku and leaking customer account details.

It could also be targeted credential stuffing given recent events. An interesting tactic to create problems for a company.

I'm not saying Roku is a good company, but this isn't really a data breach but poor credential management by customers.

Re: Roku data breach: Over 15k accounts affected

#77
post #69

Earlier quoted context omitted.

> We hold the power in that we elect the public officials. Very optimistic attitude!

Is it? Just a plain fact. At least in the US

I don't know what you mean by "fact", but your vote certainly holds less proportional power to influence a politician than that of 1/(population of the us). Politicians straight-up don't care about your opinion unless you can show up as a meaningful horde, and judging by the reaction to the Israeli invasion of Palestine that doesn't hold much water either.

Re: Roku data breach: Over 15k accounts affected

#78

For those who don't know, just a week or so ago Roku amended the arbitration clause of their terms of service and soft-bricked every Roku in the US until you Agreed to the new terms. This even extended to TVs from other brands with Roku software, making the TV non-functional even as a dumb display since the Roku software controls input selection AND would ignore any HDMI-CEC commands. I guess we know why now. There i…

My Roku-enabled TV used to bootloop whenever I blocked it from fetching screensaver ads. Support was happy to help. First step: (re)connect to the internet. Second step: disable any network ad blocking. Hmmmmm. People rolled their eyes when I suggested that this was intentional, but these recent revelations strongly suggest that Roku is very comfortable exploiting the hell out of dark patterns. If we don't enact stro…

For years, it has been the case that, when booting up the Roku, the highlighted item would often be a link that would install an app. My kids have accidentally installed so many things. When I tried to remove YouTube, it suggested it below the installed apps, and the kids re-installed it, without having a clue what they were doing and were confused as to why it now showed ads (logged out), when before it didn't (logged in with Premium).

Re: Roku data breach: Over 15k accounts affected

#79
post #69

Earlier quoted context omitted.

Is it? Just a plain fact. At least in the US

I don't know what you mean by "fact", but your vote certainly holds less proportional power to influence a politician than that of 1/(population of the us). Politicians straight-up don't care about your opinion unless you can show up as a meaningful horde, and judging by the reaction to the Israeli invasion of Palestine that doesn't hold much water either.

I literally said that other interests hold outsized power. Not sure what your goal is here.

Re: Roku data breach: Over 15k accounts affected

#80

For those who don't know, just a week or so ago Roku amended the arbitration clause of their terms of service and soft-bricked every Roku in the US until you Agreed to the new terms. This even extended to TVs from other brands with Roku software, making the TV non-functional even as a dumb display since the Roku software controls input selection AND would ignore any HDMI-CEC commands. I guess we know why now. There i…

My Roku-enabled TV used to bootloop whenever I blocked it from fetching screensaver ads. Support was happy to help. First step: (re)connect to the internet. Second step: disable any network ad blocking. Hmmmmm. People rolled their eyes when I suggested that this was intentional, but these recent revelations strongly suggest that Roku is very comfortable exploiting the hell out of dark patterns. If we don't enact stro…

In the "old days," the junkbuster proxy used to return a 128x32(?) blank gif in lieu of an actual block because the page layout would :fu: if the ad wasn't in place and correctly sized. I could easily imagine that might help your situation, too

Don't misunderstand me: it's 100% atrocious that any device bootloops if some ad network 403s, but on the spectrum of "spit into one hand..." and nginx in the other ...

Post reply on HN