Roku makes 2FA mandatory for all after nearly 600K accounts pwned | Hacker News Reader

Roku makes 2FA mandatory for all after nearly 600K accounts pwned

theregister.com

23 pointsrntn10 comments

Sadly this article doesn't mention the ToS arbitration change (February 2024) that happened just before this: https://www.tomsguide.com/tvs/your-roku-will-stop-working-un... , where you had to send a physical mail to opt-out of it.

"Listen Jack making people have two factor introduces friction to the signup process, which reduces customers, which reduces growth and profits. Meanwhile if there's a security incident what are they going to do, they can't sue us we made a TOS change that prevents that, so all they can do is b** on the internet. It just doesn't make sense to waste money on security because it isn't our security." - The Roku CEO probably.

This is becoming the norm: A company gets hacked so they immediately put the responsibility on their customers, and then them off at the knees with arbitration demands for any recourse.

A reason to NOT buy a Roku.

I agree with you that the timing is very coincidental, and it irritates me that you agree to once set of ToS for a device you purchased, and then the company can say "accept the new terms or stop using the device you already paid for." It's crap.

However, I don't understand the outrage about this particular incident, and every headline I've seen about it is disingenuous and makes it sound like Roku was breached.

If some other service "XYZ" gets hacked and they steal your password, AND that's the same password you use with Roku, AND you didn't bother to turn on 2FA ahead of time, what exactly was Roku supposed to be doing to protect you?

If this is Roku's fault, then every service in existence should mandate 2FA with the assumption that their users are reusing a single password on every site. In which case, they might as well ditch the passwords completely and use only an SMS or e-mail verification for login ("magic link").

> what exactly was Roku supposed to be doing to protect you?

Prevent mass infiltration

Especially with close monitoring

> start monitoring account activity more closely in March, it said, and this monitoring led to the discovery of a second incident a

Yes, 2FA should be mandatory if you’re not using passkeys. This is straightforward to implement.

https://passkeys.directory/

I think there are other things going on. Companies love to gather a phone number for 2FA.

I remember when gas stations were sued because they collected the the zip code at the pumps for security, but then used them for marketing purposes.

(I don't know, does roku already require a phone number?)

shrug the inconvenience of 2FA is more a consequence of having accounts in the first place. If something isn't worth using 2FA on it's probably not worth using.

[dupe]

Official post: https://www.roku.com/blog/protecting-your-roku-account

More discussion:

https://news.ycombinator.com/item?id=40031256

This is a good defense against a credential stuffing attack, but I don’t know if it is very user friendly

Reply on news.ycombinator.com