Andrew 🌻 Brandt 🐇<p>Well it looks like the <a href="https://infosec.exchange/tags/Roku" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Roku</span></a> <a href="https://infosec.exchange/tags/enshittification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>enshittification</span></a> story is finally taking shape.</p><p>Last week Ars Technica reported that Roku, the streaming-service hardware company, started forcefully insisting that its users accept a terms-of-service change that disallows <a href="https://infosec.exchange/tags/lawsuits" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>lawsuits</span></a>, giving users no choice but to accept the terms or not use their Roku boxes/TVs.</p><p><a href="https://arstechnica.com/gadgets/2024/03/disgraceful-messy-tos-update-allegedly-locks-roku-devices-until-users-give-in/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">arstechnica.com/gadgets/2024/0</span><span class="invisible">3/disgraceful-messy-tos-update-allegedly-locks-roku-devices-until-users-give-in/</span></a></p><p>Now today, we learn that someone has been credential stuffing Roku accounts, then using them to make online purchases using the stored credit card details.</p><p><a href="https://www.bleepingcomputer.com/news/security/over-15-000-hacked-roku-accounts-sold-for-50-each-to-buy-hardware/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/over-15-000-hacked-roku-accounts-sold-for-50-each-to-buy-hardware/</span></a></p><p>Of course, Roku is going to issue refunds for the charges, because they are entirely responsible for protecting their customer data, and failed to do so.</p><p><a href="https://therecord.media/roku-unauthorized-subscriptions-account-refunds" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">therecord.media/roku-unauthori</span><span class="invisible">zed-subscriptions-account-refunds</span></a></p><p>But this <a href="https://infosec.exchange/tags/enshittifcation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>enshittifcation</span></a> of legal terms of service continues. Is there any wonder anymore why Roku was playing hardball to force users to agree to <a href="https://infosec.exchange/tags/arbitration" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>arbitration</span></a> instead of suing the company for negligence? <a href="https://infosec.exchange/tags/TOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TOS</span></a></p>