Skip to main content

Roku closes the barn door, badly, after a half-million accounts are compromised

Roku Streaming Stick 4K.
Phil Nickinson / Digital Trends

I gave Roku a bit of a hard time in March after it came to light that some 15,000 accounts were affected in a security breach. To be fair, that breach wasn’t entirely Roku’s fault because it was done via credential stuffing. That’s the method by which credentials are used from some other leak and just tried in various other services in hopes that you’ve reused a password somewhere. That attack netted more than 15,000 hits.

That’s bad enough. Worse was that Roku still didn’t have two-factor authentication, which would have required the evildoers to have a second set of credentials and could have prevented many of the unauthorized entries.

But apparently things actually got worse from there. Roku today announced that the investigation into the 15,000-account breach uncovered a second attack, “which impacted approximately 576,000 additional accounts.” (For context, Roku had 80 million active accounts at the end of 2023.)

Like the first attack, Roku says that “it is likely that login credentials used in these attacks were taken from another source, like another online account, where the affected users may have used the same credentials.” In other words, more credential stuffing. Roku says that fewer than 400 cases saw unauthorized purchases or streaming subscriptions using the payment methods that were attached to those accounts.

All of that is bad. Very bad, actually. (Especially for the 400 accounts that actually saw money change hands.)

Roku finally enables 2FA, sort of

If there’s any good news to come from this, is that’s Roku has finally enabled two-factor authentication. Sort of. First, here’s what Roku had to say in its post announcing the second breach:

“As a part of our ongoing commitment to information security, we have enabled two-factor authentication (2FA) for all Roku accounts, even for those that have not been impacted by these recent incidents. As a result, the next time you attempt to log in to your Roku account online, a verification link will be sent to the email address associated with your account, and you will need to click the link in the email before you can access the account.”

That second part is important. The main two-factor authentication Roku has implemented is that it will send you a link, via email, as the secondary form of authentication. That’s better than nothing. You also can enter the last five digits of your device ID if for some reason you can’t get to your email to click the link.

The email you get if you try to log in to your Roku account.
Roku will now send you an email with a unique, single-use link when you try to log in to your account. Phil Nickinson / Digital Trends

What you don’t get is any options. You can’t choose whether the two-factor authentication is done by “magic link” (wherein the company sends you a temporary link to approve access), or time-based code via SMS or authenticator app. Or some other method. That’s not the end of the world, I suppose. An emailed link is fairly frictionless — provided that the email account itself isn’t also compromised.

But it’s also not without issues.

Post-2FA device activation

Just to test things out, I reset my Roku account password. All subsequent logins have ended up with Roku sending me a email with a link to click, just like Roku said would happen. That works fine in a web browser. I log in with my email and password, then wait a couple seconds for Roku to send me a link to click. Same goes for logging in to the Roku app.

The email received after manually entering your email address when activating a Roku device.
The email received after manually entering your email address when activating a Roku device. Note how it looks different than the email you get if you used the QR code. Phil Nickinson / Digital Trends

But I ran into issues trying to log in to a Roku streaming stick after a hard reset. There are two options here. With one, the Roku device can display a QR code on the TV. Scan it with your phone, and you’re prompted to log in using your email and password. Easy enough. And that login will send you a link via email that you have to click before you’re actually able to do anything on the device you’re trying to activate. Only, it doesn’t appear that the authentication is returned to the device.

But if you choose the option by which you manually type your email using the Roku remote, you’ll be sent a different-looking email. Click that link, and your Roku device will authenticate and activate, just as it should. In other words, it looks like the QR code method is trying to log you in to your account, while the manual method is trying to properly activate the device.

Roku says it’s looking into this part.

The really frustrating part

This really shouldn’t be that difficult. Two-factor authentication is not particularly new. And while any 2FA obviously adds a layer of complexity to any login scheme — and if Roku is known for anything, it’s simplicity — 2FA is also the sort of thing that users have gotten used to over the years.

Roku needs to do a few things. Foremost is that it needs to fix the device authentication. It’s simply broken if you try to use the QR code. (The good news is that should be a server-side fix.) It should allow you to choose your method of authentication. That likely would take a little longer to roll out. But given that Roku should have had proper 2FA set up years ago, that’s hardly an excuse.

Security is always going to be an uphill battle. It’s too easy for the bad guys to play offense. Defense is costly and time-consuming. But it’s not getting any less important. Roku still needs to do better.

Phil Nickinson
Phil spent the 2000s making newspapers with the Pensacola (Fla.) News Journal, the 2010s with Android Central and then the…
Dyson’s strange ‘air-purifying headphones’ get a $200 price cut
The Dyson Zone air-purifying ANC headphones on a model.

For those with lots of cash to spare while looking for headphone deals to buy, you may want to turn your attention to this pair from Dyson -- yes, the brand known for cordless vacuums and bladeless fans. The Dyson Zone, which are noise-canceling headphones with an air purifying function, are available from Best Buy with a $200 discount that slashes their price from $700 to $500. You need to hurry with your purchase if you're interested though, as the offer may expire at any moment.

Why you should buy the Dyson Zone wireless headphones
On the surface, the Dyson Zone appear to be your regular wireless headphones, albeit with a premium price. They offer active noise cancellation using eight microphones that can block unwanted sounds so that you can maintain your focus, and a battery that can last up to 50 hours on a single charge with ANC activated. Their earcups are designed with a seal that keeps your music in and noise out, with micro-suede cushions for all-day comfort. The Dyson Zone also works with the MyDyson app to monitor battery life and make adjustments to EQ settings.

Read more
Legacy cable company invents $180-a-year streaming bundle
A handout image of a TV showing the logos of Netflix, Peacock, and Apple TV Plus.

If you're a customer of Comcast's Xfinity internet or TV business, you now have a new bundle of streaming apps available at a discount. For $15 a month, Xfinity StreamSaver (because you can't sell something that already exists without giving it a funny name, apparently) brings together Netflix, Peacock, and Apple TV+. It'll all be available through Comcast's hardware, of course, but also on other platforms.

On their own, the three services would cost a minimum of $23 a month. That's $7 for Netflix with ads at 1080p resolution, $6 for Peacock Premium with ads, and $10 for Apple TV+. And as it turns out, that's the same level of service you'll get with StreamSaver, saving you about $96 a year. And if you want to get rid of ads or get 4K resolution on Netflix, you can pay the difference for that higher service tier.

Read more
Best Memorial Day soundbar deals: Bose, Sennheiser, Sonos, more
An LG Eclair 3.0 Channel Soundbar sitting on a table in a nice room.

If you've been looking closely at this year's Memorial Day TV deals, then you might've been directed to buy a soundbar. The reasoning is simple: Today's TVs are thin, which is great for your living room space but not that good for generating sound. Fortunately, the solution is also pretty simple: Get a soundbar. Unfortunately, if you've just spent quite a bit of money on a TV, you might not be excited to spend more money on a soundbar. We get it. However, as Memorial Day is in our sights, we've found good early deals on soundbars. Here are the best early discounts happening now.
Best LG soundbar Memorial Day deals

If you have one of the best LG TVs, then you'll likely want an LG soundbar. As you might've guessed, the two just go together. If you match your LG TV with a compatible LG soundbar, the two can team up with the TV Sound Mode Share to provide the TV's processing power alongside your soundbar's. Plus, you won't even need an extra remote. With the right LG TV, you can control your LG soundbar from the same remote. So, if you're an LG TV owner, take advantage of one of these — the best early Memorial Day deals — offers now:

Read more