Hacker News new | past | comments | ask | show | jobs | submit login
[flagged] Roku is cryptolocking TV’s until you give personal data (medium.com/datareallies)
49 points by Thisisthefuture on Nov 20, 2019 | hide | past | favorite | 36 comments



> Disclaimer: by ‘’Lock’’ I mean soft-lock. They do technically allow you to continue without doing do on the payment, but the options are hidden and only available if you look for them. Dark-net patterns are absolutely at work here, and unless you factory reset your TV it’s a freaking brick for the majority of people. Your TV is what I will call ‘’BlueBricked’’

"Cryptolocking" is something I generally associate with malware that encrypts your hard drive and won't give you the decryption key unless you pay a ransom.

This is "there are dark patterns that make it difficult to get past the initial setup screen without signing up for an account", which is not the same at all.


This could have been an informative article. But instead, the writer decided to go all sensationalist clickbait. That's a dark pattern, too.

For the future, I recommend to the writer that he spend less time on sensationalism, and more time on editing.


What is a "Dark-net pattern"? And cryptolocking implies it somehow bricks your TV with some sort of cryptographic security.


The term is dark pattern. Dark-net is something different, author doesn’t know what they’re talking about.


Oh no, it sounds like "cryptolocking" has the potential to be yet another term subsumed into meaning the wrong thing, much like "hacker", "drone", and "bot" have been.

This pattern and cryptolocking both have the common trait that you have to pay to get past a specific point, so I get why this happens: they're indistinguishable from a "typical end user" point of view.

Really, I think "Paywall" is maybe closer to the proper term to use here.


There's a lot wrong with this article, but:

> Lets get something straight here. Gender should ALWAYS be a optional choice.

This is a good take. Many more services should make gender more optional. It's unnecessary for almost all services, it's something that is often used for _poor_ targeting – targeting based on markers in platform activity is likely to yield much better targeting, and unless you spend a lot of time thinking about how to model the answers to that question it has the potential to exclude and offend. Let's just stop asking for it!


Is this a TV with some kind of Roku software built in? I thought Roku was a physical device that you could just unplug.

This is why I will only buy "dumb" TVs that can only display input from external sources.


I agree that buying "dumb" TVs is preferable, but they're often hard to find if you're looking for high-end features.

To quickly include the comments which often come up in similar threads -

There are some TVs you can find at BestBuy without smart features, but they're usually not 4K.

In many cases you can use a "smart" tv, and avoid putting it on your local wifi. Some TVs reportedly require internet access to work at all.

In other cases people have said that the device jumped on a neighbors open wifi without prompting.

People often say that including these "smart" features makes a TV cheaper for a manufacturer, since they can then sell your viewing data.


It's true, the last TV I bought was a dumb 55" that I got for maybe $480. It was hard to find though, and it was a model a few years old at the time. Incidentally I got it from Best Buy. But absolutely, try to find a new TV with top end display tech without smart features? Nigh impossible, unless you pony up for a commercial display.


Just last week I bought a TCL Roku TV. The price was right!

During setup, I declined to connect to WiFi and then set the TV to automatically switch to HDMI 1 when it turns on, and to honor CEC over HDMI so that my external AppleTV box can power it on and off. Taught the AppleTV remote how to handle the volume on the TV, and that's it. The Roku remote is in a drawer, and the TV behaves as a dumb monitor.

I'm not even sure whether it's possible to buy a large TV without software loaded on it, but you don't have to let that software run!


I wonder how long not connecting it to wifi will be a viable option. I wouldn't be surprised if many devices today still attempt to connect to open networks even if you decline to connect it to your home network. Once cell modems are embedded in everything the only option to prevent it from phoning home will be to physically disable the modem or put it in a Faraday cage.


Fortunately, not connecting to wifi also means that my TV's software/firmware won't be updated, so for this particular device, I think it will be a viable option as long as it keeps operating.

Whether TCL will someday close that loophole for future models remains to be seen.


See tvupdate.roku.com; Roku posts USB-loadable firmware updates for all Roku TVs, although it's sometimes not as current as the network-delivered version.


>The price was right!

In my opinion, a "right" price would not encourage the kind of behavior that puts bullshit software on a device in the first place. Also, your TV could be connected to mobile networks and you would not know, although I'm not sure what information they can divine from the TV being on or off, other than the times someone is home or not.


If the TV demanded a network connection to operate, I would have returned it the next day.

My TV could have a secret mobile chip, it's true. So could literally anything brought into my house larger than a chip+antenna. I don't think that a TV would be the first thing I'd suspect.


Good to know. I've heard of some that will nag you to connect to WiFi.


Yeah, there are TVs with Roku built-in. It's the TV's "OS". I thought it was incredibly dumb too until every TV started having an OS, most of them awful, and all of them spying on you unless you stop them. Now, at least the OS is Roku so the performance is pretty good and it's not too weird or crashy. Faster boot-up (ugh) than a lot of others.


yes. as far as smart TVs go, a Roku one is usually the best option because all the other platforms absolutely suck.

I agree with only buying "dumb" TVs


The problem is that "Dumb" TVs are quickly going extinct. They already tend to be more expensive than otherwise equivalent "Smart" TVs, which should give you an idea of how much value is actually added to the TV by these "Smart" features.

It's probably about time for someone to figure out the firmware update process and come with a DD-WRT style open source firmware that doesn't have all of this nonsense.


As long as "smart" TVs still provide for a way to not connect it to any network (this is true for Roku TVs too) it's all good and we can use them as dumb TVs.

Yes, most people may not realize that's an option. But also, yes, the TV price already factors in the financial benefits of getting people's personal information. I remember reading an article on this, oh yes: https://www.businessinsider.com/smart-tv-data-collection-adv...

""" It's not just about data collection. It's about post-purchase monetization of the TV. """


The closest thing is to never let it connect to the internet, plug in a raspi with Kodi on it, and just use that. It's almost perfect


Does anybody here know a good alternative? A device you can connect to a dumb TV to play streaming content that doesn't spy on you? All of the commercially available options seem to be selecting a giant corporation to send all your data to. As a "small" company that does this and nothing else, you would think Roku would be a relatively privacy-focused option, but it appears to be the opposite. I feel like we're being forced to go the Kodi route, which leads to a disturbing correlation of privacy with piracy.


It appears that Apple TV is the most privacy focused out of the box option https://foundation.mozilla.org/en/privacynotincluded/product...

Also I think you might be surprised to learn that ROKU's market cap over $18B and most of that is likely due to their user profiling -- https://www.theverge.com/2018/7/20/17595384/roku-ceo-anthony...


I use an NVIDIA Shield TV and a Pi-Hole, which gives me the advantage / flexibility of the Android ecosystem and the ability to stop some tracking. All subscription streaming providers phone home while you're watching.


I second this while also mentioning that I have not let my TV connect to the internet. It came as a 'smart TV' but I just don't give it access to the internet so it is therefore just a 'dumb' screen with inputs


It seems like you already know the good alternative - anything that can run Kodi, or other software that you control.

A company maximizing their revenue will inevitably end up implementing surveillance - it's a way to take more value from a relationship after the price has already been set. And if you're willing to pay more to avoid surveillance, this just means you're a more valuable target to surveil!

The only way to overcome is to not play by these given rules in the first place. By definition this means you're being a pirate, whether you're looking for ways to compensate the creators or not.


"As a "small" company that does this and nothing else, you would think Roku would be a relatively privacy-focused option, but it appears to be the opposite."

Roku is not just a physical device, or an OS. It's also in the advertising business. They stream video ads and display ads when you watch certain shows through Roku. Thus, they want to know a lot more about you to show you relevant ads.


Indeed. Judging from my PiHole logs, my Roku is trying to phone home quite a lot. Of course, the PiHole is preventing that...


A Raspberry Pi has HDMI out and can run Linux, for a more Roku-like experience you could try installing Android on it.


The best solution is just a computer. Put Windows or Linux on it, whatever you prefer. It can play literally all content. You can install adblockers, whatever you like.


This looks like an Oauth2-like pin code flow. My guess is it’s doing this because Roku are requiring logged in users to access the software. This isn’t unheard of. I’d argue that it’s highly beneficial.

But if this is the main OS of the TV, and this is a requirement to use external inputs. Then fuck this.

I think my Sony Android TV allowed me to skip user login during setup. I might be wrong because I logged in then subsequently put it on my “Internet of Shit” VLAN, where all the other terrible crap goes.


This article is poorly structured to be polite.

I recently set one of these up for my daughter, and there is indeed no way to use the display without a Roku account, and that does require a credit card, and sneakily tries to get you to sign up for trials, as the article mentions. It took a lot of effort for me to make sure my (3 year old) couldn't order HBO, etc.

Had I known that, I woudln't have bought it. It's easy to envision a future where Roku is out of business and this tv can't be activated again if needs be.


During setup, you can choose to not connect to a network and you don't have to link the TV. Also, once you get to this screen, hitting star will bring up a help menu; asking for more help will let you factory reset the TV and start setup again where you can skip a network connection.


The article doesn't explain one thing - what is Roku TV? I tried googling but the first result is the Facebook Portal device, and then their own website says it's a Hisense TV?


These appear to be different than "smart TVs" which offer Roku built-in as an optional app

Instead of spending all this time writing an article and on.the phone, they should have returned it and got another brand of TV


Wouldn't blocking the tv's MAC from the router solve this problem along with blocking any data collection as well?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: