Enlarge (credit: Getty Images)

Everyone with a Roku TV or streaming device will eventually be forced to enable two-factor authentication after the company disclosed two separate incidents in which roughly 600,000 customers had their accounts accessed through credential stuffing.

Credential stuffing is an attack in which usernames and passwords exposed in one leak are tried out against other accounts, typically using automated scripts. When people reuse usernames and passwords across services or make small, easily intuited changes between them, actors can gain access to accounts with even more identifying information and access.

In the case of the Roku attacks, that meant access to stored payment methods, which could then be used to buy streaming subscriptions and Roku hardware. Roku wrote on its blog , and in a mandated data breach report , that purchases occurred in "less than 400 cases" and that full credit card numbers and other "sensitive information" was not revealed.

Enlarge / A promotional image for a Roku TV. (credit: Roku )

Roku TV sets come with ads. Generally, these are restricted to Roku's home and menu screens, its screensavers, and its first-party video channels , and once you start playing video, the only ads you'll see are the ones from the service you're streaming from. That said, Roku TVs have shown ads atop live TV before .

Now, the company is apparently experimenting with ways to show ads over top of even more of the things you plug into your TV. A patent from spotted by Lowpass describes a system for displaying ads over any device connected over HDMI, a list that could include cable boxes, game consoles, DVD or Blu-ray players, PCs, or even other video streaming devices. Roku filed for the patent in August 2023 and it was published in November 2023, though it hasn't yet been granted.

The technology described would detect whether content was paused in multiple ways—if the video being displayed is static, if there's no audio being played, if a pause symbol is shown anywhere on screen, or whether (on a TV with HDMI-CEC enabled) a pause signal has been received from some passthrough remote control. The system would analyze the paused image and use metadata "to identify one or more objects" in the video frame, transmit that identification information to a network, and receive and display a "relevant ad" over top of whatever the paused content is.

Enlarge / A promotional image for a Roku TV. (credit: Roku )

Roku customers are threatening to stop using, or to even dispose of, their low-priced TVs and streaming gadgets after the company appears to be locking devices for people who don't conform to the recently updated terms of service ( ToS ).

This month, users on Roku's support forums reported suddenly seeing a message when turning on their Roku TV or streaming device reading: "We've made an important update: We’ve updated our Dispute Resolution Terms. Select ‘Agree’ to agree to these updated Terms and to continue enjoying our products and services. Press * to view these updated Terms." A large button reading "Agree" follows. The pop-up doesn't offer a way to disagree, and users are unable to use their device unless they hit agree.

Customers have left pages of complaints on Roku's forum. One user going by "rickstanford" said they were "FURIOUS!!!!" and expressed interest in sending their reported six Roku devices back to the company since "apparently I don't own them despite spending hundreds of dollars on them."

• 

  A rendering of a Roku TV mounted on a wall. [credit: Roku ]

To say Roku is dominant in the TV software space would be an understatement—RokuOS is by far the most popular smart TV operating system. But for its hardware, the company has relied on partners like TCL and Hisense. As previously rumored , that's changing in 2023.

Starting this spring, Roku will begin shipping its self-branded TVs in the United States. The lineup will include 11 models, ranging from 24 to 75 inches across two product lines: Roku Select and the more expensive Roku Plus. Roku hasn't said much about what will distinguish Roku Plus, apart from including the company's Voice Remote Pro, which offers more features than the standard Roku Voice Remote.

Prices for these HD and 4K TVs will range from $119 to $999—a clear sign that, as with Amazon's competing Fire TV sets, the emphasis here is on accessible pricing, not top-notch picture quality.

Roku's cameras can (like Wyze) alert you to certain specific things, like people and pets, when they appear on your camera. The alerts appear on a new phone app, but also Roku TVs and streaming devices. (credit: Roku)

Today, Connected TV-maker Roku unveiled eight new low-cost lights, cameras, doorbells, and plugs, all centered on being easy to install and operate from the company's "Roku TV Operating System." It marks the entrance of a new player in the smart home field, one with no particularly novel gadgets yet, but already a sizable gateway into many homes.

The products, available exclusively through Roku and Walmart, can be controlled with a new Roku Smart Home phone app, but Roku is positioning the devices as tightly integrated with their TVs and streaming boxes and sticks. The Roku video doorbell can trigger a picture-in-picture view on a Roku-powered TV and alert you to dedicated events like packages or pets. Using the voice function on a Roku remote can bring up live camera streams, activate switches, or turn on lights.

Roku's Doorbell Pro can pop up on a Roku TV to show who's at the door—in this case, the takeout delivery. (credit: Roku)

The products will be familiar to anyone who has browsed the Wyze lineup, and that's intentional. Roku partnered with Wyze to build its first non-streaming-focused products, and some of them are dead-ringers for existing Wyze gear, especially the cameras. Wyze is a well-known brand, but also one with some security breaches and heavily delayed vulnerability responses in its past. Roku states that its products will offer two-factor authentication, user data encryption, and secure boot and will be certified by the ioXt Alliance .

Enlarge / Roku OS 11.5. (credit: Roku )

Roku today announced new hardware with the budget-conscious in mind, including the $130 Roku Wireless Bass subwoofer and an updated Roku Express streaming device. The company also detailed Roku OS 11.5, which includes features that should mean less time spent helplessly clicking around for something to watch.

Roku’s $130 Wireless Bass

The Roku Wireless Bass subwoofer is meant to boost the bass heard with Roku's Streambar , Wireless Speakers , or TV Wireless Soundbar . Roku's upcoming 5.25-inch subwoofer is a cheaper version of the already released, 10-inch Roku Wireless Bass Pro .

Roku Wireless Bass. (credit: Roku )

The lower-priced subwoofer sports a frequency response of 50-200 Hz, while the more expensive Wireless Bass Pro packs more at the low-end with a range of 40-200 Hz. Roku describes the new subwoofer as having a front-firing ported design compared to the Wireless Bass Pro's downward-facing design and sealed cabinet.