Hacker News Reader

Comment by shiado | Hacker News Reader

What will happen is some high profile company that has a few Amazon devices on their network will have these devices exploited to gain network access and get hit with some ransomware/data theft/etc... and then there will be a big legal battle between Amazon and the hacked company and this whole idea will be shut down and consumers will get a $10 class action settlement for each device.

View on HN

Maybe not? Most consumer arbitration agreements these days ban asserting class claims. This has been on the rise since 2011: https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepc....

In my opinion, this legal change is a huge sleeper story that is behind a number of changes in how customers are getting treated. Since customers can no longer economically avail themselves of the courts to protect themselves en-masse, certain companies find it in their interest to exploit that asymmetry for profit.

In other words, a company could always impose a harm on all of its customers for its profit. But, now, if that that company imposes a class ban through arbitration, those customers cannot, collectively, seek recourse for that harm.

It's amazing to watch companies admit they abuse this pattern.

A couple years ago I got into it with Comcast over an Identity fraud issue. When I threatened to take them to court for harrassment (I'd sent them more than what was needed to prove I never resided at the address in question) they tried to throw the 'binding arbitration' clause out there... When I told them I never was or would be a customer of theirs and thus wasn't held to their arbitration, they didn't quite know what to say next.

Was this a conversation with their legal department?

Is that really enforceable? Maybe. I suspect that customers are better off not going through class claims anyway, as few of them actually yield amounts close to the harm done, and lawyers walk away with absurd amounts.

"Collective" is merely a tool for not clogging courtrooms; there really isn't any other benefit to consumers here.

Civil and criminal court systems are very overwhelming and just broken in general in my opinion.

Another story on the front page right now[0] from the WSJ[1] seems to imply that arbitration clauses fall apart when faced with a mountain of arbitration demands (75k+). Amazon is now seeking to remove its own arbitration clause for customers so that these can be consolidated into a class action lawsuit.

[0] https://news.ycombinator.com/item?id=27356550

[1] https://www.wsj.com/articles/amazon-faced-75-000-arbitration...

absolutely brilliant

Something like that happened to Doordash a little over a year ago [1] [2]. Workers wanted to start a class action, Doordash used their arbitration clause to stop that. Over 5000 workers then asked for arbitration, which would have cost Doordash around $10 million in arbitration fees.

Doordash then tried to get a judge to make it a class action. The judge felt that this Doordash was in this mess due to their own hypocrisy and declined their request.

[1] https://www.theverge.com/2020/2/12/21135474/doordash-workers...

[2] https://www.courthousenews.com/doordash-ordered-to-pay-12m-t...

I interviewed at Doordash when they were just starting. I think I would have been like employee number twelve or something. To this day, I have not interviewed with a founder that repelled me more.

I believe there was a successful recent strategy for dealing with this clause by submitting a new lawsuit for each harmed user, to overwhelm everything (courts, company lawyers, etc).

Some attorneys are starting to specialize in consumer arbitration. The attorneys will eventually find a way to put the squeeze on these companies as they try to change the rules.

Depends who clicked the agreement and what the company bylaws of who can agree to terms. Some low level IT person will not have the authority to bind the company into an agreement and the injured party is the company.

https://www.binadox.com/blog/clickwrap-held-unenforceable-na...

> Most consumer arbitration agreements these days ban asserting class claims.

This really ought to be illegal.

More likely, telecom will think, this is against our residential TOS and we can use that to get a slice of the Amazon’s mesh revenue. Especially because most of the telecoms offer side access to wireless routers of their customer for other customers of theirs too. Maybe this is a play by Amazon to be in a better position in this set of future negotiations - one which the average consumer is really a bystander for all the input they have.

>consumers will get a $10 class action settlement for each device.

Worse, it would likely be settled in the same way the Ticketmaster case was settled ... with a 10% off coupon for a Prime membership.

This could be somewhat mitigated by VPN tunneling all traffic through Amazon’s edge, not sure of their implementation here but I highly doubt that Amazon overlooked this threat model.

The exploit attack vector mentioned is already a risk to any device connected to a sensitive network. VLAN your consumer devices, conference room screens, at minimum.

I'm more worried about this amazon mesh network being used for access by other internet devices.

For example, it's not easy to get a dumb TV. If I had one I wouldn't want it online. It appears that Amazon would sell access to the TV manufacturer so that it could spy on me via my neighbours Amazon Sidewalk device.

To me this is new threat vector. I don't take kindly to corporations spying on me.

5G is the same kind of thing. You can relay traffic through 5G devices that have internet connectivity.

huh i didn't even think about that, plug an amazon device into your network and this mesh allows anyone to connect to it - exploit it and now they are on your internal "Secure" network. brilliant.

Sidewalk is a separate network that only allows encrypted links back to the AWS cloud. It should not be possible to interact with the host network without two malicious devices, one Trojan with access to the network already, and the other in control of the attacker. Even then, the host would have to give the Trojan access.

https://m.media-amazon.com/images/G/01/sidewalk/final_privac...

I would assume that Amazon has looked into this problem from a legal risk perspective before doing this.

Generally, when it comes to risks, you can do 4 things:

ARAT

(a) Accept the risk

(b) Reduce the risk

(d) Transfer the risk (e.g. buy insurance)

I guess they do a mix of (a) and (b), since they have deep pockets.

this is not different for any other internet connected device on your network. although i doubt its about connectivity to the internet but about connectivity to some backend over the internet. I think it is quite common to assume these risks to be your own problem as is mitigating them. I mean i would probably like it if there is some responsibility for manufactures to make sure it does not happen but i doubt we are even close to something like that.

$10? Ha. How about another year of credit monitoring!

Reply on news.ycombinator.com