Jamsbond
Member
If there is a Roku in a room where other people hang around, this is a two-minute test worth doing before you shrug it off. A Roku owner says their son found that on the Wi-Fi password screen, pressing the voice button on a 2nd Gen voice remote and saying a single word ("one" in his case) makes the masked field show the whole password in plain text, with the 1 tacked onto the end. The owner says they tried Roku through chat and email and got nothing back, which is why it went public.
This is a familiar class of bug rather than anything exotic. The field hides what you type on the on-screen keyboard, but dictation writes into the same field through a different path and nobody remembered to keep the mask on. Phone keyboards and browsers have had their own versions of this over the years.
How serious it is depends on your house. You need the remote, the TV and a reason to be on the network settings screen, so a stranger outside gets nothing. The people it matters for are the ones already in the room: a teenager whose router rules are the only thing between them and the console at 2am, a lodger, a party guest left alone with the TV. If the Wi-Fi password is also the router admin password, that is the bigger problem and it isn't Roku's.
There's no word on which Roku OS versions or remote revisions are affected, and Roku hasn't said anything publicly. Until it does, a guest network for the streaming boxes is the cheap fix, and a router admin password that differs from the Wi-Fi one costs nothing.
This is a familiar class of bug rather than anything exotic. The field hides what you type on the on-screen keyboard, but dictation writes into the same field through a different path and nobody remembered to keep the mask on. Phone keyboards and browsers have had their own versions of this over the years.
How serious it is depends on your house. You need the remote, the TV and a reason to be on the network settings screen, so a stranger outside gets nothing. The people it matters for are the ones already in the room: a teenager whose router rules are the only thing between them and the console at 2am, a lodger, a party guest left alone with the TV. If the Wi-Fi password is also the router admin password, that is the bigger problem and it isn't Roku's.
There's no word on which Roku OS versions or remote revisions are affected, and Roku hasn't said anything publicly. Until it does, a guest network for the streaming boxes is the cheap fix, and a router admin password that differs from the Wi-Fi one costs nothing.
