After reading the article, it's pretty clear that it was credential stuffing and that the writer didn't take the time to understand how it worked. Not sure what security experts they talked to, but credential stuffing absolutely can get all the information described, and the whole part about wifi connected devices is completely unrelated.

I'm not making any guesses what actually happened.

Just stating that you misrepresented what the article actually said when you wrote "the attack is called credential stuffing". Your sentence gives impression that the article would have said it, but the article made a point for the opposite.

The Amazon spokesperson directly said it was credential stuffing--the article was trying to argue that it was more than that in an extremely misleading way.

You may be totally right and it was credential stuffing and the article may have been wrong, misleading, incompetent and stupid.

Nonetheless, you misrepresented what the article actually said -- the article raised both, the possibility credential stuffing (implied by Amazon spokesperson), and doubt about it (unspecified security expert, WiFi attacks).

Calling out an article for being misleading is not the same as misrepresenting it.

Yes they are different, and you did both: called it out for being misleading, and simultaneously misrepresented what it actually said (I've already detailed the reasons above, and others have quoted them verbatim to you).

The best before date of this conversation has clearly expired, so let's just stop here.

It's in Amazon's interest to argue that it wasn't a failing on their part.

I mean, being this susceptible to credential stuffing is a failing on their part, too.

> Not sure what security experts they talked to

https://www.eff.org/about/staff/cooper-quintin

And here is his take on it. https://twitter.com/cooperq/status/1207780461834977281

His take is a result of him trying not to completely let go of the story he's already decided is significant. There is no story. There isn't really a great way to defend against credential stuffing attacks when the adversary has access to a huge residential proxy network and you don't want to greatly inconvenience your users. All major US banks are pretty vulnerable to credential stuffing attacks. If banks aren't going to defend against it, Ring isn't.

I really wish this was included in the article, his conclusion makes a lot more sense in that context (though I still disagree with it).

The article implied he wasn't the only one they talked with. There isn't anything he said that was explicitly incorrect (unlike some of the other unnamed security researchers), but he must not have much experience with credential stuffing incidents given his responses.