14 ms·

23andMe says user data stolen in credential stuffing attack

341 points by nickthegreek 3y ago

smlavine 3y ago
It was only a matter of time. I feel sorry for all the people that were tricked into trusting a private company with their genetic information.
- darkclouds 3y ago
  [dead]
- fenalphthalein 3y ago
  After reading the article, I think it's more that people were tricked into [reusing passwords across websites instead of having a password manager and randomized passwords]. It's not on 23andMe, or anyone (other than the user) for that matter, to ensure the passwords used by the user are not copied passwords from other credentials. Seems to me like passwords need to be regulated on a governmental level, but that's a can of worms of an idea that I am not ready to defend.
  - chatmasta 3y ago
    I mostly agree with you, but 23andme could have prevented this by requiring 2FA for all accounts, or at least for accounts with an email in the HaveIBeenPwned database. Credential stuffing is most preventable by the user (who can simply not reuse passwords), but platforms have a responsibility as well. They can at least mitigate it through rate limiting, and mostly stop it with 2FA requirements. If an attacker is able to exfiltrate millions of records from a platform with credential stuffing, that means they tried to login to multiple millions of accounts. It shouldn't be difficult for a service to detect and stop such a sustained level of load on its login infrastructure. You can't get millions of proxies.
    - thebrain 3y ago
      Actually, if the attacker is determined enough they can use enough IPs and make it really hard to detect and defend against. I work on combating credential stuffing on a regular basis... it's quite challenging.
    - the8472 3y ago
      > but 23andme could have prevented this by requiring 2FA for all accounts They could have prevented that by not keeping the data longer than needed to send it to the user.
    - supercucumber 3y ago
      None of this is surprising. I was a sw engineer at 23andMe about 5y ago. Their backend consisted of some of the worst python/django spaghetti code I’ve ever worked on. There was also no engineering culture whatsoever.
  - kulahan 3y ago
    What I make my password should be entirely up to me, with the knowledge that if my data is stolen because I reused a password, it was entirely my fault. I don't really think this needs to be regulated; government-standard guidelines are probably sufficient, with companies knowing that deviating will expose them more to litigation in the event of a problem. Not trying to argue with you, I did read your last sentence, just tossing in another POV.
    - sib 3y ago
      In this case, due to the "genetic relatives" feature, one user's choice to use poor security (e.g., "passw0rd") enabled the bad guys to get the data of other users who did use good security. Sort of a "negative security externality"...
  - smeej 3y ago
    "Tricked into"? Who is tricked into reusing a password?
    - fenalphthalein 3y ago
      This is my personal take: People are sometimes tricked by natural human instinct into performing actions that give benefit to a simple human need ("it's just easier for me") at the detriment of higher-level outcomes (in this case, password security). It's simply easier for me, as a human, to remember that my password for all websites is Hunter2, rather than spend the extra time, create a password manager account, store passwords, utilize best password management practices, etc. Not saying this is what I do, but for many people, this is how they remember their password(s). Maybe I should have changed the "tricked into" to "trick themselves", but I'm just a human and this was easier for me.
  - adameasterling 3y ago
    > It's not on 23andMe, or anyone (other than the user) for that matter, to ensure the passwords used by the user are not copied passwords from other credentials. In my opinion, it is, actually, on 23andMe. At my tiny startup, I implemented a simple check against Troy Hunt’s compromised password database.[1] If I can do it, 23andMe can. If anyone reading this is in the business of making web apps and there’s literally anything of value behind your login, prioritize this mitigation. OWASP recommends it too. [2] 1. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords 2. https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Credential_St...
- justrealist 3y ago
  I have my genetic info on 23andMe and I could not care less. Seriously — what are people going to do with it? It's illegal for insurance companies to discriminate. I'd post it myself on GitHub if anyone showed the slightest interest in using it.
  - sdfghswe 3y ago
    The problem with this situation is A) precisely that you don't know what people are going to do with it, and B) that once it's out there it's impossible to undo that. You're confident enough that nothing can be done, to the point that you'd take the risk for no upside. That... doesn't sound rational to me?
    - latchkey 3y ago
      > A) precisely that you don't know what people are going to do with it We know now, they are going to leak it. Everyone is going to know that I'm an Ashkenazi Jew who is more likely going to have blue or brown eyes and hair loss. Whooops.
      - progman32 3y ago
        And we now (hypothetically, in the context of leaking genetic info) know Meryem is Uyghur, James is trans, and Alex is related to a deeply divisive political figure.
        latchkey 3y ago
        > By day, the government pays me to publish their data.
        progman32 3y ago
        Yes, my background is in publishing open government data, such as budgets, election results, environmental info, economic data, and government program accountability studies. Not personal information. And yes, I do have strong opinions on how data is to be responsibly managed, hence my participation in this conversation. So, I'm curious if you have additional thoughts on the matter.
- leotravis10 3y ago
  Not just those people, but people who never even heard of the company or even visited the website due to the fact that their DNA and personal details have been shared to the site thanks to relatives' DNA. Source: https://www.linkedin.com/feed/update/urn:li:share:7116053429763936256 https://www.linkedin.com/feed/update/urn:li:share:7116053429...
  - Svenskunganka 3y ago
    Veritasium has an interesting video explaining this, mentioning 23andMe on multiple occasions: https://www.youtube.com/watch?v=KT18KJouHWg https://www.youtube.com/watch?v=KT18KJouHWg
- amelius 3y ago
  > I feel sorry for all the people that were tricked into trusting a private company with their genetic information. And all their relatives (who share a lot of their DNA after all)
- ellisv 3y ago
  Much of healthcare is provided by private, for-profit companies. Even public, non-profit healthcare providers will use services (including genetic testing) from private, for-profit companies.
tgv 3y ago
Sounds like dystopia is nudging closer. But who gives their DNA to a company?
- riffic 3y ago
  there are a lot of really valid use cases for genetic testing but to address your point you (these customers, etc) really should be aware of the risk and privacy issues that may occur if that data was compromised.
- huytersd 3y ago
  People that want to know very, very useful information about themselves.
  - mrguyorama 3y ago
    Very very useful information like "Our arbitrary data model that isn't exactly based on science says you're like 4% eastern european"
    - lo_zamoyski 3y ago
      Fodder for those who claim they're 1/17 Cherokee.
  - keep_reading 3y ago
    They were doing important Parkinson's research maybe 10 years ago. I sent in my dad's sample and mine. No idea what they got from my dad (it was a voluntary thing that didn't give you account access, just participating in their research). I didn't have any of the known genetic markers for Parkinson's at the time and requested they destory my data and sample.
  - maximinus_thrax 3y ago
    I very much doubt the usefulness of the information you get from 23andme. I would say it's useful with a grain of salt when it comes to clinical accuracy, maybe it would enable someone to actually go to the doctor and get properly and accurately tested. But on the other hand, it can also enforce a false sense of security when the tests are clean. 'FDA approved' does not actually mean 'clinically useful'[1]. From the ancestry standpoint, I think it's only useful for a very limited set of individuals/scenarios. In my case, I'm 90% Eastern European which is... kind of basic considering I know where I was born. Yeah, I share a lot of my DNA with all the people who were born in roughly the same geographic area. Big fucking surprise? I never used 23andme and not planning to (the example is from a close friend of mine who did). I think the privacy concerns far outweigh the benefits. But I am interested in genetic testing so if anyone has any pointers for a privacy conscious, not-for-profit (maybe in academia?), non-Law Enforcement friendly entity and preferably does it anonymously, please let me know. [1]: "Why You Should Be Careful About 23andMe’s Health Test" - https://archive.ph/lpaUU https://archive.ph/lpaUU
tsuru 3y ago
No matter how securely you connect or rotate passwords, the inside-job or supoena risks were too d*** high
- taeric 3y ago
  Except... this leak was from people not having good password hygiene? Right?
_8j50 3y ago
There needs to be a term to describe this "f*k you I got mine, who cares about the future or future generations" behavior. The normalizing of dna collection, facial recognition, being oblivious to climate issues, screwing up housing market,etc...
- mistrial9 3y ago
  there is a rumor about bank employees during the 2007 crisis, passing a note that said "IWBTYWBT" meaning "I won't be there, you won't be there".. just what you are referring to..
- smeej 3y ago
  Gonna take my downvotes on this, but in my circles, we just call this "being a Boomer." Goes to your head when you're the largest generation during your formative years. Nobody has any choice but to do what you say. So you take what you can get and screw over everyone else coming after you. And then you belittle them for resenting you over it.
  - edgarvaldes 3y ago
    In some years the boomer gen will be gone. The behavior, I think, wont.
- moretrashplz 3y ago
  Like, a government? Mine is too busy squabbling about gender identity and whether Pelosi should have her office back or not.
- syndicatedjelly 3y ago
  Moral hazard perhaps. Or externalities. 23andme kept the upside benefits - making money, but doesn't have to realize the downside risk - facilitating future conflict. If anyone thinks that's facetious, I encourage them to read Erin Kissane's description of what went down in Myanmar - https://erinkissane.com/meta-in-myanmar-part-i-the-setup https://erinkissane.com/meta-in-myanmar-part-i-the-setup. And then think about how they did that without DNA data.
danw1979 3y ago
“user data” …
riffic 3y ago
There are some genealogical services out there that do Leeds-Collins charts that to my knowledge work by asking their users for their 23andMe credentials, much like some third party banking services that work by asking their users directly for their banking credentials. There's a lot of really bad security in this sector.
- beaugunderson 3y ago
  so sad given that there was a 23andMe OAuth2 API for some time that had SNPs as OAuth scopes!
  - riffic 3y ago
    gonna name and shame geneticaffairs.com here for this appalling practice: https://geneticaffairs.com/faq.html https://geneticaffairs.com/faq.html > Genetic Affairs is able to retrieve DNA matches for several DNA matching companies. To download DNA matches of these companies we need to store your login credentials. See the next section concerning the secure storage of these credentials. > Since we have to use login information for 23andme and FamilyTreeDNA, we use an isolated database in which we encrypt and store the passwords of these websites. This database is only available in a private network in the cloud and not exposed to the Internet.
    - beaugunderson 3y ago
      bizarre... I wonder why they don't just accept a raw data upload from 23andMe?
neilv 3y ago
> The information that has been exposed from this incident includes full names, usernames, profile photos, sex, date of birth, genetic ancestry results, and geographical location. Is 23andMe going to actually be held responsible? I think both our industry and our information infrastructure would be vastly better if companies were forced to be serious about security when they are collecting and holding private data.
- leotravis10 3y ago
  Probably not as I would guess it'll be just a wrist slap and nothing more. This not only affects users, but the user's relatives/loved ones as well.
- kulahan 3y ago
  As I understand it, only if they can prove some pretty intentional negligence. If some random dude sucks at his job and forget to encrypt so-and-so, or change the default password on such-and-such, it's not really the CEO's fault. Maybe you could chase after the CTO if they had policies which directly lead to this issue. Again, just as I understand it, that's why nobody gets in trouble for this shit. It's not really fair to blame any one particular person. Whether or not that can be remedied by modifying the corporate system we operate in somehow, I don't know. Probably yes, but that's not my skillset at all. edit: but in any case, this was due to people re-using passwords, so I doubt you could realistically blame the company.
  - jstarfish 3y ago
    > Maybe you could chase after the CTO if they had policies which directly lead to this issue. > It's not really fair to blame any one particular person These are literally the very circumstances that we were presented with as reason why executive compensation is astronomical. It's all that responsibility they have to assume in times like these, right? They're supposed to fall on their sword, and whoever replaces them is supposed to make damn sure shit like this doesn't happen on their watch. The pay and parachutes ensure they land on their feet. The reason nothing ever changes is because these clowns never get in trouble. If you want that $10M salary, you better make sure everyone under you is doing their part to ensure events like this don't happen-- or you get dethroned. Does China still sell melamine-tainted baby formula? We've been conditioned to just let our leaders stay in command after plowing into icebergs-- while they blame and execute the engineers shoveling coal below deck.
pphysch 3y ago
> The initial data leak was limited, with the threat actor releasing 1 million lines of data for Ashkenazi people. > The information that has been exposed from this incident includes full names, usernames, profile photos, sex, date of birth, genetic ancestry results, and geographical location. Not good. Really not good. This is why I never volunteer any PII to link with my DNA. Sampling DNA is not that hard (we leave traces literally everywhere) but credibly linking it to PII is another thing.
- trompetenaccoun 3y ago
  All that ethnicity data will be a goldmine for future genocidal dictatorships.
neilv 3y ago
> The initial data leak was limited, with the threat actor releasing 1 million lines of data for Ashkenazi people. When the evil kind of hackers disrupted a children's hospital, did someone ask how they could be as evil as that, then had the idea, "Hey, how about selling a list of Jewish people specifically?" (They have to know that no one's going to buy that for marketing, but rather for targeting due to hatred and insanity.)
Urgo 3y ago
Unless I'm reading this wrong all that happened was someone had an existing leaked database of emails/passwords and then tried them on 23andme, and if they worked they took the data they could get. Yes, 23andme has some pretty extensive and personal data, but this attack could be done on literally any website. The issue is people re-used passwords, and also did not have 2fa enabled. So the database that is for sale is just a list of emails/passwords from other breaches that worked on 23andme, along with the data that 23andme had on those users. Not exactly a 23andme breach.
- teaearlgraycold 3y ago
  Use a password manager with long, random passwords. Pick your own passwords and you're leaving your door unlocked.
  - dewey 3y ago
    I don't think you have to tell that to people on HN, but regular people will not be able to use most password managers. Not even 1Password is really user-friendly and it's the most mainstream one. The included one on macOS is hidden in some setting panel. For non-technical people the best authentication method is probably their phone (Passkeys, or tokens sent to their email address).
    - randerson 3y ago
      Most (all?) major browsers now have built-in password managers which are intuitive enough for regular people and provide sufficient security against these attacks.
      - dewey 3y ago
        And yet, passwords get guessed, stolen, re-used all the time. If you talk to regular people they still use pet names + a number because they want to be able to type it in everywhere. It's not a solved problem, even if a rudimentary password manager is in most browsers. Personally I don't know a single person outside of my tech bubble that uses passwords that you can't keep in your head, or write down on a piece of paper on their desk.
tpmx 3y ago
Some background for new readers: The 23andMe founder (and current CEO) Anne Wojcicki is the sister of Susan Wojcicki, until recently a long time Youtube CEO. Anne is also the ex-wife of Google/Alphabet founder Sergey Brin. Google/Alphabet is also an investor in 23andMe. Youtube is an Alphabet company.
- cooper_ganglia 3y ago
  The Wojcicki-Brin family tree seems like its own mini-map of Silicon Valley! It’s amusing and ironic to me that the co-founder of a gene-testing company has such an interconnected family network within the tech industry.
- toomuchtodo 3y ago
  > Anne is also the ex-wife of Google/Alphabet founder Sergey Brin. Google/Alphabet is also an investor in 23andMe. Youtube is an Alphabet company. It was sort of cool that as a 23andme employee some time back (10-12 yrs?), you could use some of Google's amenities because of these relationships.
- deleted 3y ago
  [deleted]
dboreham 3y ago
How do you exfil data on 1.3M users by guessing a few passwords?
- SketchySeaBeast 3y ago
  Well, it seems they took advantage of a feature that indicates who you may be related to, so they must have guessed Genghis Khan's password.
  - ganeshkrishnan 3y ago
    MONGOLIAN71682@HOTMAIL.com and password "SHADOW_RAIDERZ123" that was easy.
- worksonmine 3y ago
  They're not guessing passwords, they have a list of e-mails and passwords from other leaks and are hoping the users are using the same credentials on all their accounts. Since password managers aren't mainstream yet it works.
  - nemacol 3y ago
    How do you hide authenticating 1.3+m unique accounts? A distributed system? A mess of VPN's? Or they don't hide it because the auth system is not checking for 1.3 million auth attemps?
    - juunpp 3y ago
      The latter. Forget tracking auth attempts: > The researcher added that he discovered another issue where someone could enter a 23andme profile ID, like the ones included in the leaked data set, into their URL and see someone’s profile.
      - jtriangle 3y ago
        Ah, so they were able to use a few accounts, then fuzzed the URLS to victory... Amazingly incompetent.
oger 3y ago
[flagged]
- 23B1 3y ago
  No, but you should feel sorry for all the people who refused to entrust 23andMe but whose relatives didn't get the memo. They'll be hurt by this too.
- btgeekboy 3y ago
  23andMe is a 17 year old public company with almost $300m in revenue. I’d hardly call that a startup.
mjsweet 3y ago
If I were operating a SaaS platform or any other online service, I'd be inclined to automatically reset passwords for users whose credentials have been compromised in a data breach. Has anyone here developed an automated system to handle this? I'm particularly curious about how one would automate the gathering of leaked databases and cross-reference user passwords against these lists, both at the point of signup and periodically thereafter. Seems like a compelling problem to solve.
- brap 3y ago
  I don’t know if there’s a service that does that, but I do know big tech companies do exactly this for their accounts (user accounts, not just employees). Additionally many password managers will warn you, including the built in ones in iOS and Chrome.
RadixDLT 3y ago
anything that has connections to google is going to be a privacy nightmare
spullara 3y ago
Maybe they could send me my dad's account password he lost years ago and no longer has the email address.
- akvadrako 3y ago
  You should be able to lookup the email on https://haveibeenpwned.com/ https://haveibeenpwned.com/. If it's there, they might have your password.
ganeshkrishnan 3y ago
I visited the site in the screenshot and saw someone peddling NATO leaks from their Philippines visit including "PLANCTON, CRONOS, CA SIRIUS, EMADS, MCDS, B1NT etc" And one more list of some ukrainian citizens database from 2023. please don't kill me CIA! I swear I accidentally saw it. welp! time to head back to my work.
- mottosso 3y ago
  That's exactly what a spy would say. Get'em boys!
- yieldcrv 3y ago
  what site is it?
mrobins 3y ago
$75k. Tell me the government doesn’t take privacy seriously without telling me that government doesn’t take privacy seriously. > Three weeks ago, genetic testing firm 1Health.io agreed to pay the Federal Trade Commission (FTC) a $75,000 fine to resolve allegations that it failed to secure sensitive genetic and health data, retroactively overhauled its privacy policy without notifying and obtaining consent from customers whose data it had obtained, and tricked customers about their ability to delete their data.
- juunpp 3y ago
  I already find the narcissistic "welcome to you" message on the package inducing of extensive amounts of vomit. And then they only get $75k for this? I want them go DOWN.
  - readyplayernull 3y ago
    The FTC takes the its_not_about_the_money.jpg meme very seriously.
- dheera 3y ago
  Capitalism being backwards as usual. If we really take privacy seriously we should fund them $75K to fix their privacy problems. If you take away $75K from their engineering budget they will only do a worse job, and more data will leak.
  - Angostura 3y ago
    That sounds like a good way to ensure monthly data leaks
  - rileymat2 3y ago
    Wouldn't this incentivize insecure practices and bad practices so they can get 75k? Wouldn't that be the effect, everyone tries to as little as possible until they get paid?
  - jddj 3y ago
1B05H1N 3y ago
Whoopsie daisy.
hn_throwaway_99 3y ago
I wonder if companies will seriously start to rethink "transitive permissions" or "network permissions". This is very similar to what bit Facebook in the ass years ago: I have permissions to see all the data of my friends, but in the past I could also click a button to let someone who requested see not just my own info, but also all the info from my friends. From a "computer science" perspective this makes sense: if I say you can view all my data, I lose control with who else you share that data with. But from a "human" perspective, most people don't think that if I give you access that I'm essentially giving access to the rest of the world. These types of network permissions make any company who holds them a prime target because it means bad guys only need to hack a few accounts to get exponentially more data.
- deleted 3y ago
  [deleted]
- hunter2_ 3y ago
  > also all the info from my friends They would only see the subset of what your friend shared, the set configured by its author as visible to friends of friends, right?
  - hn_throwaway_99 3y ago
    No, IIRC this predates that entire permission model. "Friends of friends" today means just what it sounds like - my friends and all of their friends can see the data Iark that way. Back in the late 00s/early 10s when lots of "Facebook apps" were a bit of a craze (think Farmville), you could give an app maker permission to view your personal data and all of the data that you could see about your friends. This is how Cambridge Analytics was able to build profiles of 87 million Facebook users when only a few hundred thousand actually installed the "your digital life" app: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election https://www.theguardian.com/news/2018/mar/17/cambridge-analy...
effnorwood 3y ago
[dead]
hammock 3y ago
According to this tweet, the hackers likely got ALL of the data but only leaked a subset, 1.3 million records (only the ashkenazi Jews) https://x.com/mattjay/status/1710370423311888724?s=20 https://x.com/mattjay/status/1710370423311888724?s=20
- beaugunderson 3y ago
  as a 23andMe user with a high percentage of Ashkenazi genes I expected my data to be in the leak but it wasn't so it's probably not all of the Ashkenazi data
  - justinzollars 3y ago
    How did you verify? I am ashkenazi
    - beaugunderson 3y ago
      assuming your last name is the same as in your HN username you are not in the file either (as to how I verified: the file is still available on the leak site)
      - marcod 3y ago
        OK, that CSV is just a subset of the data they claim to have.... so our data might still be out there even if it wasn't in this file. These are the headers: profile_id; account_id; first_name; last_name; sex; birth_year; has_health; ydna; mdna; current_location; regions; subregions; population_ids First entry is Elon;Musk;Male;1971;...
        1-6 3y ago
        There's a whole debate about whether Elon Musk has Jewish ancestry. Are you saying he is?
        3y ago
technol0gic 3y ago
I've said it countless times now: until there is criminal liability for negligence with regard to data warehousing/safekeeping, this is going to keep happening. because they do not care, and will not care (regardless of what their PR puts out) until their toosh is on the line. Every time there's a breach, they pull a British Petroleum "we're reallllly sorrrrrry" and buy a bunch of people LifeLock. Its absolute bullshit.
- calgarymicro 3y ago
  Why would 23andMe face any criminal liability? Per the article, they were never breached; only individual accounts with reused credentials exposed in other breaches. They should have had 2FA, but I don't think not having 2FA should be criminalized.
  - adameasterling 3y ago
    I don’t know about criminal liability, but they’re certainly at fault for not implementing a check against known compromised passwords[1]. I believe it’s been an accepted best practice since something like 2017. 1. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
  - prometheon1 3y ago
    If a bank allowed people to log in to their bank account and make transfers based on only email+password and someone stole money from a bunch of accounts, would the bank face any criminal liability? I don't know the answer, but I would say your DNA sequence should be secured similarly to your bank account.
Calamitous 3y ago
This is precisely why, though I find it to be a fascinating idea, I have steadfastly refused to do one of these genetic tests.
- libraryatnight 3y ago
  I remember a Simpsons joke where Homer finds out the government has everyone's DNA on file and asks about it and they say "Yep everyone who's touched a penny since 1932" or something. Turns out it didn't need to be that elaborate, you could just ask folks to mail it in ;)
  - teagoat 3y ago
    you could just ask folks to mail it in (and pay for the privilege)
- MerelyMortal 3y ago
  Not only that, you have to make sure all of your extended family members don't take the test too.
  - stjohnswarts 3y ago
    that's impossible. All you can do is talk to them and tell them it's a bad idea. The data will exist from now until the end of the current human age. Everyone wants it, 23 and me may be decent custodians, but eventually it will end up in the hands of every government, corporation, and entity interested in getting DNA information through breaches and some eventual buyer of the company selling it.
- jdthedisciple 3y ago
  Yeap, same here. Don't think I'll ever try any of them.
- 4rt 3y ago
  Couldn't you just do it but with a fake name?
Footnote7341 3y ago
While we're talking about the privacy implications of sending your DNA to be sequenced 'for fun'. 23andMe already work with law enforcement, and the data science is getting good enough that they can figure out your identity if one of your third cousins turned in a DNA sample and you never did. The average person has around 200 3rd cousins.
- jddj 3y ago
  Can you elaborate on how that works? One of my 200 third cousins did a 23andMe swab. I then committed a crime, possibly on the other side of the country*. Law enforcement collects DNA evidence. What now? * edit: Previously this said "or world" but that felt unreasonable for the question
  - steelframe 3y ago
    The list of potential culprits reduces from perhaps tens or hundreds of thousands to about 200. Family trees are very easy discover. Check out your local Mormon genealogy center if you don't believe that. At that point they can apply standard gumshoe investigative techniques to quickly narrow it down to you.
- soared 3y ago
  Can law enforcement ping the 23andme database with any DNA they swab?
  - Footnote7341 3y ago
    Yes and it appears to be some kind of weird work around where 23andme doesn't explicitly work with them. This exact technique was used to readdress some serial killer cases recently. https://www.cbc.ca/news/world/dna-from-genealogy-site-used-to-catch-suspected-golden-state-killer-1.4637726 https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t... https://www.latimes.com/california/story/2020-12-08/man-in-the-window https://www.latimes.com/california/story/2020-12-08/man-in-t...
    - 3y ago
deleted 3y ago
[deleted]
havelhovel 3y ago
I hope someone investigates whether 23andMe adjusted user profile preferences or exposed this data through new features instead of assuming users chose to share the information now available in this leak.
jiveturkey 3y ago
Yep. Protect your precious bodily fluids people. In other news, this is surprisingly not very well known but california takes, and saves, a DNA sample of any baby born in a CA hospital. There is no consent nor opt-out, not even notification. You can write a letter to have the sample destroyed and sometime later you'll get confirmation of such. You can only hope that it wasn't sequenced and saved already and/or that it was properly destroyed. https://www.cbsnews.com/news/california-biobank-dna-babies-who-has-access/ https://www.cbsnews.com/news/california-biobank-dna-babies-w... huh. "many states" do it, I had no idea. Apparently all 50 states are required to do a genetic screening but I guess above and beyond that some states save the sample. I wonder what would happen if a parent or family member physically intervened to prevent taking the sample.
- miriam_catira 3y ago
  They actually will destroy it,if you have the paperwork. https://www.cdph.ca.gov/Programs/CFH/DGDS/Pages/nbs/nbsconsentforms.aspx https://www.cdph.ca.gov/Programs/CFH/DGDS/Pages/nbs/nbsconse... (Or you know, give you a certificate that says they destroyed it.)
TradingPlaces 3y ago
Many years ago I got a 23andMe kit. I was about to swab, when I asked myself, “Why is this thing so much cheaper than a lab?” I sent the unused kit back.
redder23 3y ago
Only complete and total retards use these services. People actually paying money to have their DNA data sold, you can not make this shit up. Apart form that the "research" they do it dubious AF and can't be trusted at all. There are cases where people send in DNA of a banana and get some made up human genetic history back.
ipaddr 3y ago
What site is that posted on? Looking at the data: name, location, dna group. Not very worried
mixmastamyk 3y ago
A friend of mine who did this says they don't record (any?) personal information and instead give you an id number. Sounds dubious to me. Anyone have any information on how effective their anonymization attempts were?
rhgamble 3y ago
Why keep calling the principle criminal entity a "threat actor", when in fact there is no 'act' here. They are openly selling stolen data, and it's been verified as stolen. Not deflecting the stupidity and criminality of 23andme...how stupid can a corporation working with peoples biological data be...oh wait...yes, repeatedly...its embedded in the business model apparently...operate for N+1 years, then provide a breach. Wish I could wake up from this recurring nightmare of groups with more money than they know what to do with, pretending to move humanity forward, making stupid mistakes. Nonetheless, please stop naming it a "threat actor". They are not 'acting' in any sense of the word.
- calgarymicro 3y ago
  > Not deflecting the stupidity and criminality of 23andme...how stupid can a corporation working with this sensitive type of data be Really? If the article is accurate, 23andMe did not have a security breach; credentials leaked in other breaches were used to compromise accounts that reused those credentials on 23andMe. Now certainly 2FA would have been advisable, but I think it's a bit much to suggest this rises to the level of criminality.
  - rhgamble 3y ago
    Appreciate the note, and agree 'criminality' is a bit strong. But this is our biological data at stake. 2FA is a minimum now given the integrated credentials sharing across platforms today.
deleted 3y ago
[deleted]
onetokeoverthe 3y ago
[dead]
yieldcrv 3y ago
what marketplace is this on? I’ve seen the screenshots but I’m not familiar with that forum
xorcist 3y ago
Of course it could be massive credential stuffing. The problem is that an inside job would look completely identical. Or negligent security. If you sell your DNA profile to someone, they are free to give or sell it to someone else. At best that's a breach of contract, but what are you going to do? A successful class action only changes the price retroactively. (I am told some people sell their DNA data at a negative price, which I suspect may be the same people who pay to have to have a remotely controlled microphone at home. That I don't understand, and accept that I probably never will. But it doesn't change the underlying premise and market dynamic. The above is still true.)
- valyala 3y ago
  Remote-controlled microphone is embedded into every smartphone. This doesn't prevent billions of people to buy and use them :)
tamimio 3y ago
Glad I never did any of these tests, and never will, good luck changing your DNA after the leaks!
JesseHayes436 3y ago
[dead]
JesseHayes436 3y ago
[dead]
jonesn11 3y ago
This is why no matter how many interesting ads or tiktoks, I will never do these genetic testing kits. I wouldn't be surprised military is working on CRISPR like infections that target your specific DNA when sprayed in the air.
Narcie 3y ago
[dead]
williemargatet 3y ago
[dead]
Fredmacco 3y ago
[dead]

341 points by nickthegreek 3y ago

It was only a matter of time. I feel sorry for all the people that were tricked into trusting a private company with their genetic information.

darkclouds 3y ago
[dead]
fenalphthalein 3y ago
After reading the article, I think it's more that people were tricked into [reusing passwords across websites instead of having a password manager and randomized passwords]. It's not on 23andMe, or anyone (other than the user) for that matter, to ensure the passwords used by the user are not copied passwords from other credentials. Seems to me like passwords need to be regulated on a governmental level, but that's a can of worms of an idea that I am not ready to defend.
- chatmasta 3y ago
  I mostly agree with you, but 23andme could have prevented this by requiring 2FA for all accounts, or at least for accounts with an email in the HaveIBeenPwned database. Credential stuffing is most preventable by the user (who can simply not reuse passwords), but platforms have a responsibility as well. They can at least mitigate it through rate limiting, and mostly stop it with 2FA requirements. If an attacker is able to exfiltrate millions of records from a platform with credential stuffing, that means they tried to login to multiple millions of accounts. It shouldn't be difficult for a service to detect and stop such a sustained level of load on its login infrastructure. You can't get millions of proxies.
  - thebrain 3y ago
    Actually, if the attacker is determined enough they can use enough IPs and make it really hard to detect and defend against. I work on combating credential stuffing on a regular basis... it's quite challenging.
  - the8472 3y ago
    > but 23andme could have prevented this by requiring 2FA for all accounts They could have prevented that by not keeping the data longer than needed to send it to the user.
  - supercucumber 3y ago
    None of this is surprising. I was a sw engineer at 23andMe about 5y ago. Their backend consisted of some of the worst python/django spaghetti code I’ve ever worked on. There was also no engineering culture whatsoever.
- kulahan 3y ago
  What I make my password should be entirely up to me, with the knowledge that if my data is stolen because I reused a password, it was entirely my fault. I don't really think this needs to be regulated; government-standard guidelines are probably sufficient, with companies knowing that deviating will expose them more to litigation in the event of a problem. Not trying to argue with you, I did read your last sentence, just tossing in another POV.
  - sib 3y ago
    In this case, due to the "genetic relatives" feature, one user's choice to use poor security (e.g., "passw0rd") enabled the bad guys to get the data of other users who did use good security. Sort of a "negative security externality"...
- smeej 3y ago
  "Tricked into"? Who is tricked into reusing a password?
  - fenalphthalein 3y ago
    This is my personal take: People are sometimes tricked by natural human instinct into performing actions that give benefit to a simple human need ("it's just easier for me") at the detriment of higher-level outcomes (in this case, password security). It's simply easier for me, as a human, to remember that my password for all websites is Hunter2, rather than spend the extra time, create a password manager account, store passwords, utilize best password management practices, etc. Not saying this is what I do, but for many people, this is how they remember their password(s). Maybe I should have changed the "tricked into" to "trick themselves", but I'm just a human and this was easier for me.
- adameasterling 3y ago
  > It's not on 23andMe, or anyone (other than the user) for that matter, to ensure the passwords used by the user are not copied passwords from other credentials. In my opinion, it is, actually, on 23andMe. At my tiny startup, I implemented a simple check against Troy Hunt’s compromised password database.[1] If I can do it, 23andMe can. If anyone reading this is in the business of making web apps and there’s literally anything of value behind your login, prioritize this mitigation. OWASP recommends it too. [2] 1. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords 2. https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Credential_St...
justrealist 3y ago
I have my genetic info on 23andMe and I could not care less. Seriously — what are people going to do with it? It's illegal for insurance companies to discriminate. I'd post it myself on GitHub if anyone showed the slightest interest in using it.
- sdfghswe 3y ago
  The problem with this situation is A) precisely that you don't know what people are going to do with it, and B) that once it's out there it's impossible to undo that. You're confident enough that nothing can be done, to the point that you'd take the risk for no upside. That... doesn't sound rational to me?
  - latchkey 3y ago
    > A) precisely that you don't know what people are going to do with it We know now, they are going to leak it. Everyone is going to know that I'm an Ashkenazi Jew who is more likely going to have blue or brown eyes and hair loss. Whooops.
    - progman32 3y ago
      And we now (hypothetically, in the context of leaking genetic info) know Meryem is Uyghur, James is trans, and Alex is related to a deeply divisive political figure.
      - latchkey 3y ago
        > By day, the government pays me to publish their data.
        progman32 3y ago
        Yes, my background is in publishing open government data, such as budgets, election results, environmental info, economic data, and government program accountability studies. Not personal information. And yes, I do have strong opinions on how data is to be responsibly managed, hence my participation in this conversation. So, I'm curious if you have additional thoughts on the matter.
leotravis10 3y ago
Not just those people, but people who never even heard of the company or even visited the website due to the fact that their DNA and personal details have been shared to the site thanks to relatives' DNA. Source: https://www.linkedin.com/feed/update/urn:li:share:7116053429763936256 https://www.linkedin.com/feed/update/urn:li:share:7116053429...
- Svenskunganka 3y ago
  Veritasium has an interesting video explaining this, mentioning 23andMe on multiple occasions: https://www.youtube.com/watch?v=KT18KJouHWg https://www.youtube.com/watch?v=KT18KJouHWg
amelius 3y ago
> I feel sorry for all the people that were tricked into trusting a private company with their genetic information. And all their relatives (who share a lot of their DNA after all)
ellisv 3y ago
Much of healthcare is provided by private, for-profit companies. Even public, non-profit healthcare providers will use services (including genetic testing) from private, for-profit companies.

tgv 3y ago

Sounds like dystopia is nudging closer. But who gives their DNA to a company?

riffic 3y ago
there are a lot of really valid use cases for genetic testing but to address your point you (these customers, etc) really should be aware of the risk and privacy issues that may occur if that data was compromised.
huytersd 3y ago
People that want to know very, very useful information about themselves.
- mrguyorama 3y ago
  Very very useful information like "Our arbitrary data model that isn't exactly based on science says you're like 4% eastern european"
  - lo_zamoyski 3y ago
    Fodder for those who claim they're 1/17 Cherokee.
- keep_reading 3y ago
  They were doing important Parkinson's research maybe 10 years ago. I sent in my dad's sample and mine. No idea what they got from my dad (it was a voluntary thing that didn't give you account access, just participating in their research). I didn't have any of the known genetic markers for Parkinson's at the time and requested they destory my data and sample.
- maximinus_thrax 3y ago
  I very much doubt the usefulness of the information you get from 23andme. I would say it's useful with a grain of salt when it comes to clinical accuracy, maybe it would enable someone to actually go to the doctor and get properly and accurately tested. But on the other hand, it can also enforce a false sense of security when the tests are clean. 'FDA approved' does not actually mean 'clinically useful'[1]. From the ancestry standpoint, I think it's only useful for a very limited set of individuals/scenarios. In my case, I'm 90% Eastern European which is... kind of basic considering I know where I was born. Yeah, I share a lot of my DNA with all the people who were born in roughly the same geographic area. Big fucking surprise? I never used 23andme and not planning to (the example is from a close friend of mine who did). I think the privacy concerns far outweigh the benefits. But I am interested in genetic testing so if anyone has any pointers for a privacy conscious, not-for-profit (maybe in academia?), non-Law Enforcement friendly entity and preferably does it anonymously, please let me know. [1]: "Why You Should Be Careful About 23andMe’s Health Test" - https://archive.ph/lpaUU https://archive.ph/lpaUU

tsuru 3y ago

No matter how securely you connect or rotate passwords, the inside-job or supoena risks were too d*** high

taeric 3y ago
Except... this leak was from people not having good password hygiene? Right?

_8j50 3y ago

There needs to be a term to describe this "f*k you I got mine, who cares about the future or future generations" behavior. The normalizing of dna collection, facial recognition, being oblivious to climate issues, screwing up housing market,etc...

mistrial9 3y ago
there is a rumor about bank employees during the 2007 crisis, passing a note that said "IWBTYWBT" meaning "I won't be there, you won't be there".. just what you are referring to..
smeej 3y ago
Gonna take my downvotes on this, but in my circles, we just call this "being a Boomer." Goes to your head when you're the largest generation during your formative years. Nobody has any choice but to do what you say. So you take what you can get and screw over everyone else coming after you. And then you belittle them for resenting you over it.
- edgarvaldes 3y ago
  In some years the boomer gen will be gone. The behavior, I think, wont.
moretrashplz 3y ago
Like, a government? Mine is too busy squabbling about gender identity and whether Pelosi should have her office back or not.
syndicatedjelly 3y ago
Moral hazard perhaps. Or externalities. 23andme kept the upside benefits - making money, but doesn't have to realize the downside risk - facilitating future conflict. If anyone thinks that's facetious, I encourage them to read Erin Kissane's description of what went down in Myanmar - https://erinkissane.com/meta-in-myanmar-part-i-the-setup https://erinkissane.com/meta-in-myanmar-part-i-the-setup. And then think about how they did that without DNA data.

danw1979 3y ago

“user data” …

riffic 3y ago

There are some genealogical services out there that do Leeds-Collins charts that to my knowledge work by asking their users for their 23andMe credentials, much like some third party banking services that work by asking their users directly for their banking credentials. There's a lot of really bad security in this sector.

beaugunderson 3y ago
so sad given that there was a 23andMe OAuth2 API for some time that had SNPs as OAuth scopes!
- riffic 3y ago
  gonna name and shame geneticaffairs.com here for this appalling practice: https://geneticaffairs.com/faq.html https://geneticaffairs.com/faq.html > Genetic Affairs is able to retrieve DNA matches for several DNA matching companies. To download DNA matches of these companies we need to store your login credentials. See the next section concerning the secure storage of these credentials. > Since we have to use login information for 23andme and FamilyTreeDNA, we use an isolated database in which we encrypt and store the passwords of these websites. This database is only available in a private network in the cloud and not exposed to the Internet.
  - beaugunderson 3y ago
    bizarre... I wonder why they don't just accept a raw data upload from 23andMe?

neilv 3y ago

> The information that has been exposed from this incident includes full names, usernames, profile photos, sex, date of birth, genetic ancestry results, and geographical location. Is 23andMe going to actually be held responsible? I think both our industry and our information infrastructure would be vastly better if companies were forced to be serious about security when they are collecting and holding private data.

leotravis10 3y ago
Probably not as I would guess it'll be just a wrist slap and nothing more. This not only affects users, but the user's relatives/loved ones as well.
kulahan 3y ago
As I understand it, only if they can prove some pretty intentional negligence. If some random dude sucks at his job and forget to encrypt so-and-so, or change the default password on such-and-such, it's not really the CEO's fault. Maybe you could chase after the CTO if they had policies which directly lead to this issue. Again, just as I understand it, that's why nobody gets in trouble for this shit. It's not really fair to blame any one particular person. Whether or not that can be remedied by modifying the corporate system we operate in somehow, I don't know. Probably yes, but that's not my skillset at all. edit: but in any case, this was due to people re-using passwords, so I doubt you could realistically blame the company.
- jstarfish 3y ago
  > Maybe you could chase after the CTO if they had policies which directly lead to this issue. > It's not really fair to blame any one particular person These are literally the very circumstances that we were presented with as reason why executive compensation is astronomical. It's all that responsibility they have to assume in times like these, right? They're supposed to fall on their sword, and whoever replaces them is supposed to make damn sure shit like this doesn't happen on their watch. The pay and parachutes ensure they land on their feet. The reason nothing ever changes is because these clowns never get in trouble. If you want that $10M salary, you better make sure everyone under you is doing their part to ensure events like this don't happen-- or you get dethroned. Does China still sell melamine-tainted baby formula? We've been conditioned to just let our leaders stay in command after plowing into icebergs-- while they blame and execute the engineers shoveling coal below deck.

pphysch 3y ago

> The initial data leak was limited, with the threat actor releasing 1 million lines of data for Ashkenazi people. > The information that has been exposed from this incident includes full names, usernames, profile photos, sex, date of birth, genetic ancestry results, and geographical location. Not good. Really not good. This is why I never volunteer any PII to link with my DNA. Sampling DNA is not that hard (we leave traces literally everywhere) but credibly linking it to PII is another thing.

trompetenaccoun 3y ago
All that ethnicity data will be a goldmine for future genocidal dictatorships.

neilv 3y ago

> The initial data leak was limited, with the threat actor releasing 1 million lines of data for Ashkenazi people. When the evil kind of hackers disrupted a children's hospital, did someone ask how they could be as evil as that, then had the idea, "Hey, how about selling a list of Jewish people specifically?" (They have to know that no one's going to buy that for marketing, but rather for targeting due to hatred and insanity.)

Urgo 3y ago

Unless I'm reading this wrong all that happened was someone had an existing leaked database of emails/passwords and then tried them on 23andme, and if they worked they took the data they could get. Yes, 23andme has some pretty extensive and personal data, but this attack could be done on literally any website. The issue is people re-used passwords, and also did not have 2fa enabled. So the database that is for sale is just a list of emails/passwords from other breaches that worked on 23andme, along with the data that 23andme had on those users. Not exactly a 23andme breach.

teaearlgraycold 3y ago
Use a password manager with long, random passwords. Pick your own passwords and you're leaving your door unlocked.
- dewey 3y ago
  I don't think you have to tell that to people on HN, but regular people will not be able to use most password managers. Not even 1Password is really user-friendly and it's the most mainstream one. The included one on macOS is hidden in some setting panel. For non-technical people the best authentication method is probably their phone (Passkeys, or tokens sent to their email address).
  - randerson 3y ago
    Most (all?) major browsers now have built-in password managers which are intuitive enough for regular people and provide sufficient security against these attacks.
    - dewey 3y ago
      And yet, passwords get guessed, stolen, re-used all the time. If you talk to regular people they still use pet names + a number because they want to be able to type it in everywhere. It's not a solved problem, even if a rudimentary password manager is in most browsers. Personally I don't know a single person outside of my tech bubble that uses passwords that you can't keep in your head, or write down on a piece of paper on their desk.

tpmx 3y ago

Some background for new readers: The 23andMe founder (and current CEO) Anne Wojcicki is the sister of Susan Wojcicki, until recently a long time Youtube CEO. Anne is also the ex-wife of Google/Alphabet founder Sergey Brin. Google/Alphabet is also an investor in 23andMe. Youtube is an Alphabet company.

cooper_ganglia 3y ago
The Wojcicki-Brin family tree seems like its own mini-map of Silicon Valley! It’s amusing and ironic to me that the co-founder of a gene-testing company has such an interconnected family network within the tech industry.
toomuchtodo 3y ago
> Anne is also the ex-wife of Google/Alphabet founder Sergey Brin. Google/Alphabet is also an investor in 23andMe. Youtube is an Alphabet company. It was sort of cool that as a 23andme employee some time back (10-12 yrs?), you could use some of Google's amenities because of these relationships.
deleted 3y ago
[deleted]

dboreham 3y ago

How do you exfil data on 1.3M users by guessing a few passwords?

SketchySeaBeast 3y ago
Well, it seems they took advantage of a feature that indicates who you may be related to, so they must have guessed Genghis Khan's password.
- ganeshkrishnan 3y ago
  MONGOLIAN71682@HOTMAIL.com and password "SHADOW_RAIDERZ123" that was easy.
worksonmine 3y ago
They're not guessing passwords, they have a list of e-mails and passwords from other leaks and are hoping the users are using the same credentials on all their accounts. Since password managers aren't mainstream yet it works.
- nemacol 3y ago
  How do you hide authenticating 1.3+m unique accounts? A distributed system? A mess of VPN's? Or they don't hide it because the auth system is not checking for 1.3 million auth attemps?
  - juunpp 3y ago
    The latter. Forget tracking auth attempts: > The researcher added that he discovered another issue where someone could enter a 23andme profile ID, like the ones included in the leaked data set, into their URL and see someone’s profile.
    - jtriangle 3y ago
      Ah, so they were able to use a few accounts, then fuzzed the URLS to victory... Amazingly incompetent.

oger 3y ago

[flagged]

23B1 3y ago
No, but you should feel sorry for all the people who refused to entrust 23andMe but whose relatives didn't get the memo. They'll be hurt by this too.
btgeekboy 3y ago
23andMe is a 17 year old public company with almost $300m in revenue. I’d hardly call that a startup.

mjsweet 3y ago

If I were operating a SaaS platform or any other online service, I'd be inclined to automatically reset passwords for users whose credentials have been compromised in a data breach. Has anyone here developed an automated system to handle this? I'm particularly curious about how one would automate the gathering of leaked databases and cross-reference user passwords against these lists, both at the point of signup and periodically thereafter. Seems like a compelling problem to solve.

brap 3y ago
I don’t know if there’s a service that does that, but I do know big tech companies do exactly this for their accounts (user accounts, not just employees). Additionally many password managers will warn you, including the built in ones in iOS and Chrome.

RadixDLT 3y ago

anything that has connections to google is going to be a privacy nightmare

spullara 3y ago

Maybe they could send me my dad's account password he lost years ago and no longer has the email address.

akvadrako 3y ago
You should be able to lookup the email on https://haveibeenpwned.com/ https://haveibeenpwned.com/. If it's there, they might have your password.

ganeshkrishnan 3y ago

I visited the site in the screenshot and saw someone peddling NATO leaks from their Philippines visit including "PLANCTON, CRONOS, CA SIRIUS, EMADS, MCDS, B1NT etc" And one more list of some ukrainian citizens database from 2023. please don't kill me CIA! I swear I accidentally saw it. welp! time to head back to my work.

mottosso 3y ago
That's exactly what a spy would say. Get'em boys!
yieldcrv 3y ago
what site is it?

mrobins 3y ago

$75k. Tell me the government doesn’t take privacy seriously without telling me that government doesn’t take privacy seriously. > Three weeks ago, genetic testing firm 1Health.io agreed to pay the Federal Trade Commission (FTC) a $75,000 fine to resolve allegations that it failed to secure sensitive genetic and health data, retroactively overhauled its privacy policy without notifying and obtaining consent from customers whose data it had obtained, and tricked customers about their ability to delete their data.

juunpp 3y ago
I already find the narcissistic "welcome to you" message on the package inducing of extensive amounts of vomit. And then they only get $75k for this? I want them go DOWN.
- readyplayernull 3y ago
  The FTC takes the its_not_about_the_money.jpg meme very seriously.
dheera 3y ago
Capitalism being backwards as usual. If we really take privacy seriously we should fund them $75K to fix their privacy problems. If you take away $75K from their engineering budget they will only do a worse job, and more data will leak.
- Angostura 3y ago
  That sounds like a good way to ensure monthly data leaks
- rileymat2 3y ago
  Wouldn't this incentivize insecure practices and bad practices so they can get 75k? Wouldn't that be the effect, everyone tries to as little as possible until they get paid?
- jddj 3y ago

1B05H1N 3y ago

Whoopsie daisy.

hn_throwaway_99 3y ago

I wonder if companies will seriously start to rethink "transitive permissions" or "network permissions". This is very similar to what bit Facebook in the ass years ago: I have permissions to see all the data of my friends, but in the past I could also click a button to let someone who requested see not just my own info, but also all the info from my friends. From a "computer science" perspective this makes sense: if I say you can view all my data, I lose control with who else you share that data with. But from a "human" perspective, most people don't think that if I give you access that I'm essentially giving access to the rest of the world. These types of network permissions make any company who holds them a prime target because it means bad guys only need to hack a few accounts to get exponentially more data.

deleted 3y ago
[deleted]
hunter2_ 3y ago
> also all the info from my friends They would only see the subset of what your friend shared, the set configured by its author as visible to friends of friends, right?
- hn_throwaway_99 3y ago
  No, IIRC this predates that entire permission model. "Friends of friends" today means just what it sounds like - my friends and all of their friends can see the data Iark that way. Back in the late 00s/early 10s when lots of "Facebook apps" were a bit of a craze (think Farmville), you could give an app maker permission to view your personal data and all of the data that you could see about your friends. This is how Cambridge Analytics was able to build profiles of 87 million Facebook users when only a few hundred thousand actually installed the "your digital life" app: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election https://www.theguardian.com/news/2018/mar/17/cambridge-analy...

effnorwood 3y ago

[dead]

hammock 3y ago

According to this tweet, the hackers likely got ALL of the data but only leaked a subset, 1.3 million records (only the ashkenazi Jews) https://x.com/mattjay/status/1710370423311888724?s=20 https://x.com/mattjay/status/1710370423311888724?s=20

beaugunderson 3y ago
as a 23andMe user with a high percentage of Ashkenazi genes I expected my data to be in the leak but it wasn't so it's probably not all of the Ashkenazi data
- justinzollars 3y ago
  How did you verify? I am ashkenazi
  - beaugunderson 3y ago
    assuming your last name is the same as in your HN username you are not in the file either (as to how I verified: the file is still available on the leak site)
    - marcod 3y ago
      OK, that CSV is just a subset of the data they claim to have.... so our data might still be out there even if it wasn't in this file. These are the headers: profile_id; account_id; first_name; last_name; sex; birth_year; has_health; ydna; mdna; current_location; regions; subregions; population_ids First entry is Elon;Musk;Male;1971;...
      - 1-6 3y ago
        There's a whole debate about whether Elon Musk has Jewish ancestry. Are you saying he is?
        3y ago

technol0gic 3y ago

I've said it countless times now: until there is criminal liability for negligence with regard to data warehousing/safekeeping, this is going to keep happening. because they do not care, and will not care (regardless of what their PR puts out) until their toosh is on the line. Every time there's a breach, they pull a British Petroleum "we're reallllly sorrrrrry" and buy a bunch of people LifeLock. Its absolute bullshit.

calgarymicro 3y ago
Why would 23andMe face any criminal liability? Per the article, they were never breached; only individual accounts with reused credentials exposed in other breaches. They should have had 2FA, but I don't think not having 2FA should be criminalized.
- adameasterling 3y ago
  I don’t know about criminal liability, but they’re certainly at fault for not implementing a check against known compromised passwords[1]. I believe it’s been an accepted best practice since something like 2017. 1. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
- prometheon1 3y ago
  If a bank allowed people to log in to their bank account and make transfers based on only email+password and someone stole money from a bunch of accounts, would the bank face any criminal liability? I don't know the answer, but I would say your DNA sequence should be secured similarly to your bank account.

Calamitous 3y ago

This is precisely why, though I find it to be a fascinating idea, I have steadfastly refused to do one of these genetic tests.

libraryatnight 3y ago
I remember a Simpsons joke where Homer finds out the government has everyone's DNA on file and asks about it and they say "Yep everyone who's touched a penny since 1932" or something. Turns out it didn't need to be that elaborate, you could just ask folks to mail it in ;)
- teagoat 3y ago
  you could just ask folks to mail it in (and pay for the privilege)
MerelyMortal 3y ago
Not only that, you have to make sure all of your extended family members don't take the test too.
- stjohnswarts 3y ago
  that's impossible. All you can do is talk to them and tell them it's a bad idea. The data will exist from now until the end of the current human age. Everyone wants it, 23 and me may be decent custodians, but eventually it will end up in the hands of every government, corporation, and entity interested in getting DNA information through breaches and some eventual buyer of the company selling it.
jdthedisciple 3y ago
Yeap, same here. Don't think I'll ever try any of them.
4rt 3y ago
Couldn't you just do it but with a fake name?

Footnote7341 3y ago

While we're talking about the privacy implications of sending your DNA to be sequenced 'for fun'. 23andMe already work with law enforcement, and the data science is getting good enough that they can figure out your identity if one of your third cousins turned in a DNA sample and you never did. The average person has around 200 3rd cousins.

jddj 3y ago
Can you elaborate on how that works? One of my 200 third cousins did a 23andMe swab. I then committed a crime, possibly on the other side of the country*. Law enforcement collects DNA evidence. What now? * edit: Previously this said "or world" but that felt unreasonable for the question
- steelframe 3y ago
  The list of potential culprits reduces from perhaps tens or hundreds of thousands to about 200. Family trees are very easy discover. Check out your local Mormon genealogy center if you don't believe that. At that point they can apply standard gumshoe investigative techniques to quickly narrow it down to you.
soared 3y ago
Can law enforcement ping the 23andme database with any DNA they swab?
- Footnote7341 3y ago
  Yes and it appears to be some kind of weird work around where 23andme doesn't explicitly work with them. This exact technique was used to readdress some serial killer cases recently. https://www.cbc.ca/news/world/dna-from-genealogy-site-used-to-catch-suspected-golden-state-killer-1.4637726 https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t... https://www.latimes.com/california/story/2020-12-08/man-in-the-window https://www.latimes.com/california/story/2020-12-08/man-in-t...
  - 3y ago

deleted 3y ago

[deleted]

havelhovel 3y ago

I hope someone investigates whether 23andMe adjusted user profile preferences or exposed this data through new features instead of assuming users chose to share the information now available in this leak.

jiveturkey 3y ago

Yep. Protect your precious bodily fluids people. In other news, this is surprisingly not very well known but california takes, and saves, a DNA sample of any baby born in a CA hospital. There is no consent nor opt-out, not even notification. You can write a letter to have the sample destroyed and sometime later you'll get confirmation of such. You can only hope that it wasn't sequenced and saved already and/or that it was properly destroyed. https://www.cbsnews.com/news/california-biobank-dna-babies-who-has-access/ https://www.cbsnews.com/news/california-biobank-dna-babies-w... huh. "many states" do it, I had no idea. Apparently all 50 states are required to do a genetic screening but I guess above and beyond that some states save the sample. I wonder what would happen if a parent or family member physically intervened to prevent taking the sample.

miriam_catira 3y ago
They actually will destroy it,if you have the paperwork. https://www.cdph.ca.gov/Programs/CFH/DGDS/Pages/nbs/nbsconsentforms.aspx https://www.cdph.ca.gov/Programs/CFH/DGDS/Pages/nbs/nbsconse... (Or you know, give you a certificate that says they destroyed it.)

TradingPlaces 3y ago

Many years ago I got a 23andMe kit. I was about to swab, when I asked myself, “Why is this thing so much cheaper than a lab?” I sent the unused kit back.

redder23 3y ago

Only complete and total retards use these services. People actually paying money to have their DNA data sold, you can not make this shit up. Apart form that the "research" they do it dubious AF and can't be trusted at all. There are cases where people send in DNA of a banana and get some made up human genetic history back.

ipaddr 3y ago

What site is that posted on? Looking at the data: name, location, dna group. Not very worried

mixmastamyk 3y ago

A friend of mine who did this says they don't record (any?) personal information and instead give you an id number. Sounds dubious to me. Anyone have any information on how effective their anonymization attempts were?

rhgamble 3y ago

Why keep calling the principle criminal entity a "threat actor", when in fact there is no 'act' here. They are openly selling stolen data, and it's been verified as stolen. Not deflecting the stupidity and criminality of 23andme...how stupid can a corporation working with peoples biological data be...oh wait...yes, repeatedly...its embedded in the business model apparently...operate for N+1 years, then provide a breach. Wish I could wake up from this recurring nightmare of groups with more money than they know what to do with, pretending to move humanity forward, making stupid mistakes. Nonetheless, please stop naming it a "threat actor". They are not 'acting' in any sense of the word.

calgarymicro 3y ago
> Not deflecting the stupidity and criminality of 23andme...how stupid can a corporation working with this sensitive type of data be Really? If the article is accurate, 23andMe did not have a security breach; credentials leaked in other breaches were used to compromise accounts that reused those credentials on 23andMe. Now certainly 2FA would have been advisable, but I think it's a bit much to suggest this rises to the level of criminality.
- rhgamble 3y ago
  Appreciate the note, and agree 'criminality' is a bit strong. But this is our biological data at stake. 2FA is a minimum now given the integrated credentials sharing across platforms today.

deleted 3y ago

[deleted]

onetokeoverthe 3y ago

[dead]

yieldcrv 3y ago

what marketplace is this on? I’ve seen the screenshots but I’m not familiar with that forum

xorcist 3y ago

Of course it could be massive credential stuffing. The problem is that an inside job would look completely identical. Or negligent security. If you sell your DNA profile to someone, they are free to give or sell it to someone else. At best that's a breach of contract, but what are you going to do? A successful class action only changes the price retroactively. (I am told some people sell their DNA data at a negative price, which I suspect may be the same people who pay to have to have a remotely controlled microphone at home. That I don't understand, and accept that I probably never will. But it doesn't change the underlying premise and market dynamic. The above is still true.)

valyala 3y ago
Remote-controlled microphone is embedded into every smartphone. This doesn't prevent billions of people to buy and use them :)

tamimio 3y ago

Glad I never did any of these tests, and never will, good luck changing your DNA after the leaks!

JesseHayes436 3y ago

[dead]

JesseHayes436 3y ago

[dead]

jonesn11 3y ago

This is why no matter how many interesting ads or tiktoks, I will never do these genetic testing kits. I wouldn't be surprised military is working on CRISPR like infections that target your specific DNA when sprayed in the air.

Narcie 3y ago

[dead]

williemargatet 3y ago

[dead]

Fredmacco 3y ago

[dead]