7 ms·

It was only a matter of time. I feel sorry for all the people that were tricked into trusting a private company with their genetic information.

darkclouds 3y ago
[dead]
fenalphthalein 3y ago
After reading the article, I think it's more that people were tricked into [reusing passwords across websites instead of having a password manager and randomized passwords]. It's not on 23andMe, or anyone (other than the user) for that matter, to ensure the passwords used by the user are not copied passwords from other credentials. Seems to me like passwords need to be regulated on a governmental level, but that's a can of worms of an idea that I am not ready to defend.
- chatmasta 3y ago
  I mostly agree with you, but 23andme could have prevented this by requiring 2FA for all accounts, or at least for accounts with an email in the HaveIBeenPwned database. Credential stuffing is most preventable by the user (who can simply not reuse passwords), but platforms have a responsibility as well. They can at least mitigate it through rate limiting, and mostly stop it with 2FA requirements. If an attacker is able to exfiltrate millions of records from a platform with credential stuffing, that means they tried to login to multiple millions of accounts. It shouldn't be difficult for a service to detect and stop such a sustained level of load on its login infrastructure. You can't get millions of proxies.
  - thebrain 3y ago
    Actually, if the attacker is determined enough they can use enough IPs and make it really hard to detect and defend against. I work on combating credential stuffing on a regular basis... it's quite challenging.
  - the8472 3y ago
    > but 23andme could have prevented this by requiring 2FA for all accounts They could have prevented that by not keeping the data longer than needed to send it to the user.
  - supercucumber 3y ago
    None of this is surprising. I was a sw engineer at 23andMe about 5y ago. Their backend consisted of some of the worst python/django spaghetti code I’ve ever worked on. There was also no engineering culture whatsoever.
- kulahan 3y ago
  What I make my password should be entirely up to me, with the knowledge that if my data is stolen because I reused a password, it was entirely my fault. I don't really think this needs to be regulated; government-standard guidelines are probably sufficient, with companies knowing that deviating will expose them more to litigation in the event of a problem. Not trying to argue with you, I did read your last sentence, just tossing in another POV.
  - sib 3y ago
    In this case, due to the "genetic relatives" feature, one user's choice to use poor security (e.g., "passw0rd") enabled the bad guys to get the data of other users who did use good security. Sort of a "negative security externality"...
- smeej 3y ago
  "Tricked into"? Who is tricked into reusing a password?
  - fenalphthalein 3y ago
    This is my personal take: People are sometimes tricked by natural human instinct into performing actions that give benefit to a simple human need ("it's just easier for me") at the detriment of higher-level outcomes (in this case, password security). It's simply easier for me, as a human, to remember that my password for all websites is Hunter2, rather than spend the extra time, create a password manager account, store passwords, utilize best password management practices, etc. Not saying this is what I do, but for many people, this is how they remember their password(s). Maybe I should have changed the "tricked into" to "trick themselves", but I'm just a human and this was easier for me.
- adameasterling 3y ago
  > It's not on 23andMe, or anyone (other than the user) for that matter, to ensure the passwords used by the user are not copied passwords from other credentials. In my opinion, it is, actually, on 23andMe. At my tiny startup, I implemented a simple check against Troy Hunt’s compromised password database.[1] If I can do it, 23andMe can. If anyone reading this is in the business of making web apps and there’s literally anything of value behind your login, prioritize this mitigation. OWASP recommends it too. [2] 1. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords 2. https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Credential_St...
justrealist 3y ago
I have my genetic info on 23andMe and I could not care less. Seriously — what are people going to do with it? It's illegal for insurance companies to discriminate. I'd post it myself on GitHub if anyone showed the slightest interest in using it.
- sdfghswe 3y ago
  The problem with this situation is A) precisely that you don't know what people are going to do with it, and B) that once it's out there it's impossible to undo that. You're confident enough that nothing can be done, to the point that you'd take the risk for no upside. That... doesn't sound rational to me?
  - latchkey 3y ago
    > A) precisely that you don't know what people are going to do with it We know now, they are going to leak it. Everyone is going to know that I'm an Ashkenazi Jew who is more likely going to have blue or brown eyes and hair loss. Whooops.
    - progman32 3y ago
      And we now (hypothetically, in the context of leaking genetic info) know Meryem is Uyghur, James is trans, and Alex is related to a deeply divisive political figure.
      - latchkey 3y ago
        > By day, the government pays me to publish their data.
        progman32 3y ago
        Yes, my background is in publishing open government data, such as budgets, election results, environmental info, economic data, and government program accountability studies. Not personal information. And yes, I do have strong opinions on how data is to be responsibly managed, hence my participation in this conversation. So, I'm curious if you have additional thoughts on the matter.
leotravis10 3y ago
Not just those people, but people who never even heard of the company or even visited the website due to the fact that their DNA and personal details have been shared to the site thanks to relatives' DNA. Source: https://www.linkedin.com/feed/update/urn:li:share:7116053429763936256 https://www.linkedin.com/feed/update/urn:li:share:7116053429...
- Svenskunganka 3y ago
  Veritasium has an interesting video explaining this, mentioning 23andMe on multiple occasions: https://www.youtube.com/watch?v=KT18KJouHWg https://www.youtube.com/watch?v=KT18KJouHWg
amelius 3y ago
> I feel sorry for all the people that were tricked into trusting a private company with their genetic information. And all their relatives (who share a lot of their DNA after all)
ellisv 3y ago
Much of healthcare is provided by private, for-profit companies. Even public, non-profit healthcare providers will use services (including genetic testing) from private, for-profit companies.

darkclouds 3y ago

[dead]

fenalphthalein 3y ago

After reading the article, I think it's more that people were tricked into [reusing passwords across websites instead of having a password manager and randomized passwords]. It's not on 23andMe, or anyone (other than the user) for that matter, to ensure the passwords used by the user are not copied passwords from other credentials. Seems to me like passwords need to be regulated on a governmental level, but that's a can of worms of an idea that I am not ready to defend.

chatmasta 3y ago
I mostly agree with you, but 23andme could have prevented this by requiring 2FA for all accounts, or at least for accounts with an email in the HaveIBeenPwned database. Credential stuffing is most preventable by the user (who can simply not reuse passwords), but platforms have a responsibility as well. They can at least mitigate it through rate limiting, and mostly stop it with 2FA requirements. If an attacker is able to exfiltrate millions of records from a platform with credential stuffing, that means they tried to login to multiple millions of accounts. It shouldn't be difficult for a service to detect and stop such a sustained level of load on its login infrastructure. You can't get millions of proxies.
- thebrain 3y ago
  Actually, if the attacker is determined enough they can use enough IPs and make it really hard to detect and defend against. I work on combating credential stuffing on a regular basis... it's quite challenging.
- the8472 3y ago
  > but 23andme could have prevented this by requiring 2FA for all accounts They could have prevented that by not keeping the data longer than needed to send it to the user.
- supercucumber 3y ago
  None of this is surprising. I was a sw engineer at 23andMe about 5y ago. Their backend consisted of some of the worst python/django spaghetti code I’ve ever worked on. There was also no engineering culture whatsoever.
kulahan 3y ago
What I make my password should be entirely up to me, with the knowledge that if my data is stolen because I reused a password, it was entirely my fault. I don't really think this needs to be regulated; government-standard guidelines are probably sufficient, with companies knowing that deviating will expose them more to litigation in the event of a problem. Not trying to argue with you, I did read your last sentence, just tossing in another POV.
- sib 3y ago
  In this case, due to the "genetic relatives" feature, one user's choice to use poor security (e.g., "passw0rd") enabled the bad guys to get the data of other users who did use good security. Sort of a "negative security externality"...
smeej 3y ago
"Tricked into"? Who is tricked into reusing a password?
- fenalphthalein 3y ago
  This is my personal take: People are sometimes tricked by natural human instinct into performing actions that give benefit to a simple human need ("it's just easier for me") at the detriment of higher-level outcomes (in this case, password security). It's simply easier for me, as a human, to remember that my password for all websites is Hunter2, rather than spend the extra time, create a password manager account, store passwords, utilize best password management practices, etc. Not saying this is what I do, but for many people, this is how they remember their password(s). Maybe I should have changed the "tricked into" to "trick themselves", but I'm just a human and this was easier for me.
adameasterling 3y ago
> It's not on 23andMe, or anyone (other than the user) for that matter, to ensure the passwords used by the user are not copied passwords from other credentials. In my opinion, it is, actually, on 23andMe. At my tiny startup, I implemented a simple check against Troy Hunt’s compromised password database.[1] If I can do it, 23andMe can. If anyone reading this is in the business of making web apps and there’s literally anything of value behind your login, prioritize this mitigation. OWASP recommends it too. [2] 1. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords 2. https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Credential_St...

justrealist 3y ago

I have my genetic info on 23andMe and I could not care less. Seriously — what are people going to do with it? It's illegal for insurance companies to discriminate. I'd post it myself on GitHub if anyone showed the slightest interest in using it.

sdfghswe 3y ago
The problem with this situation is A) precisely that you don't know what people are going to do with it, and B) that once it's out there it's impossible to undo that. You're confident enough that nothing can be done, to the point that you'd take the risk for no upside. That... doesn't sound rational to me?
- latchkey 3y ago
  > A) precisely that you don't know what people are going to do with it We know now, they are going to leak it. Everyone is going to know that I'm an Ashkenazi Jew who is more likely going to have blue or brown eyes and hair loss. Whooops.
  - progman32 3y ago
    And we now (hypothetically, in the context of leaking genetic info) know Meryem is Uyghur, James is trans, and Alex is related to a deeply divisive political figure.
    - latchkey 3y ago
      > By day, the government pays me to publish their data.
      - progman32 3y ago
        Yes, my background is in publishing open government data, such as budgets, election results, environmental info, economic data, and government program accountability studies. Not personal information. And yes, I do have strong opinions on how data is to be responsibly managed, hence my participation in this conversation. So, I'm curious if you have additional thoughts on the matter.

leotravis10 3y ago

Not just those people, but people who never even heard of the company or even visited the website due to the fact that their DNA and personal details have been shared to the site thanks to relatives' DNA. Source: https://www.linkedin.com/feed/update/urn:li:share:7116053429763936256 https://www.linkedin.com/feed/update/urn:li:share:7116053429...

Svenskunganka 3y ago
Veritasium has an interesting video explaining this, mentioning 23andMe on multiple occasions: https://www.youtube.com/watch?v=KT18KJouHWg https://www.youtube.com/watch?v=KT18KJouHWg

amelius 3y ago

> I feel sorry for all the people that were tricked into trusting a private company with their genetic information. And all their relatives (who share a lot of their DNA after all)

ellisv 3y ago

Much of healthcare is provided by private, for-profit companies. Even public, non-profit healthcare providers will use services (including genetic testing) from private, for-profit companies.