3 ms·
I mostly agree with you, but 23andme could have prevented this by requiring 2FA for all accounts, or at least for accounts with an email in the HaveIBeenPwned d
by chatmasta 3y ago
I mostly agree with you, but 23andme could have prevented this by requiring 2FA for all accounts, or at least for accounts with an email in the HaveIBeenPwned database.
Credential stuffing is most preventable by the user (who can simply not reuse passwords), but platforms have a responsibility as well. They can at least mitigate it through rate limiting, and mostly stop it with 2FA requirements.
If an attacker is able to exfiltrate millions of records from a platform with credential stuffing, that means they tried to login to multiple millions of accounts. It shouldn't be difficult for a service to detect and stop such a sustained level of load on its login infrastructure. You can't get millions of proxies.
- thebrain 3y agoActually, if the attacker is determined enough they can use enough IPs and make it really hard to detect and defend against. I work on combating credential stuffing on a regular basis... it's quite challenging.
- the8472 3y ago> but 23andme could have prevented this by requiring 2FA for all accounts They could have prevented that by not keeping the data longer than needed to send it to the user.
- supercucumber 3y agoNone of this is surprising. I was a sw engineer at 23andMe about 5y ago. Their backend consisted of some of the worst python/django spaghetti code I’ve ever worked on. There was also no engineering culture whatsoever.