4 ms·

They do have it but they probably have millions of accounts that were created before that feature and never logged back in and set it up. It's also through an

They do have it but they probably have millions of accounts that were created before that feature and never logged back in and set it up. It's also through an auth app and not texts which is more secure but more of a hassle for not allowing users which might affect adoption.

toomuchtodo 3y ago
It is very inexpensive to check your customer passwords against HIBP [1] or strongly encourage MFA. They choose not to. [1] https://haveibeenpwned.com/API/Key https://haveibeenpwned.com/API/Key (23andme customer using Apple SSO, have strong opinions on customer IAM, passwords must die)
- henryfjordan 3y ago
  Doesn't that require you to know the password in plaintext?
  - toomuchtodo 3y ago
    Depending on your use case and implementation details, not necessarily. https://www.troyhunt.com/understanding-have-i-been-pwneds-use-of-sha-1-and-k-anonymity/ https://www.troyhunt.com/understanding-have-i-been-pwneds-us...
hakcermani 3y ago
.. can't those old accounts be flagged to require email verification to log in ?
- Scoundreller 3y ago
  Oh, you lost your email account access? Please send a matching DNA sample and $99 to unlock your account. I mean, 23andme has one of the ultimate methods of account recovery available to it. (ignoring that people tend to leave copies of their DNA everywhere, but then you could just mail that in under a John Doe and find out all the same info anyway).
  - deleted 3y ago
    [deleted]
  - sschueller 3y ago
    It could be easier and cheaper for some to get someone's hair or saliva than cloning a SIM card...
    - Scoundreller 3y ago
      My point of view here is someone that’s lost their access to 23andme, not using it for SSO for other services. While I get the social media aspects of 23andme, if one can get your DNA, they could submit that to 23andme and find out everything you already knew. I wonder how they handle duplicate submissions?
  - Zetobal 3y ago
    The Facebook way...sign up with email, get instantly restricted, need to verify with a mobile number to unlock.
  - suprjami 3y ago
    Whatever way you put this, handling the support load of the few customers who can't log in - and by this argument aren't ever logging in anyway - is better than having this degree of PII leaked and the company reputation ruined.
- mcpackieh 3y ago
  Most old accounts would probably never try to log in again anyway. After you learn that you're 3/64-ths Irish you've gotten what you wanted, why log in again? Yeah I know there's the whole genetic disorder screening thing which might receive more updates in the future, but I think most of their customers probably did this for the novelty of knowing where they came from.
littlestymaar 3y ago
> created before that feature Which feature? Unless they didn't ask their user's email (which I'd find surprising), they could have added e-mail based TFA any day without asking their users to do anything.

toomuchtodo 3y ago

It is very inexpensive to check your customer passwords against HIBP [1] or strongly encourage MFA. They choose not to. [1] https://haveibeenpwned.com/API/Key https://haveibeenpwned.com/API/Key (23andme customer using Apple SSO, have strong opinions on customer IAM, passwords must die)

henryfjordan 3y ago
Doesn't that require you to know the password in plaintext?
- toomuchtodo 3y ago
  Depending on your use case and implementation details, not necessarily. https://www.troyhunt.com/understanding-have-i-been-pwneds-use-of-sha-1-and-k-anonymity/ https://www.troyhunt.com/understanding-have-i-been-pwneds-us...

hakcermani 3y ago

.. can't those old accounts be flagged to require email verification to log in ?

Scoundreller 3y ago
Oh, you lost your email account access? Please send a matching DNA sample and $99 to unlock your account. I mean, 23andme has one of the ultimate methods of account recovery available to it. (ignoring that people tend to leave copies of their DNA everywhere, but then you could just mail that in under a John Doe and find out all the same info anyway).
- deleted 3y ago
  [deleted]
- sschueller 3y ago
  It could be easier and cheaper for some to get someone's hair or saliva than cloning a SIM card...
  - Scoundreller 3y ago
    My point of view here is someone that’s lost their access to 23andme, not using it for SSO for other services. While I get the social media aspects of 23andme, if one can get your DNA, they could submit that to 23andme and find out everything you already knew. I wonder how they handle duplicate submissions?
- Zetobal 3y ago
  The Facebook way...sign up with email, get instantly restricted, need to verify with a mobile number to unlock.
- suprjami 3y ago
  Whatever way you put this, handling the support load of the few customers who can't log in - and by this argument aren't ever logging in anyway - is better than having this degree of PII leaked and the company reputation ruined.
mcpackieh 3y ago
Most old accounts would probably never try to log in again anyway. After you learn that you're 3/64-ths Irish you've gotten what you wanted, why log in again? Yeah I know there's the whole genetic disorder screening thing which might receive more updates in the future, but I think most of their customers probably did this for the novelty of knowing where they came from.

littlestymaar 3y ago

> created before that feature Which feature? Unless they didn't ask their user's email (which I'd find surprising), they could have added e-mail based TFA any day without asking their users to do anything.