4 ms·

Eh, millions of accounts hacked via credential stuffing on one platform because of reused passwords? I don't buy it for one second.

• slg 3y ago
  And even if it is true, that is still the fault of 23andMe. It is kind of a fool me once scenario. Some occasional password stuffing is excusable and can be blamed on users' laziness. Millions of accounts hijacked through password stuffing and something is fundamentally wrong with 23andMe's approach to security for not identifying such a large scale attack.
  • wubrr 3y ago
    100%
• astroid 3y ago
  It wasn't millions of accounts, it was an undefined number relying on scraping dna relatives after the breach. This article mentioned it, but last week I saw a better more detailed explanation. Regardless, the key quote from the linked article: "23andMe blamed the incident on its customers for reusing passwords, and an opt-in feature called DNA Relatives, which allows users to see the data of other opted-in users whose genetic data matches theirs. If a user had this feature turned on, in theory it would allow hackers to scrape data on more than one user by breaking into a single user’s account."
• dboreham 3y ago
  Related: what fool decided to call compromised credentials "stuffing"? Nothing is being stuffed.
  • xyzzy123 3y ago
    You take all the breach dumps you can find and "stuff" the username/password pairs into other sites.
  • ziddoap 3y ago
    Credential stuffing is a specific type of attack which uses compromised credentials. Not all compromised credentials are used in credential stuffing attacks.