22 ms·
23andMe tells victims it's their fault that their data was breached
- JohnMakin 3y agoThe fact that they immediately enforced MFA after the breach shows they know exactly how culpable they are.
- Spivak 3y agoYeah, that's a pretty dumb movie on their part to immediately mitigate the attack and show the whole world it was possible the whole time and it was via an industry accepted best practice. Why people don't get that TOTP is just "strong unique password" you can enforce from the service provider side is beyond me.
- it_citizen 3y agoRemember that when you are giving your DNA to a company, you are also partly doing it for all your family members. Maybe talk about it with them before doing it, especially if it is just for fun.
- travoc 3y agoIt's a security flaw in life itself.
- y0ssar1an 3y agoif it was truly a credential stuffing attack, then there's a shared responsibility between users and 23andme. 23andme is responsible for not enabling 2FA. the users are responsible for reusing passwords. to me, the takeaway is that we need to roll out passkeys as quickly as possible.
- eli 3y agoEven if they didn't want to do 2FA for whatever reasons, there are things they could have done like checking password hashes against breaches.
- bilekas 3y ago11k people due to credential stuffing is not a dent in the 6+ million though. It's a disingenuous argument. Not only that but they're should have been far better protected against even poor password management by users given the type of sensitive information they're handling.
- Beldin 3y agoThe service requires authentication, but then does not take the obvious steps (industry mediocre(1) practices) to ensure widely known problems with authentication are mitigated - let's not blame regular people for the failure of this service to secure their accounts. (1) the bar to do better is quite a bit below "best practices".
- yreg 3y ago2FA was enabled, just not mandatory.
- liorben-david 3y agoIs there a geneology service that does not store your data? Any kind of storage is a non-starter.
- pintxo 3y agoIsn’t the whole point of such a service to store your data? To make it possible for others (genetically) related to you, to find you?
- awinter-py 3y agosignal does some hash-based matching of your contacts without storing your contacts (but also re 'whole point', not sure about split btwn people who want their own genetic profile vs searching for long-lost twin)
- GnarfGnarf 3y agoIn order to use DNA tests in genealogy, you need to know every segment on every chromosome that matches. Matching is not a go/nogo proposition. There are degrees of matching that depend on the biological relationship. Ex: Parent/children average 3,700 cM (centiMorgans), siblings are 2,600 cM, first cousins 900 cM etc. See: https://whoareyoumadeof.com/blog/need-a-dna-centimorgan-chart/ https://whoareyoumadeof.com/blog/need-a-dna-centimorgan-char...
- programjames 3y agoYou can do holomorphic encryption.
- GnarfGnarf 3y agoThe DNA date needs to be readable by third-party apps, if the user so wishes.
- 3y ago
- unklefolk 3y agoDoes this mean that 2FA was not in place? For a company handling such personal information, this seems like a minimum requirement.
- JohnMakin 3y agoIn the article: > After disclosing the breach, 23andMe reset all customer passwords, and then required all customers to use multi-factor authentication, which was only optional before the breach.
- MattGaiser 3y agoOften on discussions about 2FA and IP address checks on HN, there is a sizable contingent that is frustrated with how ever more security impacts how they want to use the product such as people wanting to be able not to own a smartphone while still doing online banking or using their credit cards overseas. Add in all the people who struggle to use 2FA of any kind. At my first employer, I was there when they implemented it and it basically destroyed an entire week of productivity as so many people struggled to grasp how to set up a token in the authenticator app and use the token. I would be curious to know what the stats are on how 2FA impacts use and churn of users.
- phatskat 3y agoI can definitely understand this argument - imagining my dad setting up even SMS-based 2FA makes me shudder. However, for information this sensitive, it would have been smarter (imo) to strongly encourage 2FA, along with tutorials on how to set it up (articles, videos), and finally to add an option to not use it with a BIG SCARY WARNING and a consent checkbox. Ultimately, companies like this are making the choice of information safety vs profits - it’s a tale as old as the free market.
- block_dagger 3y ago> users negligently recycled and failed to update their passwords following these past security incidents, which are unrelated to 23andMe. Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures. 23andMe's argument seems ridiculous on its face.
- yreg 3y agoIt doesn't seem ridiculous to me.
- gkbrk 3y agoWhy? You could have a 100% secure website, but if the user gives their credentials to someone else (another website in this case), and that website with bad security gets hacked and leaks the credentials, how is that their fault?
- Spivak 3y agoBecause we've known about credential reuse for 20+ years, developed multiple means to keep a site secure when it happens and then chose to not employ those security measures on data people broadly consider incredibly sensitive. It is your job as a service provider to not allow access to anyone but the authorized user, how you do it is an implementation detail. You can't throw up your hands and say "well we decided that doing that is too hard so we're defining the authorized user as anyone who knows the password."
- elektor 3y agoAs someone who is excited about the potential of using DNA tech for new drug discovery, I’m really sad to see 23andme handle this so poorly. I’m seriously considering not doing their periodic health surveys given this incident + them putting updated health reports behind a paywall. Luckily I’m also in the NIH All of Us program and they’re at least better about data safety (for now?).
- liquidise 3y agoSo 23andMe failed to identify brute force and credential stuffing access of 14,000 accounts. They also have a feature that grants those 14k compromised accounts effective access to 6.9 million accounts. 23andMe then claims that poor password practices are responsible for this data leak. > “Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures” I've not run security at an org of their size, nor have i touched their service, but i have to imagine there were some patterns to this breach that would have been reasonable to account for ahead of time. Did those 14k accounts also have their email provider accounts compromised? Could a login ip-range check have prevented all of this? 2FA seems like an obvious answer here but clearly that was more than could be expected.
- hnarn 3y agoA service that handles sensitive personal data should absolutely have mandatory 2FA. Calling anything else “reasonable security measures” is laughable.
- yreg 3y agoI don't think 2FA should be mandatory. Leave that decision to me, the user.
- meepmorp 3y agoThe potential impact of a breach doesn't just affect you, and their security decisions should be made with a wider consideration of concerns than the short lived frustrations of users.
- mfashby 3y agoIt varies, I guess. For a normal end-user account on a system where no interaction between users is possible, it pretty much just affects you. For some kind of admin account with privileged access to other users' data, then it definitely affects others. One might expect increasing mandatory security measures correlating with increased potential damage of a breach. Similar to safety measures on mass transit vs. personal vehicles.
- DueDilligence 3y ago[dead]
- keepamovin 3y agoThat's a great title. I love how they've encapsulated judgment, jurisprudence and execution in a single sentence! Mastery of "journalistic" hangfolken. hahahah :)
- Slapshot_gd 3y ago> “Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures” In all honesty, you can hardly make this claim unless they properly communicated and mandated (at least in writing, since I can't imagine how it could be actually enforced) that users chose/pick passwords different from other platforms. Or at the least enforce an aggressive password change schedule, etc...
- ziddoap 3y ago>at least in writing, since I can't imagine how it could be actually enforced You can check passwords against known-compromised lists and then tell the user "sorry, please use a different password". This is something that is a recommended best practice, and has been for at least a few years. >Or at the least enforce an aggressive password change schedule This has been explicitly not recommended since at least 2016 by NIST. Research has shown this leads to password fatigue, which results in weaker passwords that are just iterated on (password1 -> password2 -> password3).
- programjames 3y agoOr, users can check their passwords against known-compromised lists. It's not on them to hold users' hands and check for their mistakes.
- ziddoap 3y agoYes, users can (and should) be doing that as well.
- Beldin 3y agoLet's not fall for 23andMe's attempts at victim blaming. They offered the service, and they failed to implement to reasonable security practices. Their process allowed users to pick "obviously" flawed passwords. Well, those passwords weren't obviously flawed enough to bar their use, but obvious enough to blame users afterwards.... yeah that's BS.
- ballenf 3y ago> Such information would only be available if plaintiffs affirmatively elected to share this information with other users via the DNA Relatives feature. I'm skeptical that 6.9 M users opted-in to an off-by-default setting. That seems absurdly high for any opt-in feature that involves nebulous user value. I don't use 23andme, but I'd love it if someone had screenshots of this supposed "opt-in" before the data breach. Also, how far does the sharing go? How far removed from a family member does a user have to be to see their info? Going from 14k to 6.9M seems like it must have been more than just immediate family, given the small family size common today.
- MattGaiser 3y ago> Also, how far does the sharing go? How far removed from a family member does a user have to be to see their info? Going from 14k to 6.9M seems like it must have been more than just immediate family, given the small family size common today. Looking at mine, it shows me 4th cousins and closer. So way more than immediate family. The user value isn't nebulous. If you are curious about your ancestry, you might also be curious to see what people you discover or see if your family tree is your real family.
- crazygringo 3y agoIt seems pretty plausible to me, because finding relatives -- especially unknown ones -- is one of the 3 main use cases of the product (the other 2 being understanding your ethnic background and health/disease markers). They have ~14M users total, so this is 50% of them opting in. That seems entirely reasonable.
- progval 3y agoThis is 50% of them opting in AND being considered relatives to the 14k who reused vulnerable passwords. For all we know, there may be 99% opt-in but only half the opt-ins are "relatives".
- ysavir 3y agoBut how does the hacker get the DNA data? A feature to find relatives is one thing, exposing all those relative's DNA to the current user is another thing entirely. All the math would be done on the backend, not exposed to the end user, no? Or is the implication here that by getting DNA on the 14k compromised users, the attackers can draw meaningful conclusions on the DNA of those in their network?
- pompino 3y ago>“ 23andMe knew or should have known that many consumers use recycled passwords ” How would they know this?
- squigz 3y agoThere's at least 1 service [1] that allows checking previous data breaches for compromised emails/passwords. I imagine there's others, too. https://haveibeenpwned.com/API/v3 https://haveibeenpwned.com/API/v3
- deleted 3y ago[deleted]
- pompino 3y agoThere is no way to verify that the usernames from the leaks are the same person as your users.
- shermantanktop 3y agoHow could they not know this? This is common knowledge for anyone involved in online consumer security. And the correctness of this common knowledge is beyond dispute, with numerous publicly-known breaches traceable to this practice, as well as the development of scaled, repeatable attack methods associated with it. The only way they could have not known is if they failed to employ or consult with the appropriate professional expertise in this area.
- kazinator 3y agoNo, how would they know this for any given password? Gashibyu@gyoryana3: is that recycled, or freshly minted?
- pompino 3y agoalso there is no way to know if the usernames from the leaks are the same person as your own users. otherwise, you’re essentially saying that you have to pick a unique password that nobody else in the world is using.
- IceTDrinker 3y agoAs long as there is no dissuasive penalties this will keep happening
- porkbeer 3y agoIts not like they dont already provide this to police and governments without a warrant and sell the data. If you expected your most personal data to be secure with them you havent been paying attention.
- 1B05H1N 3y agoThey prioritized earning new business and lowering customer friction over enforcing MFA. They also had no idea 14k accounts were brute forced and cred stuffed, so that's 100% on them. They have enough money to do the security work.
- ziddoap 3y agoOn one hand, I have to somewhat agree with 23andMe here. If someone uses the password "password1" for some service, they should not be able to turn around and blame that service when their account is compromised. On the other hand, 23andMe should have definitely done much more to reduce the blast radius of this attack. Mandatory 2FA, disallowing known-compromised passwords, geolocation of login IPs, etc. I guess the question shakes out to: where do we draw the line on personal responsibility vs. service responsibility? Services can't be responsible for 100% of user security. But they also can't be negligent in their own security and mitigations.
- deleted 3y ago[deleted]
- JohnMakin 3y agoWhere your first argument falls apart is the other several million users who had their data breached didn’t have compromised accounts. It quite literally isn’t their responsibility or problem at all.
- ziddoap 3y agoThey opted-in to the sharing feature though?
- JohnMakin 3y agoI'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
- rciorba 3y agoif you choose to share data with Bob, you have to accept the consequences of Bob being sloppy with your data
- 3y ago
- jmoak3 3y agoJust a reminder that you can (...and should?) request to delete your account and associated data [0][1]. [0] https://www.washingtonpost.com/technology/2023/10/12/23andme-hack-data-breach/ https://www.washingtonpost.com/technology/2023/10/12/23andme... [1] https://customercare.23andme.com/hc/en-us/articles/212170688-Requesting-23andMe-Account-Closure https://customercare.23andme.com/hc/en-us/articles/212170688...
- drdaeman 3y agoJust a reminder that despite whatever their front page advertises, while your account will be marked as "deleted" (23andMe still retaining your email address and some other pieces of information), your genetic data won't be deleted: > 23andMe and the contracted genotyping laboratory will retain your Genetic Information, Date of Birth, and sex as required for compliance with legal obligations, pursuant to the federal Clinical Laboratory Improvement Amendments of 1988 and California laboratory regulations. > 23andMe will retain limited information related to your data deletion request, such as your email address and Account Deletion Request Identifier, as necessary to fulfill your request and for the establishment, exercise or defense of legal claims. And that's why I don't use 23andMe, even though I'm quite interested in the product and was super tempted to buy. Just because it's not future-proof, and that's a deal breaker. If you know of a DNA sequencing service that can do its job, send the result, then destroy every sample and every bit of information they had (save, possibly, for the payment receipt), please let me know. Don't care about ancestry, relatives and other social stuff, just the raw genetic data.
- _jal 3y agoIf we're going to blame the victims, at least do it right - the mistake was submitting sensitive information to a gross, sketchy outfit like 23andMe. Much like Uber, self-enshitification was obviously the "???" part of the underpants gnomes' plans.
- electrodeyt 3y agoI wonder if they (23andMe) can sleep at night after telling innocent people that something was their fault
- khazhoux 3y agoIf you read the article, it discusses how the initial breach was due to users using same password for 23 as on other sites. It’s really very difficult to guard against that, no?
- codelikeawolf 3y agoThis is like a home security provider blaming the victims of a break-in for not changing their locks every 6 months. Just take the L and own up to it, 23andme.
- dpkonofa 3y agoThat’s not at all what it’s like. This is like using the same PIN for your work lock and home lock and then blaming the lock maker when thieves from work got into your house because they found your address in the stuff they stole from your work.
- codelikeawolf 3y agoMy bad, I skimmed the article and must have misunderstood. Fair point.
- khazhoux 3y agoBad analogy. The issue was passwords used on multiple sites. Nothing to do with rotation.
- codelikeawolf 3y agoYep, you're right. I skimmed the article and misunderstood.
- vel0city 3y agoIts getting mad at the home security provider because you made a hundred copies of your house key, sprinkled them all over the town with your address on a tag, and someone managed to get into your house.
- deleted 3y ago[deleted]
- arp242 3y agoI think 23AndMe could perhaps have done better in detecting this sooner – "perhaps" because with a sufficiently large botnet that's not so easy to detect quickly and details are not available AFAIK. But other that that, I ... kind of agree with 23AndMe: users should be primarily responsible for their own accounts. I don't like the "assume all users are blubbering morons and treat them as such" security model, and then blame $corp for treating their users as adults. Again, 23AndMe could have done better, maybe, but I strongly disagree that they're primarily responsible – at best they're partly responsible. And maybe 23AndMe also could/should have pushed 2FA harder, I don't have an account so don't know how hidden this feature was or not. All I know is that mandatory 2FA is a right pain for me, adds basically no security for me because I just store it in my password manager next to the password. For TOTP it's just an inconvenience, but I really dislike phone-number based 2FA – I've been locked out so many times...
- LargeTomato 3y agoMy cousin has some of my DNA in her DNA. She blundered it away. I wish 23 and me had treated her like the blubbering fool she is.
- maerF0x0 3y agoAs mentioned in the article, a few mitigations could have been applied to mitigate, though not eliminate. None of these are perfect, nay sayers will pop up lamenting "it wouldnt work" but the point is it would help. 1. Fraud detection on the metadata like IP address, access timing, access patterns etc. eg: Why is a person from UK logging in from China IP? 2. IMO orgs should be importing and refusing known leaked credentials and the top 1000 passwords. This could happen both at password set time ("You cannot use that password as it's a known leaked credential, click here for more info about the breach"), or at login time "You're using a leaked credential, please follow the password reset flow".
- vel0city 3y ago> Why is a person from UK logging in from China IP? And then we get to the other side of this where people get locked out of accounts because they went on vacation and bothered to check their email. And often times these "person from UK logging in from a China IP" are massively wrong. For the longest time my home IP was showing up as from another country in most GeoIP databases. They're routinely trash.
- theragra 3y agoI think best solution is to do this for users without MFA. That way we wont suffer for their sins.
- maerF0x0 3y agoThe only good thing I have to say about lastpass is that they allowed you to allowlist countries you wanted a login from. Like calling your credit card company, I'd login and add a country if I was traveling.
- vel0city 3y agoThat's an example of what I was talking about though. I set LastPass to only let me sign in from the US and suddenly I was locked out at home because it thought my home IP address was non-US despite definitely being in the US at the time.
- MBCook 3y agoYou always know you’re in a strong position when you have to resort to “stop hitting yourself” or “don’t make me hurt you, I don’t like it when you make me hurt you”.
- shermantanktop 3y ago23andMe, Ancestry.com, and similar sites have extreme appeal to some of the oldest and least technical users. It's grandmas and grandpas who are willing to pay $20/month for a DNA site. The Venn diagram of DNA site users and online/telephone scam victims has to have a big overlap. This is a tough population to increase the security for. They are highly vulnerable to social engineering, reuse passwords, use weak passwords, and struggle mightily with 2FA or other methods. But that's the gig, it's on 23andMe to solve it.
- karaterobot 3y agoOn the one hand, I sympathize with anyone whose data is stolen in a data breach, we've all been there (and some of us have three dollars from Equifax lining our pockets to prove it). On the other hand, I remember thinking ten years ago or whatever: "23AndMe sounds cool, I'd love to know about my ancestry and genetic risk factors, but that's a crazy amount of intensely personal data to trust a corporation with, so I guess I won't do that." And I'm as dumb as a rock, so if I made that decision with the same information as everyone else, it must have been pretty obvious what the consequences could be.
- deleted 3y ago[deleted]
- kazinator 3y agoHere is the thing: unless the attackers got into these accounts by guessing weak passwords at the login page, 23andMe are at fault. The data breach by which attackers get their hands on passwords isn't the fault of the users. Only the consequence of that breach to some of the users is their own fault.
- compsciphd 3y agoSo I'm a user of 23andMe. I have DNA relatives on (dont find it that useful though), but I don't really see much "DNA" in terms of "my relatives" (I've also never accepted anyone to see any of my profile, I just see who they say are relatives and how close they are (first/second/third cousin and so forth). I assume most people are the same. Therefore, I'm not sure what significant information an attacker could have gotten on me. Anyone care to enlighten me?
- crazygringo 3y agoYeah, this is my understanding too that if you weren't reusing passwords, then basically all they know is a little bit of your family tree. Which is probably mostly already pretty discoverable through public records, obituaries, and genealogy sites. It's not like 23andMe is telling you that your third cousin has some specific genetic risk for a disease, right?
- turquoisevar 3y ago> It's not like 23andMe is telling you that your third cousin has some specific genetic risk for a disease, right? So… about that: https://ibb.co/hRmgRQy https://ibb.co/hRmgRQy Edit: Keep in mind the default is “Yes”
- compsciphd 3y agoSort of. This is someone who tried to connect with me and it says. "By connecting you will be able to explore each other's personal and genetic information, which may reveal surprises. Learn how sharing works." And if one clicks on the learn link, one sees. "Establishing a sharing connection on 23andMe allows users to view one another's profile names and information (including profile sex), information from compatible reports, your predicted relationship, and the number and location of overlapping DNA segments. A sharing connection does not allow either person to search or download the other person's raw data, access their DNA Relatives list, or if applicable, view reports that require an additional consent, or view and download the other person’s Reports Archive." I never established any sharing connections and assume the same for most.
- iamleppert 3y ago23andMe is such a bizarre service to me. I have absolutely no desire to find out the details of some long lost cousin I don’t know, or know there is a chance I’m 2% Viking. Or have the chance to develop some weird kind of cancer because some post doc working in a papermill published a paper. I would have never guessed people would be interested in such useless information.
- NoZebra120vClip 3y agoAs the family genealogist, I completely agree. 23andMe had such minimal utility in comparison to the first service where I tested. At most, it corroborated and confirmed what I already knew and had been told. Also I identified the strongest possible genetic match, a person who hadn't tested elsewhere. But 23andMe's cutesy haplogroup classifications, their faux historical narratives, the ridiculous litany of "health conditions" they warn me about, it's bunk, 100% bunk. Plus, no medical professional will accept this data as diagnostic, so why bother?
- dandesim 3y ago6.9 million accounts had information stolen because they were "relatives" of 14,000 users? Something doesn't add up there. That would mean each of those random users had 492 "relatives" on the platform. I've never used 23andMe for fears of exactly this, but they should look at recalibrating what the term "relative" means if you're opting in to sharing genetic information. The average Facebook user has 338 friends, as a point of reference, and I sure wouldn't want my information shared with those people.
- tzs 3y agoThey go out to 4th cousins. I've got 1500 people that 23andMe says are my relatives. > 6.9 million accounts had information stolen because they were "relatives" of 14,000 users? Something doesn't add up there. It adds up. The key is that for the attackers to get my data they only have to compromise 1 of my 1500 relatives. 14 000 out of 14 000 000 accounts were compromised, so 1 in a 1000. In other words the attacked has 1500 chances to roll a 1 on a d1000 if they want to get my data. The probability they can do that is 1-(1-0.001)^1500 which is 0.78. If everyone had about as many relatives as I do, we'd expect the attackers to get data on nearly 11 million people from those 14 000 compromised accounts. Getting "only" 6.9 million suggests that on average people have a little under 700 relatives.
- Ekaros 3y agoSo from now on does everyone here check each login from any user against known vulnerable password lists or known leaks? As new compromises might appear after password has been set or changed...
- tzs 3y agoIt's not clear to me, due to the particular nature of the data in this breach and why it was available to the 14 000 compromised accounts, that it getting breached will actually cause any damages. This is data that appears in the ancestry data for the 14 000 compromised accounts. Your data only appears in another account's ancestry data if you opted in to sharing ancestry data and they are a relative of yours. I think most people opt in, because (1) finding out about your ancestry and relatives is one of the main reasons people use services like 23andMe, and (2) even people who started using it just for the health data often get curious and start using the ancestry stuff too. 23andMe counts anyone who is a 4th cousin or closer as a relative, which results in some big relative lists. Mine has 1500 other 23andMe users in it, but that might be above average. Based on 23andMe having 14 million customers, 14 000 accounts being compromised, and 6.9 million accounts having data taken via the relatives lists of those 14 000 compromised accounts, and assuming that everything that I don't have any data on is is pretty evenly distributed (the statistical equivalent of a spherical cow) I'd guess that the average is around 700. If that's even in the right ballpark then when you opt in to sharing this data you are opting in to share it with several hundred people, mostly complete strangers to you, mostly scattered all over the US and a few foreign countries. At that point I'm not sure if the different between just sharing it with them and sharing it with the world is meaningful.
- 1vuio0pswjnm7 3y agoAccording to this filing, as of 29 Dec 2023, there are 35 cases filed against 23andMe so far based on this incident. https://ia904506.us.archive.org/10/items/gov.uscourts.cand.364325/gov.uscourts.cand.364325.623.99.pdf https://ia904506.us.archive.org/10/items/gov.uscourts.cand.3... Almost all of them are in N.D. Cal but there is one filed in N.D. Ill. and one in C.D. Cal.
- PudgyWudge200 3y agoWhat an absolute farcical state of affairs here from 23andMe.
- dekhn 3y agoTo be honest it's amazing they are still in business. The company was originally founded on unreasonable goals in the health industry, using DNA array testing to identify risky variants in individuals to help produce better treatments. It took the CEO about a decade to learn enough to acknowledge that their approach would never have achieved this, because the mapping from genome to risk/treatment is a highly complex function and their mechanism was underpowered and they also repeatedly pissed off and ignored the FDA who then shut them down for a while. The only reason they survived this was, afaict, the CEO's ability to extract money from google to keep operating. Eventually, the company found that they could do identity by descent really well, much more useful to customers than telling them their earwax properties, and their "recreational genomics" products were extremely popular- enough to sustain a service, but not really enough to sustain advanced research. They finally got some pharma to give them a bunch of money for their data (basically all the genomic and phenotype data that they collected on their users) ostensibly to do translational health research, but this has not been very productive (and seems unlikely to be truly transformative). In the meantime they have to keep runing their consumer platform and it clearly had security issues that permitted a large scale data extraction (that's on them, not the customers) and I jusrt can't see how they keep getting money to operate, because their track record in translating data to profit/medicine has been so skimpy.
- myth_drannon 3y agoAll the other DNA test companies(MyHeritage, Ancestry) use DNA kits as a funnel to the more lucrative genealogy subscription services. But that market is pretty crowded and established, so 23andME is stuck in trying to sell DNA data.
- ravenstine 3y agoBetter yet, is it at all feasible to do at home for a Hacker News type with the right equipment and not breaking the bank?
- dekhn 3y agomechanically, it's feasible. Scientifically, it's suspect.
- RadixDLT 3y agoCurrently, they are running advertisements claiming to offer the best DNA testing kits, but their approach is tarnishing the authenticity of articles.
- slipperlobster 3y agoThe testing kits may be the "best" - their data retention and security just sucks. I (stupidly) did 23andMe a while back, I've since requested my data to be deleted. Who knows if that's even honored.
- dylan604 3y agoI never trust that someone has deleted data. There is NO way of knowing that they did. Did they delete from the active database? What about clones of the data to DEV? What about back ups? I seriously doubt any company restores a back up to purge data only to make a new back up of that. If they did, do they purge the original back up and only use the new? I don't care if something like GDPR states they must. I do not trust corps to actually go through the hassle/expense of it.
- slipperlobster 3y agoCompletely agree, and I am continuously frustrated that the US has such poor personal privacy standards and regulations, regardless of how effective any existing regulations are.
- kijnh23uihUI3 3y agoIt's amusing how Google has shut down more services than Facebook, Microsoft, and Apple combined. Despite this, the controversial 23andme is somehow still operational. It seems like Sundar Pichai is doing everything in his power to dismantle Google.
- Apocryphon 3y ago23andMe is not an Alphabet company, whatever personal ties to Google royalty its founder might have.
- justrealist 3y ago> The firm claimed complainants had “negligently recycled” login credentials from other exposed accounts and that poor cyber hygiene practices were to blame for their exposure during the breach. I mean. If people reused passwords for 23andMe, is this really 23andMe's fault? Should they have required 2FA for everything? That's kind of a hard sell tbh.
- lambdaba 3y agoI agree with this. Frankly, if something is to blame, it's user agents / browsers that should be much better at educating and alerting about password reuse.
- titzer 3y ago> during the breach. Absurd that they thought that we'd miss this part of the sentence.
- CodeWriter23 3y agoWrong question. Correct question: how does 23andMe know any customer used "password123" as a password?
- transcriptase 3y agoProbably cross referenced their compromised customer account emails with a pastebin of email:pass pairs leaked from another hack.
- lambdaba 3y agoI think one fair criticism is they could have had intrusion detection trigger when, presumably, the same IP address was logging in to thousands of accounts. But who knows how sophisticated the attack was? [edit]: there are other obvious heuristics that could have detected it, it does show they had either very basic or no intrusion detection, which, for a service of this nature, isn't really acceptable
- deleted 3y ago[deleted]
- nerevarthelame 3y agoIt's all a balancing act between not wanting to unduly impact legitimate customers, while blocking as much fraud as possible. Blocking the credential stuffing attacks? They probably did have mitigation efforts, but you can only be so aggressive before the false positives start blocking significant numbers of legitimate customers, who have no recourse except to wait out a temporary ban. And some credential stuffing attacks are extremely sophisticated, such that even best in class security companies can't always effectively block them. Mandatory MFA? Great on paper, except that 10% of people hate the extra steps (probably with great overlap between the people reusing passwords) and will complain and/or disable it if given the chance. Another 20% have invalid or out of date contact details (an old employer's email address, a landline phone number that can't receive SMS, etc.), and they'll be locked out of their accounts. Yeah, there are ways to mitigate these downsides. And I'm not arguing that 23andme found the appropriate balance between "customer satisfaction" and "customer security." But I can see how a mostly reasonable organization could end up in this position. And it's mainly the risk of terrible press and upset customers that allows other companies to justify more security-oriented policies, so let them have it.
- randerson 3y agoEvery other healthcare website I use requires me to use enter a code texted or emailed to me the first time I log in from a new computer. If someone used a corporate email address for personal services, they're likely used to being locked out of things. 23andme is also unique in their ability to create security questions to authenticate users who get locked out. "What is your date of birth and can you form a sideways U shape with your tongue?"
- woah 3y agoIs there anywhere to get a DNA test anonymously? I assume maybe you could put false information into 23andMe, but I assume they'd still have your name from your credit card.
- throwanem 3y agoWell, I suppose it's nice we now have a canonical example of how not to do messaging around a successful credential stuffing attack...
- crowcroft 3y agoMore likely this will prove to be another example of individuals under appreciating their personal data and privacy, and over appreciated some kind of novel technology.
- beej71 3y agoSounds like if you don't require 2FA on your site and users are allowed to share data with one another on your site, you're now open for lawsuits.