5 ms·

A service that handles sensitive personal data should absolutely have mandatory 2FA. Calling anything else “reasonable security measures” is laughable.

• yreg 3y ago
  I don't think 2FA should be mandatory. Leave that decision to me, the user.
  • meepmorp 3y ago
    The potential impact of a breach doesn't just affect you, and their security decisions should be made with a wider consideration of concerns than the short lived frustrations of users.
    • mfashby 3y ago
      It varies, I guess. For a normal end-user account on a system where no interaction between users is possible, it pretty much just affects you. For some kind of admin account with privileged access to other users' data, then it definitely affects others. One might expect increasing mandatory security measures correlating with increased potential damage of a breach. Similar to safety measures on mass transit vs. personal vehicles.
  • autoexec 3y ago
    Agreed! Any service with mandatory 2FA isn't one I want to use. I'm just fine with passwords so far.
  • hnarn 3y ago
    Your liberty starts where mine ends. By the same logic password complexity should be left up to the users as well, but what responsibility is this user willing to shoulder when they are the reason sensitive information leaks? I’m sure most people on HN have great passwords stored in password managers, but 99.9% of users are not like that, so mandatory 2FA does not only make sense, it’s the only reasonable choice for sensitive information.
• reactordev 3y ago
  This. Saying “It’s not our fault, it’s yours.” isn’t going to fly when the government comes looking. I remind everyone that there’s a new law about data breaches in effect. [1] The FTC will want to know what their security posture is and whether that meets HIPAA compliance rules or not. If not, they may lose their HIPAA compliance and be barred from applying, rendering their whole operation illegal under the FTC (s/you can only collect health information under HIPAA/you can but you still need to notify the FTC when you’re breached/). This is a serious HIPAA violation not just a security breach. This defense of theirs isn’t a smart strategy if they want to stay in business not to mention the impending lawsuits. *edit* forgot the link [1] https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0 https://www.ftc.gov/business-guidance/resources/complying-ft... [2] https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule https://www.ftc.gov/legal-library/browse/rules/health-breach...
  • gosub100 3y ago
    In the unlikely event hackers were prosecuted for actually breaking into them, I wonder if there is any material in this release the defendants could use to their benefit: "the purported victim here says in their own words their system was secured properly".
    • reactordev 3y ago
      The sad reality is they will be audited, found lacking, slapped with a small fine, told to implement 2FA as a requirement for all accounts, and go about their business. That’s been the precedent the last decade.
  • dekhn 3y ago
    23&Me is not subject to HIPAA, unless they are acting as a health care provider, or business associate (not sure but I don't think they are in this context). Most people misunderstand HIPAA, and think it applies in situations it doesn't. This is not a situation where HIPAA applies. HIPAA is NOT a privacy law. It's a law that mandates portability of medical data, some details of which overlap with privacy.