4 ms·

On one hand, I have to somewhat agree with 23andMe here. If someone uses the password "password1" for some service, they should not be able to turn around and b

On one hand, I have to somewhat agree with 23andMe here. If someone uses the password "password1" for some service, they should not be able to turn around and blame that service when their account is compromised. On the other hand, 23andMe should have definitely done much more to reduce the blast radius of this attack. Mandatory 2FA, disallowing known-compromised passwords, geolocation of login IPs, etc. I guess the question shakes out to: where do we draw the line on personal responsibility vs. service responsibility? Services can't be responsible for 100% of user security. But they also can't be negligent in their own security and mitigations.

deleted 3y ago
[deleted]
JohnMakin 3y ago
Where your first argument falls apart is the other several million users who had their data breached didn’t have compromised accounts. It quite literally isn’t their responsibility or problem at all.
- ziddoap 3y ago
  They opted-in to the sharing feature though?
  - JohnMakin 3y ago
    I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
    - rciorba 3y ago
      if you choose to share data with Bob, you have to accept the consequences of Bob being sloppy with your data
    - yreg 3y ago
      Isn't that obvious? If I share a Google doc with you I'm taking the implicit risk that your account might be compromised along with my document when you e.g. forget to log out at a public computer.
    - Ekaros 3y ago
      I think it is unreasonable to blame site when you allow sharing data by certain separations. Like in social media set your friends' friends to be able to see your data. If one of these friend's friend is bad actor. Is it really on the site to prevent them seeing the data?
- dpkonofa 3y ago
  They shared their info with a compromised account. If you didn’t share your DNA matches with the other person, you would have nothing to worry about.
  - luxuryballs 3y ago
    that’s why I only share my profiles with people who have a strong password
    - dpkonofa 3y ago
      Do you share your banking info with complete strangers? If not, why would you share your DNA with them and be surprised that they could do something stupid, foolish, or reckless?
      - crazygringo 3y ago
        > Do you share your banking info with complete strangers? I think this is why we were all so surprised when Venmo took off in popularity, with everybody's transactions made public by default...
        dpkonofa 3y ago
        I still don't understand how so many people can have that info public. Blows my mind...
        deleted 3y ago
        [deleted]
  - JohnMakin 3y ago
    I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
- deleted 3y ago
  [deleted]
- lolinder 3y ago
  When you send people secure information through any means, you are accepting that the security of that information is now equivalent to the worst level of security practices of all the people who received that information. When the recipients are a large collection of random strangers on the internet, you should assume the data is as good as public, because the average random stranger on the internet has terrible security practices (not to mention the non-zero probability that they're actively malicious). 23andMe could have done a better job communicating the risks of sharing your data with random strangers on the internet, but it's also not unreasonable for them to put some level of blame on users. If you wanted to treat that information as secure, you shouldn't have opted in to sharing it with an arbitrary number of strangers.
- Rudism 3y ago
  Those users signed up for a service with poor security controls (no 2FA, no requirement to rotate passwords at regular intervals) and then checked a box saying "share my data with other accounts." So while I agree with you that those users are not responsible for the accounts that were actually compromised, they were fully responsible for sharing their data on that service without fully thinking the implications through. 23andMe is not blameless--it's their poor security controls that allowed it to happen in the first place--but I strongly feel people do not take security and privacy as seriously as they should and as a result do share at least some of the blame.
  - gkbrk 3y ago
    > no requirement to rotate passwords at regular intervals Password rotations are dumb and do not improve security.
    - Rudism 3y ago
      Is that true though? I agree they're annoying and in an ideal world where users don't reuse passwords or leaked hashes can't be broken they'd be pointless--but in this case I think it certainly would have protected at least some of the accounts that were reusing breached passwords. Is there actual evidence/research that proves password rotation has no effect on security in the event of breaches?
      - ziddoap 3y ago
        >Is that true though? NIST, Microsoft, etc. didn't decide to change their minds (to now explicitly discourage arbitrary expiration) out of the blue. See: https://web.archive.org/web/20180603140100/https://www.cs.unc.edu/~reiter/papers/2010/CCS.pdf https://web.archive.org/web/20180603140100/https://www.cs.un... >Using this framework, we confirm previous conjectures that the effectiveness of expiration in meeting its intended goal is weak. Also see: https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf https://people.scs.carleton.ca/~paulv/papers/expiration-auth... >in sum, these security-specific observations and the results in Section 3 suggest the security benefit of password aging policies are at best partial and minor. Combining this with the well-known and widely experienced (negative) usability impact of password aging policies, and results [18] mentioned earlier on high predictability of new passwords from knowledge of old, the burden appears to shift to those who continue to support password aging policies, to explain why, and in which specific circumstances, a substantiating benefit is evident. And: https://discovery.ucl.ac.uk/id/eprint/20247/2/CACM%20FINAL.pdf https://discovery.ucl.ac.uk/id/eprint/20247/2/CACM%20FINAL.p... >Although change regimes are employed to reduce the impact of an undetected security breach, our findings suggest that they reduce the overall password security in an organization. There have been several more, and I'm sure that NIST and others did their own additional analysis prior to changing their recommendations which may not have been made public.
Beldin 3y ago
> On one hand, I have to somewhat agree with 23andMe here. If someone uses the password "password1" for some service, they should not be able to turn around and blame that service when their account is compromised. I call BS. If the service thinks the user's password is acceptable to perform authentication, how should a user know they are actually wrong about that? Either it is flawed, and therefore the service's job to catch, or it is acceptable. But the service doesn't get to say afterwards "haha, that was really dumb of you, you should have used a stronger password".
- ziddoap 3y ago
  >Either it is flawed, and therefore the service's job to catch, or it is acceptable. But the service doesn't get to say afterwards "haha, that was really dumb of you, you should have used a stronger password". You are missing the category of attack that happened here. The password was acceptable. But the users used the acceptable password on multiple websites. A different website was breached, and the password was leaked. It is not 23andMe's responsibility to check if other services are breached, cross-reference the users in that other service, get the leaked password list, and then see if those leaked passwords are currently in-use on their website on accounts that are used on both sites. However, as noted in my top-level comment, they should be checking against known-compromised passwords at password creation/change time, and disallow those.
  - richbell 3y ago
    > It is not 23andMe's responsibility to check if other services are breached, cross-reference the users in that other service, get the leaked password list, and then see if those leaked passwords are currently in-use on their website on accounts that are used on both sites. To play devil's advocate here, why not? Plenty of companies (e.g., Tumblr) specifically do this and require email verification + password change if yours was breached. It would make the world a better and more secure place if companies took proactive security measures. There is even a financial incentive for them to do so because it mitigates risk.
    - 3y ago
cm2187 3y ago
You don't even need to bug your users with those pain-in-the-ass 2FA. Just don't let them chose a password, send them a strong random one by email when they signup. If their mailbox is compromised, it is game over anyway as it allows an attacker to reset every password.
Rebelgecko 3y ago
IMO the problem is that even if you have the best most secure alphanumericpunctuated leetspeak 20 character password, your data was still compromised if your third cousin once removed had "hunter2" as their password. It's like Cambridge Analytica- each compromised account let them dump data for hundreds to thousands of people
- ziddoap 3y ago
  >your data was still compromised if your third cousin once removed had "hunter2" as their password. And you opted-in to share your DNA data. But yes, the entire business model of 23andMe makes me uncomfortable. But it's a bit removed from the password security stuff I wanted to focus on, especially as the password security stuff is applicable to any type of service.
  - Rebelgecko 3y ago
    Nowadays it's an opt-in feature. In the past, 23AndMe actually opted people into the "DNA relatives" feature by default!

deleted 3y ago

[deleted]

JohnMakin 3y ago

Where your first argument falls apart is the other several million users who had their data breached didn’t have compromised accounts. It quite literally isn’t their responsibility or problem at all.

ziddoap 3y ago
They opted-in to the sharing feature though?
- JohnMakin 3y ago
  I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
  - rciorba 3y ago
    if you choose to share data with Bob, you have to accept the consequences of Bob being sloppy with your data
  - yreg 3y ago
    Isn't that obvious? If I share a Google doc with you I'm taking the implicit risk that your account might be compromised along with my document when you e.g. forget to log out at a public computer.
  - Ekaros 3y ago
    I think it is unreasonable to blame site when you allow sharing data by certain separations. Like in social media set your friends' friends to be able to see your data. If one of these friend's friend is bad actor. Is it really on the site to prevent them seeing the data?
dpkonofa 3y ago
They shared their info with a compromised account. If you didn’t share your DNA matches with the other person, you would have nothing to worry about.
- luxuryballs 3y ago
  that’s why I only share my profiles with people who have a strong password
  - dpkonofa 3y ago
    Do you share your banking info with complete strangers? If not, why would you share your DNA with them and be surprised that they could do something stupid, foolish, or reckless?
    - crazygringo 3y ago
      > Do you share your banking info with complete strangers? I think this is why we were all so surprised when Venmo took off in popularity, with everybody's transactions made public by default...
      - dpkonofa 3y ago
        I still don't understand how so many people can have that info public. Blows my mind...
        deleted 3y ago
        [deleted]
- JohnMakin 3y ago
  I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
deleted 3y ago
[deleted]
lolinder 3y ago
When you send people secure information through any means, you are accepting that the security of that information is now equivalent to the worst level of security practices of all the people who received that information. When the recipients are a large collection of random strangers on the internet, you should assume the data is as good as public, because the average random stranger on the internet has terrible security practices (not to mention the non-zero probability that they're actively malicious). 23andMe could have done a better job communicating the risks of sharing your data with random strangers on the internet, but it's also not unreasonable for them to put some level of blame on users. If you wanted to treat that information as secure, you shouldn't have opted in to sharing it with an arbitrary number of strangers.
Rudism 3y ago
Those users signed up for a service with poor security controls (no 2FA, no requirement to rotate passwords at regular intervals) and then checked a box saying "share my data with other accounts." So while I agree with you that those users are not responsible for the accounts that were actually compromised, they were fully responsible for sharing their data on that service without fully thinking the implications through. 23andMe is not blameless--it's their poor security controls that allowed it to happen in the first place--but I strongly feel people do not take security and privacy as seriously as they should and as a result do share at least some of the blame.
- gkbrk 3y ago
  > no requirement to rotate passwords at regular intervals Password rotations are dumb and do not improve security.
  - Rudism 3y ago
    Is that true though? I agree they're annoying and in an ideal world where users don't reuse passwords or leaked hashes can't be broken they'd be pointless--but in this case I think it certainly would have protected at least some of the accounts that were reusing breached passwords. Is there actual evidence/research that proves password rotation has no effect on security in the event of breaches?
    - ziddoap 3y ago
      >Is that true though? NIST, Microsoft, etc. didn't decide to change their minds (to now explicitly discourage arbitrary expiration) out of the blue. See: https://web.archive.org/web/20180603140100/https://www.cs.unc.edu/~reiter/papers/2010/CCS.pdf https://web.archive.org/web/20180603140100/https://www.cs.un... >Using this framework, we confirm previous conjectures that the effectiveness of expiration in meeting its intended goal is weak. Also see: https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf https://people.scs.carleton.ca/~paulv/papers/expiration-auth... >in sum, these security-specific observations and the results in Section 3 suggest the security benefit of password aging policies are at best partial and minor. Combining this with the well-known and widely experienced (negative) usability impact of password aging policies, and results [18] mentioned earlier on high predictability of new passwords from knowledge of old, the burden appears to shift to those who continue to support password aging policies, to explain why, and in which specific circumstances, a substantiating benefit is evident. And: https://discovery.ucl.ac.uk/id/eprint/20247/2/CACM%20FINAL.pdf https://discovery.ucl.ac.uk/id/eprint/20247/2/CACM%20FINAL.p... >Although change regimes are employed to reduce the impact of an undetected security breach, our findings suggest that they reduce the overall password security in an organization. There have been several more, and I'm sure that NIST and others did their own additional analysis prior to changing their recommendations which may not have been made public.

Beldin 3y ago

> On one hand, I have to somewhat agree with 23andMe here. If someone uses the password "password1" for some service, they should not be able to turn around and blame that service when their account is compromised. I call BS. If the service thinks the user's password is acceptable to perform authentication, how should a user know they are actually wrong about that? Either it is flawed, and therefore the service's job to catch, or it is acceptable. But the service doesn't get to say afterwards "haha, that was really dumb of you, you should have used a stronger password".

ziddoap 3y ago
>Either it is flawed, and therefore the service's job to catch, or it is acceptable. But the service doesn't get to say afterwards "haha, that was really dumb of you, you should have used a stronger password". You are missing the category of attack that happened here. The password was acceptable. But the users used the acceptable password on multiple websites. A different website was breached, and the password was leaked. It is not 23andMe's responsibility to check if other services are breached, cross-reference the users in that other service, get the leaked password list, and then see if those leaked passwords are currently in-use on their website on accounts that are used on both sites. However, as noted in my top-level comment, they should be checking against known-compromised passwords at password creation/change time, and disallow those.
- richbell 3y ago
  > It is not 23andMe's responsibility to check if other services are breached, cross-reference the users in that other service, get the leaked password list, and then see if those leaked passwords are currently in-use on their website on accounts that are used on both sites. To play devil's advocate here, why not? Plenty of companies (e.g., Tumblr) specifically do this and require email verification + password change if yours was breached. It would make the world a better and more secure place if companies took proactive security measures. There is even a financial incentive for them to do so because it mitigates risk.
  - 3y ago

cm2187 3y ago

You don't even need to bug your users with those pain-in-the-ass 2FA. Just don't let them chose a password, send them a strong random one by email when they signup. If their mailbox is compromised, it is game over anyway as it allows an attacker to reset every password.

Rebelgecko 3y ago

IMO the problem is that even if you have the best most secure alphanumericpunctuated leetspeak 20 character password, your data was still compromised if your third cousin once removed had "hunter2" as their password. It's like Cambridge Analytica- each compromised account let them dump data for hundreds to thousands of people

ziddoap 3y ago
>your data was still compromised if your third cousin once removed had "hunter2" as their password. And you opted-in to share your DNA data. But yes, the entire business model of 23andMe makes me uncomfortable. But it's a bit removed from the password security stuff I wanted to focus on, especially as the password security stuff is applicable to any type of service.
- Rebelgecko 3y ago
  Nowadays it's an opt-in feature. In the past, 23AndMe actually opted people into the "DNA relatives" feature by default!