4 ms·

Where your first argument falls apart is the other several million users who had their data breached didn’t have compromised accounts. It quite literally isn’t

Where your first argument falls apart is the other several million users who had their data breached didn’t have compromised accounts. It quite literally isn’t their responsibility or problem at all.

ziddoap 3y ago
They opted-in to the sharing feature though?
- JohnMakin 3y ago
  I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
  - rciorba 3y ago
    if you choose to share data with Bob, you have to accept the consequences of Bob being sloppy with your data
  - yreg 3y ago
    Isn't that obvious? If I share a Google doc with you I'm taking the implicit risk that your account might be compromised along with my document when you e.g. forget to log out at a public computer.
  - Ekaros 3y ago
    I think it is unreasonable to blame site when you allow sharing data by certain separations. Like in social media set your friends' friends to be able to see your data. If one of these friend's friend is bad actor. Is it really on the site to prevent them seeing the data?
dpkonofa 3y ago
They shared their info with a compromised account. If you didn’t share your DNA matches with the other person, you would have nothing to worry about.
- luxuryballs 3y ago
  that’s why I only share my profiles with people who have a strong password
  - dpkonofa 3y ago
    Do you share your banking info with complete strangers? If not, why would you share your DNA with them and be surprised that they could do something stupid, foolish, or reckless?
    - crazygringo 3y ago
      > Do you share your banking info with complete strangers? I think this is why we were all so surprised when Venmo took off in popularity, with everybody's transactions made public by default...
      - dpkonofa 3y ago
        I still don't understand how so many people can have that info public. Blows my mind...
        deleted 3y ago
        [deleted]
- JohnMakin 3y ago
  I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
deleted 3y ago
[deleted]
lolinder 3y ago
When you send people secure information through any means, you are accepting that the security of that information is now equivalent to the worst level of security practices of all the people who received that information. When the recipients are a large collection of random strangers on the internet, you should assume the data is as good as public, because the average random stranger on the internet has terrible security practices (not to mention the non-zero probability that they're actively malicious). 23andMe could have done a better job communicating the risks of sharing your data with random strangers on the internet, but it's also not unreasonable for them to put some level of blame on users. If you wanted to treat that information as secure, you shouldn't have opted in to sharing it with an arbitrary number of strangers.
Rudism 3y ago
Those users signed up for a service with poor security controls (no 2FA, no requirement to rotate passwords at regular intervals) and then checked a box saying "share my data with other accounts." So while I agree with you that those users are not responsible for the accounts that were actually compromised, they were fully responsible for sharing their data on that service without fully thinking the implications through. 23andMe is not blameless--it's their poor security controls that allowed it to happen in the first place--but I strongly feel people do not take security and privacy as seriously as they should and as a result do share at least some of the blame.
- gkbrk 3y ago
  > no requirement to rotate passwords at regular intervals Password rotations are dumb and do not improve security.
  - Rudism 3y ago
    Is that true though? I agree they're annoying and in an ideal world where users don't reuse passwords or leaked hashes can't be broken they'd be pointless--but in this case I think it certainly would have protected at least some of the accounts that were reusing breached passwords. Is there actual evidence/research that proves password rotation has no effect on security in the event of breaches?
    - ziddoap 3y ago
      >Is that true though? NIST, Microsoft, etc. didn't decide to change their minds (to now explicitly discourage arbitrary expiration) out of the blue. See: https://web.archive.org/web/20180603140100/https://www.cs.unc.edu/~reiter/papers/2010/CCS.pdf https://web.archive.org/web/20180603140100/https://www.cs.un... >Using this framework, we confirm previous conjectures that the effectiveness of expiration in meeting its intended goal is weak. Also see: https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf https://people.scs.carleton.ca/~paulv/papers/expiration-auth... >in sum, these security-specific observations and the results in Section 3 suggest the security benefit of password aging policies are at best partial and minor. Combining this with the well-known and widely experienced (negative) usability impact of password aging policies, and results [18] mentioned earlier on high predictability of new passwords from knowledge of old, the burden appears to shift to those who continue to support password aging policies, to explain why, and in which specific circumstances, a substantiating benefit is evident. And: https://discovery.ucl.ac.uk/id/eprint/20247/2/CACM%20FINAL.pdf https://discovery.ucl.ac.uk/id/eprint/20247/2/CACM%20FINAL.p... >Although change regimes are employed to reduce the impact of an undetected security breach, our findings suggest that they reduce the overall password security in an organization. There have been several more, and I'm sure that NIST and others did their own additional analysis prior to changing their recommendations which may not have been made public.

ziddoap 3y ago

They opted-in to the sharing feature though?

JohnMakin 3y ago
I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
- rciorba 3y ago
  if you choose to share data with Bob, you have to accept the consequences of Bob being sloppy with your data
- yreg 3y ago
  Isn't that obvious? If I share a Google doc with you I'm taking the implicit risk that your account might be compromised along with my document when you e.g. forget to log out at a public computer.
- Ekaros 3y ago
  I think it is unreasonable to blame site when you allow sharing data by certain separations. Like in social media set your friends' friends to be able to see your data. If one of these friend's friend is bad actor. Is it really on the site to prevent them seeing the data?

dpkonofa 3y ago

They shared their info with a compromised account. If you didn’t share your DNA matches with the other person, you would have nothing to worry about.

luxuryballs 3y ago
that’s why I only share my profiles with people who have a strong password
- dpkonofa 3y ago
  Do you share your banking info with complete strangers? If not, why would you share your DNA with them and be surprised that they could do something stupid, foolish, or reckless?
  - crazygringo 3y ago
    > Do you share your banking info with complete strangers? I think this is why we were all so surprised when Venmo took off in popularity, with everybody's transactions made public by default...
    - dpkonofa 3y ago
      I still don't understand how so many people can have that info public. Blows my mind...
      - deleted 3y ago
        [deleted]
JohnMakin 3y ago
I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?

deleted 3y ago

[deleted]

lolinder 3y ago

When you send people secure information through any means, you are accepting that the security of that information is now equivalent to the worst level of security practices of all the people who received that information. When the recipients are a large collection of random strangers on the internet, you should assume the data is as good as public, because the average random stranger on the internet has terrible security practices (not to mention the non-zero probability that they're actively malicious). 23andMe could have done a better job communicating the risks of sharing your data with random strangers on the internet, but it's also not unreasonable for them to put some level of blame on users. If you wanted to treat that information as secure, you shouldn't have opted in to sharing it with an arbitrary number of strangers.

Rudism 3y ago

Those users signed up for a service with poor security controls (no 2FA, no requirement to rotate passwords at regular intervals) and then checked a box saying "share my data with other accounts." So while I agree with you that those users are not responsible for the accounts that were actually compromised, they were fully responsible for sharing their data on that service without fully thinking the implications through. 23andMe is not blameless--it's their poor security controls that allowed it to happen in the first place--but I strongly feel people do not take security and privacy as seriously as they should and as a result do share at least some of the blame.

gkbrk 3y ago
> no requirement to rotate passwords at regular intervals Password rotations are dumb and do not improve security.
- Rudism 3y ago
  Is that true though? I agree they're annoying and in an ideal world where users don't reuse passwords or leaked hashes can't be broken they'd be pointless--but in this case I think it certainly would have protected at least some of the accounts that were reusing breached passwords. Is there actual evidence/research that proves password rotation has no effect on security in the event of breaches?
  - ziddoap 3y ago
    >Is that true though? NIST, Microsoft, etc. didn't decide to change their minds (to now explicitly discourage arbitrary expiration) out of the blue. See: https://web.archive.org/web/20180603140100/https://www.cs.unc.edu/~reiter/papers/2010/CCS.pdf https://web.archive.org/web/20180603140100/https://www.cs.un... >Using this framework, we confirm previous conjectures that the effectiveness of expiration in meeting its intended goal is weak. Also see: https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf https://people.scs.carleton.ca/~paulv/papers/expiration-auth... >in sum, these security-specific observations and the results in Section 3 suggest the security benefit of password aging policies are at best partial and minor. Combining this with the well-known and widely experienced (negative) usability impact of password aging policies, and results [18] mentioned earlier on high predictability of new passwords from knowledge of old, the burden appears to shift to those who continue to support password aging policies, to explain why, and in which specific circumstances, a substantiating benefit is evident. And: https://discovery.ucl.ac.uk/id/eprint/20247/2/CACM%20FINAL.pdf https://discovery.ucl.ac.uk/id/eprint/20247/2/CACM%20FINAL.p... >Although change regimes are employed to reduce the impact of an undetected security breach, our findings suggest that they reduce the overall password security in an organization. There have been several more, and I'm sure that NIST and others did their own additional analysis prior to changing their recommendations which may not have been made public.