4 ms·

I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing

I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?

dpkonofa 3y ago
Because the breach wasn’t on 23andMe. It was on another site. The only way you’d be affected by this is if you used the same password on multiple sites (where one of those sites actually had a breach) or if you shared your DNA profile (since it is opt-in) with someone that reused passwords. In the latter case, only the info you shared with that person would be accessible to someone using a compromised account. In other words, if you shared your info with someone you didn’t know and didn’t trust, your info can be used by bad actors.
tomjakubowski 3y ago
Really? Seems analogous to sharing, I dunno, a private Google sheet with somebody. If my friend's Google account is compromised, because they reused a password lost on another site, I wouldn't blame Google for the attacker being able to read the sheet. I shared it with my friend knowing that might happen.
0xffff2 3y ago
Of course it means exactly that. If you opt in to a feature that shares your data with other users, you're explicitly opting in to the risk that those users will steal/leak/share your data with a third party, either intentionally or through their own negligence. If 23andMe had made any claim that they took steps to force users to secure their accounts properly or that they implemented measures to prevent data exfiltration then perhaps you could argue that you should have been able to rely on those claims, but as far as I can tell 23andMe made no such claims.
kbenson 3y ago
Not the GP but that's clearly the case IMO. If I share my tax records with my accountant and their office is broken into because they left the office key sonewhere, do I blame the office building or the accountant? We can argue about whether the office building should have had better security and noticed weird people around, but ultimately it's the accountant's negligence that allowed my info to be compromised, and if I suspected they weren't the best with their security, I should have factored that into who I decided to share my info with.
JohnMakin 3y ago
Not gonna bother responding to the turfer comments in this thread but they're roughly analogous to saying "because you use facebook it is therefore your fault when facebook leaks your data because you voluntarily shared that data with facebook." Legally, logically, and ethically this is an absurd argument on its face.
- dpkonofa 3y ago
  To borrow your analogy, though, Facebook (23andMe) didn’t leak anyone’s data. That’s the issue with your position. Also, the turfer comment makes you seem like a conspiracy theorist. There’s nothing untoward or off about the replies you’ve received so far that is off enough to suggest astroturfing.
  - JohnMakin 3y ago
    Who did then? It happened on their site, they had the means to control/monitor/mitigate it. Are you saying then that if someone hacks into facebook, steals data, it is then not facebook's responsibility that that happened because they didn't publish the data? Even the backwards cybersecurity laws in the US don't work that way.
    - dpkonofa 3y ago
      I think you’re misunderstanding what happened in this situation. Nothing was stolen from 23andMe and no 23andMe accounts were “hacked into”. The “hack” happened on another site and the hacker got a database leak of usernames and passwords for that site (not 23andMe). Some of the users of that site used the exact same email addresses and passwords for their 23andMe accounts. If you use “Hunter2” as a password for all of your accounts and AOL gets hacked, the hackers know your password is “Hunter2”. If they get into your Facebook or Gmail account because you also used “Hunter2” there, that is neither Facebook’s or Gmail’s fault. It is your own fault.
      - JohnMakin 3y ago
        So now we're playing a semantics game about what the word "hack" refers to in this context? users gained unauthorized access to 23andMe and used that access to get access to data, and 23andMe had full control of mitigating, monitoring, and preventing this type of attack. Is that better? Doesn't really change my salient point at all. In your example the site is fully capable of preventing weak passwords or enforcing things like MFA that make this type of attack a lot less effective. It may surprise you to know that most websites already do this!

dpkonofa 3y ago

Because the breach wasn’t on 23andMe. It was on another site. The only way you’d be affected by this is if you used the same password on multiple sites (where one of those sites actually had a breach) or if you shared your DNA profile (since it is opt-in) with someone that reused passwords. In the latter case, only the info you shared with that person would be accessible to someone using a compromised account. In other words, if you shared your info with someone you didn’t know and didn’t trust, your info can be used by bad actors.

tomjakubowski 3y ago

Really? Seems analogous to sharing, I dunno, a private Google sheet with somebody. If my friend's Google account is compromised, because they reused a password lost on another site, I wouldn't blame Google for the attacker being able to read the sheet. I shared it with my friend knowing that might happen.

0xffff2 3y ago

Of course it means exactly that. If you opt in to a feature that shares your data with other users, you're explicitly opting in to the risk that those users will steal/leak/share your data with a third party, either intentionally or through their own negligence. If 23andMe had made any claim that they took steps to force users to secure their accounts properly or that they implemented measures to prevent data exfiltration then perhaps you could argue that you should have been able to rely on those claims, but as far as I can tell 23andMe made no such claims.

kbenson 3y ago

Not the GP but that's clearly the case IMO. If I share my tax records with my accountant and their office is broken into because they left the office key sonewhere, do I blame the office building or the accountant? We can argue about whether the office building should have had better security and noticed weird people around, but ultimately it's the accountant's negligence that allowed my info to be compromised, and if I suspected they weren't the best with their security, I should have factored that into who I decided to share my info with.

JohnMakin 3y ago

Not gonna bother responding to the turfer comments in this thread but they're roughly analogous to saying "because you use facebook it is therefore your fault when facebook leaks your data because you voluntarily shared that data with facebook." Legally, logically, and ethically this is an absurd argument on its face.

dpkonofa 3y ago
To borrow your analogy, though, Facebook (23andMe) didn’t leak anyone’s data. That’s the issue with your position. Also, the turfer comment makes you seem like a conspiracy theorist. There’s nothing untoward or off about the replies you’ve received so far that is off enough to suggest astroturfing.
- JohnMakin 3y ago
  Who did then? It happened on their site, they had the means to control/monitor/mitigate it. Are you saying then that if someone hacks into facebook, steals data, it is then not facebook's responsibility that that happened because they didn't publish the data? Even the backwards cybersecurity laws in the US don't work that way.
  - dpkonofa 3y ago
    I think you’re misunderstanding what happened in this situation. Nothing was stolen from 23andMe and no 23andMe accounts were “hacked into”. The “hack” happened on another site and the hacker got a database leak of usernames and passwords for that site (not 23andMe). Some of the users of that site used the exact same email addresses and passwords for their 23andMe accounts. If you use “Hunter2” as a password for all of your accounts and AOL gets hacked, the hackers know your password is “Hunter2”. If they get into your Facebook or Gmail account because you also used “Hunter2” there, that is neither Facebook’s or Gmail’s fault. It is your own fault.
    - JohnMakin 3y ago
      So now we're playing a semantics game about what the word "hack" refers to in this context? users gained unauthorized access to 23andMe and used that access to get access to data, and 23andMe had full control of mitigating, monitoring, and preventing this type of attack. Is that better? Doesn't really change my salient point at all. In your example the site is fully capable of preventing weak passwords or enforcing things like MFA that make this type of attack a lot less effective. It may surprise you to know that most websites already do this!