4 ms·

> Nothing on 23andme’s end failed unless you consider someone using a correct user/pass combo while not being the owner as a fail on the part of 23andMe rather

> Nothing on 23andme’s end failed unless you consider someone using a correct user/pass combo while not being the owner as a fail on the part of 23andMe rather than the end user. This seems to be the big societal discussion, in the same way that people blame banks for them sending money to crypto and romance scammers overseas.

dpkonofa 3y ago
That is a great analogy.
2devnull 3y ago
Or the way people blame bars for stuff when it’s the drunken fools who go to bars and drink too much that are the actual problem.
ribosometronome 3y ago
Your analogy is unfair. There's not really any evidence any of the users were using the platform in any way other than intended. I think this would be far more akin to finding out someone has stolen a card number, which has happened in breaches, and used it to purchase a lot. Generally, we do expect recourse on the bank's end.
- dpkonofa 3y ago
  It's not unfair. The data that was exfiltrated is data that was accessible to the users. If someone gives their routing number and checking number to a scammer, that is also considered "using the platform in any way other than intended". In 99% of cases, you'd be providing that information to someone you had an actual business relationship with. My employer, for example, might have that info in order to process my direct deposit payments. A debtor may have that info in order to process ACH payments. Giving that info to a total stranger would be an issue but that wouldn't be the bank's fault. Neither would it be the bank's fault if you chose a poor or reused password. That's what happened here. Users shared data with total strangers who requested their connection to their DNA data based on some percentage of shared DNA. Users accepted those requests. The users who reused their passwords had all their info accessible. The users who accepted sharing requests with those users had their shared info accessible. Both cases are "using the platform as intended".

dpkonofa 3y ago

That is a great analogy.

2devnull 3y ago

Or the way people blame bars for stuff when it’s the drunken fools who go to bars and drink too much that are the actual problem.

ribosometronome 3y ago

Your analogy is unfair. There's not really any evidence any of the users were using the platform in any way other than intended. I think this would be far more akin to finding out someone has stolen a card number, which has happened in breaches, and used it to purchase a lot. Generally, we do expect recourse on the bank's end.

dpkonofa 3y ago
It's not unfair. The data that was exfiltrated is data that was accessible to the users. If someone gives their routing number and checking number to a scammer, that is also considered "using the platform in any way other than intended". In 99% of cases, you'd be providing that information to someone you had an actual business relationship with. My employer, for example, might have that info in order to process my direct deposit payments. A debtor may have that info in order to process ACH payments. Giving that info to a total stranger would be an issue but that wouldn't be the bank's fault. Neither would it be the bank's fault if you chose a poor or reused password. That's what happened here. Users shared data with total strangers who requested their connection to their DNA data based on some percentage of shared DNA. Users accepted those requests. The users who reused their passwords had all their info accessible. The users who accepted sharing requests with those users had their shared info accessible. Both cases are "using the platform as intended".