In security, it should be ALWAYS assumed that the users are naive and will use the least possible means for an account security, it is the responsibility of the

In security, it should be ALWAYS assumed that the users are naive and will use the least possible means for an account security, it is the responsibility of the service provider to enforce these policies, let’s see: - Did 23andMe enforced a strong password policy during the account creation with X minimum and combination of chars with complexity meter? - Did they send a periodic reminder about account security, update passwords, secret questions and the likes? - Did they enforce the 2FA? - Failed authentication attempts count? And those on top of my head, NIST, PCI and other standards have more details about those, in fact, the security level should be provided by such services should pass more than the “standards”, as once these data are leaked, you won’t be able to change it, so blaming that in the users shows the lack of accountability, glad I never trusted my DNA in any of these services.