5 ms·

> The firm claimed complainants had “negligently recycled” login credentials from other exposed accounts and that poor cyber hygiene practices were to blame for

> The firm claimed complainants had “negligently recycled” login credentials from other exposed accounts and that poor cyber hygiene practices were to blame for their exposure during the breach. I mean. If people reused passwords for 23andMe, is this really 23andMe's fault? Should they have required 2FA for everything? That's kind of a hard sell tbh.

lambdaba 3y ago
I agree with this. Frankly, if something is to blame, it's user agents / browsers that should be much better at educating and alerting about password reuse.
titzer 3y ago
> during the breach. Absurd that they thought that we'd miss this part of the sentence.
CodeWriter23 3y ago
Wrong question. Correct question: how does 23andMe know any customer used "password123" as a password?
- transcriptase 3y ago
  Probably cross referenced their compromised customer account emails with a pastebin of email:pass pairs leaked from another hack.
- lambdaba 3y ago
  I think one fair criticism is they could have had intrusion detection trigger when, presumably, the same IP address was logging in to thousands of accounts. But who knows how sophisticated the attack was? [edit]: there are other obvious heuristics that could have detected it, it does show they had either very basic or no intrusion detection, which, for a service of this nature, isn't really acceptable
  - deleted 3y ago
    [deleted]
- bqmjjx0kac 3y ago
  I don't think this is a smoking gun. Assuming competence, they could have obtained a password dump from another site that stored cleartext passwords, then compared their own database rows with hash(salt(leaked_password)).
- ahahahahah 3y ago
  It's easy and could be just how other companies with great security practices (like google) can tell you when they find your password in a password dump. Imagine you are a company with great password practices, how would you tell that a user re-used a password that was exposed in some other data breach without you being able to generally know what a user's password is? Well, of course, it's the same way that you verify their password when they login. You track (or more likely in this case, adhoc check) data breaches, when you find a matched email in the breach with one of your users, you check if the password from the breach would allow that user to login.
paxys 3y ago
> Should they have required 2FA for everything? If an average online gaming service or social network can manage sending 2FA codes over email or SMS when their users are logging in from a new device, the holder of a large chunk of the world's genetic data can as well.
- intrasight 3y ago
  Have they now fixed that?
maxrecursion 3y ago
So, to play devil's advocate, 23andMe shouldn't allow credential stuffing to happen by rate limiting logins after so many failed logins, or locking accounts after failed logins. They could've blocked source IPs making all the login requests, but that was probably being changed to not set off alarms. However, there wasn't enough information in the article to go on, but since they suffered so many breaches of user accounts, they probably had to do something wrong. I'm too busy to dig into the specifics.
- RajT88 3y ago
  Not just rate limiting logins, but rate limiting queries against their user base (10k logins compromised, and data on ~6 million people scraped). Additionally, they don't support 2FA/MFA which of course would mitigate some of the risk of password re-use. There's plenty of things they could have done to prevent this breach.
- adrianmonk 3y ago
  Continuing devil's advocate, we don't know that they didn't do those things. Maybe they did and that's why it's only 14,000. If an attacker works off lists of compromised usernames and passwords from various sites, for a given user there's always a chance that the first one they try is correct. Especially for the kind of user who recycles the exact same password on 50 different sites. (Incidentally, you should probably try to hack that kind of user first, and for each user, try their most-recycled passwords first.)
rootusrootus 3y ago
> If people reused passwords for 23andMe, is this really 23andMe's fault? Yes absolutely. If it were one account being compromised due to the user reusing a password, that would be the user's fault. But what happened is credential stuffing, and that is absolutely something a professional IT organization should be prepared to defend against.

lambdaba 3y ago

I agree with this. Frankly, if something is to blame, it's user agents / browsers that should be much better at educating and alerting about password reuse.

titzer 3y ago

> during the breach. Absurd that they thought that we'd miss this part of the sentence.

CodeWriter23 3y ago

Wrong question. Correct question: how does 23andMe know any customer used "password123" as a password?

transcriptase 3y ago
Probably cross referenced their compromised customer account emails with a pastebin of email:pass pairs leaked from another hack.
lambdaba 3y ago
I think one fair criticism is they could have had intrusion detection trigger when, presumably, the same IP address was logging in to thousands of accounts. But who knows how sophisticated the attack was? [edit]: there are other obvious heuristics that could have detected it, it does show they had either very basic or no intrusion detection, which, for a service of this nature, isn't really acceptable
- deleted 3y ago
  [deleted]
bqmjjx0kac 3y ago
I don't think this is a smoking gun. Assuming competence, they could have obtained a password dump from another site that stored cleartext passwords, then compared their own database rows with hash(salt(leaked_password)).
ahahahahah 3y ago
It's easy and could be just how other companies with great security practices (like google) can tell you when they find your password in a password dump. Imagine you are a company with great password practices, how would you tell that a user re-used a password that was exposed in some other data breach without you being able to generally know what a user's password is? Well, of course, it's the same way that you verify their password when they login. You track (or more likely in this case, adhoc check) data breaches, when you find a matched email in the breach with one of your users, you check if the password from the breach would allow that user to login.

paxys 3y ago

> Should they have required 2FA for everything? If an average online gaming service or social network can manage sending 2FA codes over email or SMS when their users are logging in from a new device, the holder of a large chunk of the world's genetic data can as well.

intrasight 3y ago
Have they now fixed that?

maxrecursion 3y ago

So, to play devil's advocate, 23andMe shouldn't allow credential stuffing to happen by rate limiting logins after so many failed logins, or locking accounts after failed logins. They could've blocked source IPs making all the login requests, but that was probably being changed to not set off alarms. However, there wasn't enough information in the article to go on, but since they suffered so many breaches of user accounts, they probably had to do something wrong. I'm too busy to dig into the specifics.

RajT88 3y ago
Not just rate limiting logins, but rate limiting queries against their user base (10k logins compromised, and data on ~6 million people scraped). Additionally, they don't support 2FA/MFA which of course would mitigate some of the risk of password re-use. There's plenty of things they could have done to prevent this breach.
adrianmonk 3y ago
Continuing devil's advocate, we don't know that they didn't do those things. Maybe they did and that's why it's only 14,000. If an attacker works off lists of compromised usernames and passwords from various sites, for a given user there's always a chance that the first one they try is correct. Especially for the kind of user who recycles the exact same password on 50 different sites. (Incidentally, you should probably try to hack that kind of user first, and for each user, try their most-recycled passwords first.)

rootusrootus 3y ago

> If people reused passwords for 23andMe, is this really 23andMe's fault? Yes absolutely. If it were one account being compromised due to the user reusing a password, that would be the user's fault. But what happened is credential stuffing, and that is absolutely something a professional IT organization should be prepared to defend against.