6 ms·
23andMe is reportedly turning the blame back on its customers
- KeithAnderson57 3y ago[dead]
- badgersnake 3y agoThey’re not customers, they’re the product.
- huseyinkeles 3y agoFrom what I read, people got their credentials breached on some other websites. Hackers then somehow used those same credentials to log in to 23andMe. I see that 23andMe could’ve forced MFA, or have a better brute force protection for sure but seems like 23andMe themselves didn’t breach any passwords at least.
- sersi 3y ago> The hackers initially got access to around 14,000 accounts using previously compromised login credentials, but they then used a feature of 23andMe to gain access to almost half of the company's user base, or about 7 million accounts I mean for the 14,000 accounts accessed with compromised login credentials, yes that's logical that it's their fault. But what kind of feature would allow attackers to then get access to 7 million accounts from 14,000 compromised accounts? The article doesn't say and I can't imagine any feature that would allow that without being an egregious breach of security.
- huseyinkeles 3y agoWhen you are able to log in, you then see who are related to you as well. I believe the news sites use those inflated numbers to make it more dramatic.
- AlecSchueler 3y ago> use those inflated numbers to make it [clear how serious it actually was].
- dmurray 3y agoThey already release the 7 million people's data - to the same extent the hackers got it - to anyone who manages to upload a sufficiently similar genome. There's no additional data privacy concern in releasing it to hackers or Equifax or the FBI or 4chan or the Washington Post. 23andMe limit access to it for commercial reasons, not privacy ones.
- wrasee 3y agoBut you only have one genome, so you will only ever see a very small subset of that 7 million (I’m assuming that’s how it works, I’ve never used the service). Now you have access to 7 million records at the same time, which is much more powerful in terms of what you can do with that data.
- dmurray 3y agoMore powerful, but mostly you can do good things, like genealogical research, not bad things, like identity fraud or credit card theft (which you could do if you compromised the 7 million accounts individually). It's better for the world that that kind of aggregate data is public where anyone can use it, rather than exploited by 23andMe or sold only through data brokers.
- sersi 3y agoAh, but then it's not like you get all of the data, just the names that are often fake anyway no? I mean I don't know anyone who used 23 and me under their real name.
- Aachen 3y agoIf someone registers on my website with the same password as in LinkedIn, then LinkedIn gets hacked overmorrow, and the attacker then logs in with the correct password on my website, what should I have done to prevent that successful login to this user's account? We can get angry and make jokes about 23&Me but I don't know what people would expect of me here; what solution I ought to implement as someone who runs several websites as hobby projects This problem is also one of the reasons why I'd not recommend doing such a DNA test with a web service... Edit: could I know why a moderator pinned this comment to the bottom? It got votes and was at the top for a few minutes, but now sorts below literally every other comment, also greyed-out ones and downvotes are starting to appear (maybe by association because it's at the bottom?). What should I have written differently to not get moderated away?
- op00to 3y agoForced 2 factor authentication for critical biometric data.
- fallingknife 3y agoHow critical is this data, really? What could an attacker really do with my genetic profile?
- nirav72 3y agoThe genetic data could be sold to a third-party that exists outside of any regulations. 23andme allows download of raw data. So its not just genetic profile.
- prepend 3y agoAssume everyone breached now has their dna linked forever with their marketing data graph. It will be sold and resold so eventually your TikTok feed will be influenced by your genes.
- fallingknife 3y ago
- ManBeardPc 3y agoYou could kind of argue that users that reuse passwords are responsible for leaking their own information. But how do they explain the remaining 7 million? Also they are suddenly able to enforce changing passwords and 2FA, so how do they want to claim they reasonably protected sensitive data before? If the 7 million users made their data public to other users that may explain a little bit, but I would assume the company would say so.
- Aachen 3y ago> how do they explain the remaining 7 million? It's not a bug, it's a feature! This person used it and shared the message they got from 23&M: https://news.ycombinator.com/item?id=39116561 https://news.ycombinator.com/item?id=39116561 Basically the find relatives "feature" let them expand the information base from 14k actually-compromised accounts to viewing some level of data on all their distant relatives
- cowsandmilk 3y agoThe 7 million made their data available to DNA relatives and were DNA relatives of the accounts with compromised passwords. This is similar to saying your Facebook account was hacked when one of your friends had their account compromised and the hacker had access to the information you share with friends.
- masto 3y agoI do not reuse passwords, and from what I understand, my account was not accessed directly. The message they sent me was: "After further review, we have identified your DNA Relatives profile as one that was impacted in this incident. Specifically, there was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor." So there's nothing I could have done with password security that would have prevented this; my only mistake was using a feature of their site.
- Culonavirus 3y agoTurns out that people who were saying that these kinds of services are going to give access to Government actors, sell their databases or just have them hacked/stolen by malicious actors because of garbage security were, in fact, correct. Color me not surprised.
- poszlem 3y agoI will color you cynical instead.
- Loughla 3y agoIs it still cynicism if it's accurate?
- timnetworks 3y agoIt is if the future is stupid.
- tomrod 3y agoI have bad news for you...
- ilovetux 3y agoAcuracy does not factor into whether a statement is cynicism.
- _heimdall 3y ago"The hackers initially got access to around 14,000 accounts using previously compromised login credentials, but they then used a feature of 23andMe to gain access to almost half of the company's user base, or about 7 million accounts, the company previously told Business Insider." Okay, so first off no software team would be surprised to know that you have millions or tens of millions of customers and as many as 14k reused logins from elsewhere. Second, if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base you've made a terrible, terrible decision when adding features that allowed that. Reused username/password pairs is a known challenge, and we should all be aware that our software will be used with compromised logins. Plan for that and don't assume that anyone with a login is both allowed in the door and not there for malicious reasons.
- Aachen 3y ago> if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base The article implies that (probably for sensation), but I don't think this is what it means. I assume they got enough matches between these 14k customers to view some level of information on their relatives such as their name. Genetics being what they are (pretty stable between generations), that resulted in a ton of data being shown cumulatively But that's just my reading, per my understanding of 23&M's business model. Maybe they did find a vulnerability that allowed actual account access, but that would be bigger news by itself and the article would be exceedingly likely to mention that explicitly Edit: this other top-level comment seems to confirm that https://news.ycombinator.com/item?id=39116561 https://news.ycombinator.com/item?id=39116561
- deleted 3y ago[deleted]
- jefftk 3y ago> if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base If someone gets access to my facebook account they can read anything my "friends" have marked as "friends-only". Lots of users want that kind of restricted sharing (both with Facebook and with 23andMe).
- that_guy_iain 3y agoI think with how 23andMe is reacting they know they're about to get spanked in a class action.
- tiahura 3y agoThanks for letting us know that you’re that guy who doesn’t read the article.
- that_guy_iain 3y agoWait does the article tell us they're not going to get spanked in a class action? No, it doesn't. Thanks for letting us know you're the guy who tries to be a smart-arse but fails.
- tcgv 3y agoTwo factor authentication should be mandatory for services like 23andMe that hold such sensitive information (i.e. DNA tests). It would at least have reduced the wideness of the attack by protecting most of those 14k initial accounts that were used to leverage the 'relatives feature' vulnerability.
- James_K 3y agoI was thinking this as well, but I'm still not sure 23andMe is to blame. Everyone who signed up to the site knowingly shared their information with accounts that were not 2FA protected. The service was unsafe but the question is weather or not the users should have known that. You can't sue the knife company if you cut yourself, after all.
- NikolaNovak 3y agoI have a genuine question: If somebody accesses a Facebook account; and uses it to view intentionally-shared information on 500 people connected to that person; is that Facebook's fault for having that feature? It appears Hacker News consensus is "Yes", but... that feature IS Facebook; and to many many people, that feature IS "23andme". Don't get me wrong - I don't have 23andme account; we are at an early age of DNA analysis and I'm supremely uncomfortable randomly giving my DNA and wide permissions to strangers for perpetuity. I've tried to give same perspective to friends and family, with limited success. I also don't particularly care about geneaology either, yet goodness gracious a lot of people really really do and they get giddy and excited when they find some 'match' on DNA sites :). But it does rather seem that external actors used credentials obtained elsewhere, to access a core "social-network-like" feature of 23andme, that users eagerly opted in (again, I wouldn't have, but I'm a weirdo:). I don't understand what 23andme's real fault is, other than existing, and allowing users to willingly, consensually, in an informed manner do what they specifically chose to do. We all told our friends & family "hey don't share your DNA results and intimate details of your life with strangers and random new startups", but they repeatedly choose to do so anyway :(.
- dzolob 3y agoIf you can be massively scraped while holding very sensitive data, you have a problem.
- arcbyte 3y agoYou are correct. Human nature seems to be to find a scapegoat. Holding 14,000 anonymous people culpable history doesn't feel as good as complaining about a single, visible entity - even an innocent one.
- itsnotafight 3y agoMy reading suggests that this is the correct interpretation. And I think it actually crystallizes in the question of whether such services should be allowed to exist. To me it’s hard to argue that we should prevent people from creating and consensually engaging in these large-scale social platforms from an individual liberty perspective. However in aggregate they have so much power to disrupt people’s lives. How do you balance these issues? If 23andMe is in the wrong here it seems to be because this entire approach of large scale social networks is wrong, and we must solve it at a regulatory level.
- avsteele 3y agoThe article is terrible. What are commenters even discussing without having additional context? The hackers initially got access to around 14,000 accounts using previously compromised login credentials, but they then used a feature of 23andMe to gain access to almost half of the company's user base, or about 7 million accounts, the company previously told Business Insider. This is the only actual 'information' in the article. The rest is just finger pointing. But what does this mean? What feature? Does 'gain access' here mean all the data you would have as if you logged in as that user? How does 14K become 7M? Is it that case that an average user has access to the data of 500 other users on website? (7M/14K)
- padjo 3y agoBusiness insider is a trash publication. I wouldn’t waste my time reading it. Their content is always some combination of over stated, inaccurate or flat out made up.
- whiddershins 3y agoTrue, and that 500 number is way too low because that calculation imagines there is zero overlap/duplication.
- lefixx 3y agoSounds like the hackers used recycled logins to gain access to 14000 accounts and then for each account gained info about other related accounts. I can see how you can get 14000 compromised accounts even though it sounds too much to me. Cant see how you can get info to so many related accounts. a 1 to 500 ratio. But if it is true then there is a little blame for the costumers too.
- tzs 3y ago> What feature? If you opt in to finding DNA relatives then you essentially get a list of all your DNA relatives on 23andMe that have also opted in. DNA relative seems to be people who are 4th cousins or closer to you. For each you get a name and an approximate location. > Does 'gain access' here mean all the data you would have as if you logged in as that user? Yes. > How does 14K become 7M? Is it that case that an average user has access to the data of 500 other users on website? (7M/14K) Data point: I have opted in. My DNA relatives list has just over 1500 other people on it.
- ta8645 3y agoThis doesn't just affect 23andMe's customers. It affects every person who shares DNA with their customers. For instance, police have been able to match DNA samples of an unknown perpetrator against these DNA services. Matches against their extended family (who have used the service) is enough to identify them, even though they've never been a customer. And while that's a good thing, the more general case is true for every one of us all. We're all represented in this DNA data to one degree or another, even if we've never used the service.
- jefftk 3y agoIt sounds like you're under the impression that the data that was leaked for half the customer base was people's full genotype? Because the kind of matching that you're talking about here isn't possible on the coarse data that the attackers were able to leverage compromised accounts to access.
- erikson 3y agoSame pr agency as you know who
- shadowgovt 3y ago> One 23andMe customer impacted by the breach told TechCrunch that it's "appalling that 23andMe is attempting to hide from consequences instead of helping its customers." I mean... Of course they ate trying to dodge extra punishment from California while trying to help customers. They can be doing both at the same time. And as a legal argument, they may have a point. How precisely are they supposed to secure their architecture against recycled login credentials? Does California's law imply that you have to implement two-factor authentication? Seems like it would be a novel application of the law if that's the case.
- deleted 3y ago[deleted]
- dzolob 3y agoThis “it’s their fault for sharing information” is a terrible externality/unaccountability argument. As a company, you are responsible for the safety and privacy of all your direct and indirect users. I don’t have a facebook, but I’m in there for sure, and it’s the company’s responsibility to protect my privacy. I know this is not 23&me’s case, and sure, the front door keys weren’t stolen from them, but they allowed the whole museum to be robbed without triggering one alarm. If a bad actor gained access to my account, he/she would still need my device to deobfuscate card info or make transactions. I mean, it’s a solved problem!
- deleted 3y ago[deleted]
- bookofjoe 3y agoThis is a canary in a coal mine. At some point in the future — in our lifetimes — every newborn will have DNA taken and tested — and banked permanently. You say "No way, over my dead body?" >Kuwait: New Counterterror Law Sets Mandatory DNA Testing (2015) https://www.hrw.org/news/2015/07/21/kuwait-new-counterterror-law-sets-mandatory-dna-testing https://www.hrw.org/news/2015/07/21/kuwait-new-counterterror... >Kuwait: Court Strikes Down Draconian DNA Law (2017) https://www.hrw.org/news/2017/10/17/kuwait-court-strikes-down-draconian-dna-law#:~:text=Kuwait%20was%20the%20only%20country,to%20personal%20liberty%20and%20privacy https://www.hrw.org/news/2017/10/17/kuwait-court-strikes-dow.... In the US, a blood sample is taken from all newborns to test for a panel of diseases that are treatable and cause serious problems if not treated within a few days after birth. The sample is not taken by federal authorities, but by medical staff, usually before the infant goes home from the hospital. The individual states, rather than the Federal government, mandate the testing. The sample consists of a piece of paper with a few or several spots saturated with drops of blood. After testing, the samples are stored for a period of time determined by each individual state. In states where the samples are kept on file for an extended period, those blood spots could be considered a DNA sample.
- sschueller 3y agoLet's not pretend that 23andMe didn't voluntarily give access to the data to law enforcement and wanted to sell it as well to insurance companies.
- merricksb 3y agoSource article on Techcrunch discussed here 3 weeks ago: https://news.ycombinator.com/item?id=38856412 https://news.ycombinator.com/item?id=38856412 (261 points/20 days ago/371 comments)
- insickness 3y agoWhile 23andMe may not be culpable, they certainly look culpable, particularly to the layman. Their messaging in response to this is terrible.
- kseifried 3y agoWe covered this on the open source podcast last week. https://opensourcesecurity.io/2024/01/21/episode-412-blame-the-users-for-bad-passwords/ https://opensourcesecurity.io/2024/01/21/episode-412-blame-t... TLDR there is a LOT 23andme could’ve done to prevent this. Around the same time BrickLink had a similar incident, but handled it perfectly. There is a lot that these vendors can do to protect people, even if their password and username are exposed. Things like requiring email confirmation if you’re logging in from a new IP address. Things like using the haveibeenpwned database to ensure people use good passwords. When I reset my password at 23 and it allowed me to use passwords like Password1234567. 23andme continues to disappoint.