4 ms·

If someone registers on my website with the same password as in LinkedIn, then LinkedIn gets hacked overmorrow, and the attacker then logs in with the correct p

• op00to 3y ago
  Forced 2 factor authentication for critical biometric data.
  • fallingknife 3y ago
    How critical is this data, really? What could an attacker really do with my genetic profile?
    • nirav72 3y ago
      The genetic data could be sold to a third-party that exists outside of any regulations. 23andme allows download of raw data. So its not just genetic profile.
    • prepend 3y ago
      Assume everyone breached now has their dna linked forever with their marketing data graph. It will be sold and resold so eventually your TikTok feed will be influenced by your genes.
      • fallingknife 3y ago
        Tiktok know what videos you have watched and liked which is all the targeting data they ever need. They don't need or want your genetics. And even if they did, better Tiktok targeting isn't something that would make me worry enough to not make my password "abcdef".
        • prepend 3y ago
          Advertisers need your dna to sell products that are applicable only to certain dna. Or for higher probability (ie, Alzheimer’s genes).
    • bookofjoe 3y ago
      1. Find relatives you didn't know you had and inform them of the fact, perhaps destroying families by revealing long-concealed/previously unknown secrets 2. Identify DNA sequences and genes associated with various diseases, then contact you AND your relatives to advise seeing a doctor and consider using drugs made by the new owners of your genetic data 3. Sell your data to insurance companies who would pay plenty for early evidence of breast cancer likelihood or Huntington's Disease so they can avoid insuring you
      • fallingknife 3y ago
        Thinking that large companies are going to buy black market genetic data and deny your insurance is completely unhinged. Not only would they never do it because they would instantly get caught and sued into oblivion, the health insurance industry is actually incentivized against cutting medical costs because of the statutory maximum of 20% gross profit on premiums in the ACA.
        • bookofjoe 3y ago
          >Private equity wants to own your DNA https://www.cbsnews.com/news/blackstone-private-equity-ancestry-com-dna/ https://www.cbsnews.com/news/blackstone-private-equity-ances...
          • fallingknife 3y ago
            This is an acquisition of a company and has nothing in common with a data breach or purchasing stolen data on the black market.
            • bookofjoe 3y ago
              >Theoretically your insurance companies or employers won’t be buying this information off the black market. "Theoretically" is the operative word here. https://www.yourdnaguide.com/ydgblog/dna-data https://www.yourdnaguide.com/ydgblog/dna-data
  • themoose8 3y ago
    How would you do this for historical accounts? 2FA needs to be set up by users. It has gone through multiple iterations over the past 2 decades and was not always standard practice. 23andme was founded in 2006.
    • cced 3y ago
      Force them to change their password, prevent use of the account? If it’s a dormant account, force a password reset using email? Doesn’t feel like an unsolvable problem, certainly not one without edge cases but surely we can hit 80/20 without too big a hassle.
      • Aachen 3y ago
        The thing is, attackers don't need 20%. The article says they used 14k accounts with previously cracked passwords to uncover data of 7 million customers: that's 0.2% Doing low-hanging fruit isn't enough here. Honestly I just don't feel like the time is right to build such big DNA databases yet. Maybe one day with quantum encryption (can't observe the state without modifying it) or whatever else we may figure out, but today it just seems like you're taking a risk for yourself and half a dozen layers of relatives
    • mirekrusin 3y ago
      You show popup "are you hacker?". If somebody lies, it's not your problem, right?
    • prepend 3y ago
      I’ve had sites that do forced password resets and other annoying things when I come back after years. 23andme bears responsibility more than users like banks bear more responsibility for customers choosing stupid pins. DNA info is valuable they need to design good safeguards.
      • bookofjoe 3y ago
        Yahoo for one: I didn't mind.
  • tjoff 3y ago
    We don't have satisfactory 2fa solutions for consumers yet.
    • op00to 3y ago
      Sure we do. Mail a postcard with codes. Problem solved.
      • tjoff 3y ago
        We have different bars for satisfactory.
  • throw_pm23 3y ago
    Why should someone who is able to choose a strong, distinct password for each service (and keep it safe) be forced into an additional inconvenience. I think this is a more broad issue, how do you give the same service for all users, regardless of their level of experience.
    • mplewis 3y ago
      Because I have no way to verify that you never reused or leaked your own password anywhere. And because your genetic data isn’t just your own. It is shared by your kids, your parents, your extended family. I’ve never used 23andMe and yet I’m involved in this breach. How is that a fair shake?
      • uptown 3y ago
        “I’ve never used 23andMe and yet I’m involved in this breach.” How were you notified? I’ve never used the service but wondered what shadow profiles they may hold.
      • bookofjoe 3y ago
        If you have any blood relatives who signed up with 23andMe then you are automatically involved, even if you've never heard of 23andMe.
  • vdaea 3y ago
    I hate this. I hate that 2fa is becoming mandatory for more and more services because people can't be arsed to keep their passwords secure. I hate having to look at my mail to copy a stupid code every time I log into a website. Please don't do this.
    • op00to 3y ago
      Use passkeys then. Works great for me.
      • vdaea 3y ago
        1) Is it free? 2) Is it supported by all websites and apps I use? 3) Is it supported by all devices I use? Until the answer to all of those is "yes", passwords will remain superior.
• Aachen 3y ago
  To try to answer my own question, I suppose they could try detecting elevated login rates. Let's do the math: Getting a few thousand IP addresses for a month is cost-effective for any serious business (criminal or otherwise, but especially criminals that can buy botnet access). Spreading it out over a month, you could do 0.1 logins per minute to stay under the radar and get: 0.1 × 60 minutes × 24 hours × 30.4 days/month × 1000 IP addresses = 4.4 million login attempts > The [attackers logged in] to around 14,000 accounts using previously compromised login credentials 14k is well below 4.4M. To get that number lower than 14k (assuming they only ever use 1000 IPs), you need to ensure each IP address stays below 0.07 logins per day. Even allowing some bursting (3 attempts on some of the days), that's going to block paying customers from logging in.
• mc32 3y ago
  They have to know what normal access patterns look like, and if it looks unusual send confirmation magic links as well as look into what’s causing the unusual pattern, if anything. The data they guard is up there with banking information except it’s impossible to restore privacy, unlike funds in a bank.
  • Aachen 3y ago
    What features would you include in "look like"? Saying to just look at "normal behavior" is a bit like Intel saying they solved a problem with "algorithms and code" as an explanation
• Shrezzing 3y ago
  23-and-me could implement something like Troy Hunt's K-Anonymity API. The password is hashed, then the first n characters are sent to the API. The API then returns the count of times that password has appeared in data breaches. If the result is >0, the user's account is blocked until they've gone through a forgot password journey. 23-and-me could probably check if large numbers of people have all tried to sign in from common IP addresses within the space of a few hours. Even checking their login APIs for enormous spikes in unexpected traffic too. The requirements for your hobby projects are different to that of 23-and-me, but you could potentially implement a similar feature too.
  • Aachen 3y ago
    The password may not be known to HIBP at the time it is registered. This will very likely be a large enough fraction (>0.2%) that you can still get into sufficient accounts to access plenty of relatives' data. > could probably check if large numbers of people have all tried to sign in from common IP addresses within the space of a few hours That doesn't work, see my sibling comment where I did the math on what authentication rate you'd need to trigger at https://news.ycombinator.com/item?id=39116531 https://news.ycombinator.com/item?id=39116531
    • Shrezzing 3y ago
      >The password may not be known to HIBP at the time it is registered. This will very likely be a large enough fraction (>0.2%) that you can still get into sufficient accounts to access plenty of relatives' data. To be clear, the password can be checked at login-time, rather than registration-time, at which point the service should send the user through an account recovery process. There's still scope for passwords not appearing in the HIBP dataset, but it's massively reduced. Do you mean this link: https://news.ycombinator.com/item?id=39116531 https://news.ycombinator.com/item?id=39116531 ? I'm not sure I agree with your conclusion. You should be able to successfully highlight a unique IP address making ~4,400 discrete login attempts across a month as suspicious - and further highlight that there are 1,000 other IP addresses behaving in the same way. Most users login from a handfull of predictable IP addresses, and most IP addresses login with only a couple of predictable accounts. These types of login analytics aren't beyond the ken of man, and a service like 23-and-me should definitely not be able to allow 4.4m attempts and 14k successes from a small set of IP addresses without it raising some internal alerts.
• Sander_Marechal 3y ago
  - They could have used HIBP to prevent people using exposed passwords - They could have detected elevated authorizations - They could have forced 2FA - They could have implemented password stuffing protection Any security assessment would have pointed that out. In fact, when I had my own site pentested the very first time, this was exactly what was pointed out and I promptly fixed it. But it's all moot, since the attacker used a feature of 23andme to access data on other people whose account info they did not have. And that is squarely on 23andme.
  • Aachen 3y ago
    - The password may not be exposed at the time it is registered - That doesn't work, see my sibling comment where I did the math on what authentication rate you'd need to trigger at https://news.ycombinator.com/item?id=39116531 https://news.ycombinator.com/item?id=39116531 - 2FA sounds like a good suggestion, but is bad for business so they'll never do it voluntarily (maybe now that they need to save their reputation) - Isn't that the three above points combined? Or what does "credential stuffing protection" amount to? --- > Any security assessment would have pointed that out. I don't think you're familiar with security assessments That's what I do for a living and we'd have recommended only the first one because it's a simple thing you can implement on the server. About 1 in 10 customers actually follows through on that hardening advice to some extent (e.g. by downloading a top 10k passwords list or adding zxcvbn), even fewer use a huge database like HIBP even though we recommend that. We don't recommend 2FA for all users (only for administrative accounts) because clients never implement it. Adding suggestions that are seen as unrealistically paranoid makes the rest not being taken seriously anymore We also don't buy a botnet and simulate credential stuffing attacks. Maybe we should, but then we'd need the customer to deploy not one staging system with two test accounts per permission level but thousands of accounts, and some way to simulate having thousands of residential IP addresses. These things are not standard procedure and I haven't heard of any other pentest company requesting such a test setup (based on working together with other companies on one scope, chats at conferences, or looking at public pentest reports to see their setup or if they ever reported this finding)
    • Sander_Marechal 3y ago
• wzdd 3y ago
  "You're logging in from a new device. Please check your email for a verification code." "You're logging in from an unusual location. Please answer your security questions to continue." "We've sent you a text message with a code which is valid for the next 10 minutes." "Press OK on the 23andme app to continue." "Please enter the code shown on your 2-factor device." As a user, you can be blamed for poor password practices, but if you're running a service, it's basically a given that some percentage of your users are going to re-use passwords and it's your reponsibility to mitigate the fallout from that. If you don't enforce 2FA then you can check for unusual things about the login, such as change of IP address, browser, or device. Yes, it's not foolproof like 2FA, but it doesn't need to be foolproof to be useful.
  • Aachen 3y ago
    All of these quotes are saying to use 2FA (besides security questions, which are a horrible security measure: https://security.stackexchange.com/a/224271/10863 https://security.stackexchange.com/a/224271/10863). That sounds like a good suggestion, though it costs business because it adds friction. Maybe now that they need to save their reputation, and they're an established business with plenty of customers already, it makes sense for them to add, but a new entrant to the market would simply not do it and I'm not sure whether they can be fully blamed in a competitive market
  • tzs 3y ago
    I'm sure people would complain about most of those on privacy and/or antitrust grounds. > "You're logging in from a new device. Please check your email for a verification code." This site is keeping track of all the devices I use, which is not necessary to provide their service. > "You're logging in from an unusual location. Please answer your security questions to continue." They are also tracking my location, which is not necessary to provide their service. > "We've sent you a text message with a code which is valid for the next 10 minutes." They make me provide a phone number, which is not necessary to provide their service. > "Press OK on the 23andme app to continue." They have a perfectly good web site, yet they require me to use their proprietary app (which requires me to have an Apple or Android phone or tablet). This is not necessary to provide their service. They are probably getting paid by Apple and Google to try to force people to have they devices.