4 ms·
Forced 2 factor authentication for critical biometric data.
by op00to 3y ago
Forced 2 factor authentication for critical biometric data.
- fallingknife 3y agoHow critical is this data, really? What could an attacker really do with my genetic profile?
- nirav72 3y agoThe genetic data could be sold to a third-party that exists outside of any regulations. 23andme allows download of raw data. So its not just genetic profile.
- prepend 3y agoAssume everyone breached now has their dna linked forever with their marketing data graph. It will be sold and resold so eventually your TikTok feed will be influenced by your genes.
- fallingknife 3y agoTiktok know what videos you have watched and liked which is all the targeting data they ever need. They don't need or want your genetics. And even if they did, better Tiktok targeting isn't something that would make me worry enough to not make my password "abcdef".
- prepend 3y agoAdvertisers need your dna to sell products that are applicable only to certain dna. Or for higher probability (ie, Alzheimer’s genes).
- bookofjoe 3y ago1. Find relatives you didn't know you had and inform them of the fact, perhaps destroying families by revealing long-concealed/previously unknown secrets 2. Identify DNA sequences and genes associated with various diseases, then contact you AND your relatives to advise seeing a doctor and consider using drugs made by the new owners of your genetic data 3. Sell your data to insurance companies who would pay plenty for early evidence of breast cancer likelihood or Huntington's Disease so they can avoid insuring you
- fallingknife 3y agoThinking that large companies are going to buy black market genetic data and deny your insurance is completely unhinged. Not only would they never do it because they would instantly get caught and sued into oblivion, the health insurance industry is actually incentivized against cutting medical costs because of the statutory maximum of 20% gross profit on premiums in the ACA.
- bookofjoe 3y ago>Private equity wants to own your DNA https://www.cbsnews.com/news/blackstone-private-equity-ancestry-com-dna/ https://www.cbsnews.com/news/blackstone-private-equity-ances...
- fallingknife 3y agoThis is an acquisition of a company and has nothing in common with a data breach or purchasing stolen data on the black market.
- bookofjoe 3y ago>Theoretically your insurance companies or employers won’t be buying this information off the black market. "Theoretically" is the operative word here. https://www.yourdnaguide.com/ydgblog/dna-data https://www.yourdnaguide.com/ydgblog/dna-data
- themoose8 3y agoHow would you do this for historical accounts? 2FA needs to be set up by users. It has gone through multiple iterations over the past 2 decades and was not always standard practice. 23andme was founded in 2006.
- cced 3y agoForce them to change their password, prevent use of the account? If it’s a dormant account, force a password reset using email? Doesn’t feel like an unsolvable problem, certainly not one without edge cases but surely we can hit 80/20 without too big a hassle.
- Aachen 3y agoThe thing is, attackers don't need 20%. The article says they used 14k accounts with previously cracked passwords to uncover data of 7 million customers: that's 0.2% Doing low-hanging fruit isn't enough here. Honestly I just don't feel like the time is right to build such big DNA databases yet. Maybe one day with quantum encryption (can't observe the state without modifying it) or whatever else we may figure out, but today it just seems like you're taking a risk for yourself and half a dozen layers of relatives
- mirekrusin 3y agoYou show popup "are you hacker?". If somebody lies, it's not your problem, right?
- prepend 3y agoI’ve had sites that do forced password resets and other annoying things when I come back after years. 23andme bears responsibility more than users like banks bear more responsibility for customers choosing stupid pins. DNA info is valuable they need to design good safeguards.
- bookofjoe 3y agoYahoo for one: I didn't mind.
- tjoff 3y agoWe don't have satisfactory 2fa solutions for consumers yet.
- throw_pm23 3y agoWhy should someone who is able to choose a strong, distinct password for each service (and keep it safe) be forced into an additional inconvenience. I think this is a more broad issue, how do you give the same service for all users, regardless of their level of experience.
- mplewis 3y agoBecause I have no way to verify that you never reused or leaked your own password anywhere. And because your genetic data isn’t just your own. It is shared by your kids, your parents, your extended family. I’ve never used 23andMe and yet I’m involved in this breach. How is that a fair shake?
- uptown 3y ago“I’ve never used 23andMe and yet I’m involved in this breach.” How were you notified? I’ve never used the service but wondered what shadow profiles they may hold.
- bookofjoe 3y agoIf you have any blood relatives who signed up with 23andMe then you are automatically involved, even if you've never heard of 23andMe.
- vdaea 3y agoI hate this. I hate that 2fa is becoming mandatory for more and more services because people can't be arsed to keep their passwords secure. I hate having to look at my mail to copy a stupid code every time I log into a website. Please don't do this.