5 ms·
I do not reuse passwords, and from what I understand, my account was not accessed directly. The message they sent me was: "After further review, we have identi
by masto 3y ago
I do not reuse passwords, and from what I understand, my account was not accessed directly. The message they sent me was:
"After further review, we have identified your DNA Relatives profile as one that was impacted in this incident. Specifically, there was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor."
So there's nothing I could have done with password security that would have prevented this; my only mistake was using a feature of their site.
- Culonavirus 3y agoTurns out that people who were saying that these kinds of services are going to give access to Government actors, sell their databases or just have them hacked/stolen by malicious actors because of garbage security were, in fact, correct. Color me not surprised.
- poszlem 3y agoI will color you cynical instead.
- Loughla 3y agoIs it still cynicism if it's accurate?
- timnetworks 3y agoIt is if the future is stupid.
- tomrod 3y agoI have bad news for you...
- ilovetux 3y agoAcuracy does not factor into whether a statement is cynicism.
- davisoneee 3y agoWe only highlight the cases where the cynicism paid off...and in this case praising someone who is saying something pithy _after the fact_. It's easy to throw out cynical opinions. It's also easy to come along later and say "I _knew_ this would happen"
- KronisLV 3y agoSometimes cynicism is well warranted. Security is just very hard to get right, in general, regardless of who you are.
- npoc 3y agoThis isn't cynicism. It's intelligence - making an accurate prediction of future events.
- davisoneee 3y agoEven a broken clock is right twice a day. Intelligence is being able to _consistently_ make accurate predictions of the future.
- ChildOfChaos 3y agoJust because something ended up being right doesn't mean it was intelligent. Things don't work in absolute, most things are a bet. If one outcome is 99% likely and the other 1%, the intelligent thing is choosing the 99% likelihood, but that still means that sometimes the person making the bad choice was right. That doesn't make them intelligent, it makes them lucky.
- pyrale 3y agoCynicism is often a coping mechanism for people that have seen too many such events happen. It's actually only a problem when it guides choices from decision makers ahead of time, there's nothing wrong with some cynicism as long as it doesn't guide your actions.
- worksonmine 3y agoHow is one not cynical today?
- cudgy 3y agoCynicism is a general distrust in other people’s motives. How does one conclude that distrust expressed in a single event constitutes general distrust? Don’t we need many more examples of distrust from this person before branding them as cynical?
- bayindirh 3y agoIf you think that governments are not already building gene pools of their populations, I can color you a hip shade of naive, too, if you consent of course.
- shafyy 3y agoOk, I'll bite. Which governments are you referring to? And how are they doing this? And how do you know of this?
- jtc331 3y agoIsn’t it true that it’s already widely known that some US states (or the US itself; can’t remember details) stores DNA of anyone ever booked by the police even if not charged or charged and acquitted?
- lcnPylGDnU4H9OF 3y agoI’m not the person you’re responding to but their claim doesn’t seem so contentious. > Which governments are you referring to? Any that has an intelligence service. (And probably most others too.) > And how are they doing this? They get the data from breaches like this or otherwise purchased from services like this. > And how do you know of this? I’d suspect less that they know and more that they have a reasonable suspicion. I personally have that suspicion because 1) it’s feasible and 2) governments would be interested in the data.
- wonderwonder 3y agoThat's how they caught the golden state serial killer https://www.cbc.ca/news/world/dna-from-genealogy-site-used-to-catch-suspected-golden-state-killer-1.4637726#:~:text=World-,DNA%20from%20genealogy%20site%20used%20to%20catch%20suspected%20Golden%20State,to%20find%20a%20DNA%20match https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t.... Also, the government keeps all DNA from people arrested (not convicted) for anything https://www.nbcnews.com/news/world/your-dna-police-database-flna6c10617124 https://www.nbcnews.com/news/world/your-dna-police-database-...
- bayindirh 3y ago
- apwell23 3y ago> give access to Government actors, sell their databases or just have them hacked/stolen by malicious actors one of these is not like the other
- ClumsyPilot 3y agoIt’s a big club, and we ain’t in it!
- MailleQuiMaille 3y agoStill your mistake, so in a sense they were right. I dont use DNA services like these especially for cases like these. /s
- Aachen 3y agoI wouldn't say it so starkly. Not overseeing all consequences isn't necessarily a mistake someone can be blamed for At least part of the issue is not informing people of the risk they're taking by using the feature. That doesn't make for good business, though
- MailleQuiMaille 3y agoSadly, I have to agree. The amount of convincing I had to to try (and fail) to stop friends from using this specific website before the leak… The sad thing is that it’s not necessarily about malice that you should be wary. Stuff like this is a risk too. But yeah, I was a bit harsh, it’s true.
- masto 3y agoYou're welcome to your own opinion about what you think is a bad idea, but I don't share it. I won't call you paranoid if you don't call me stupid.
- TibbityFlanders 3y ago[dead]
- rjmunro 3y agoWhat exactly does the feature do? Share (some of?) your data with people you seem to be related to? If that data is sensitive, it seems a pretty risky thing to share even with relatives who you know quite well.
- masto 3y agoIt shares some information that you optionally choose to share (genealogical data like where your ancestors are from, family names, etc., and which segments of DNA match). One thing reading Hacker News has made clear is that people have wildly differing opinions of what "sensitive" and "risky" mean.
- shadowgovt 3y agoYeah, that's the thing about defining PII in law. You may simply legally curtail some useful applications.
- nickthegreek 3y agoIt shares your name and how much DNA you have in common. These are opt-in features.
- onetimeuse92304 3y agoI had a similar situation back when Adobe lost their database. I have a personal domain with a catch all configured. So back then I would just give a name like adobe.com@<personal-domain>. When they leaked my password I contacted their support and they flatly told me that's not them who lost the password, even though evidently the mail itself was tailored specifically for Adobe. It is likely the support was told to follow a script when a concerned client contacts them and there is no way they are going to tell you anything else regardless of the specifics of your case or how absurd their arguments are.
- posix86 3y agoI understand you couldn't have done anything, but on the other hand, could they have? My understanding is that the people that were breached were breached outside 23andMe, and their credentials were simply used to log into 23andMe. Not attachking you or anything but haven't you opted in to sharing potentially sensitive information to people you don't know, basically making this information as secure as these people's accounts are? Or, for that matter, as secure as these people are? Perhaps they could highlight that a bit more (I wouldn't think of that probably if I used this feature). But that's just as much "just" a mistake as "just using a feature".
- kieranhunt 3y agoUsing a service like Have I Been Pwned, could companies like 23andMe proactively invalidate credentials that are known to be leaked? The next time those customers try to log in, they're forced to update their credentials through something like an email-based password reset?
- hazmazlaz 3y agoYes, this is exactly what could have been (and in my opinion, should have been) done to prevent this kind of "credential stuffing" attack. By taking known corpus of exposed passwords and comparing the hashed values against existing user password hashes, the company could have proactively locked accounts and forced password resets for users who had previously chosen weak passwords, and prevented new weak passwords from being chosen as well. This is quickly becoming an industry standard practice, and 23andMe likely knows that and is trying to make the argument that it's not their problem and has nothing to do with them (wrong).
- grotorea 3y agoThey could have mandated stronger security. Wouldn't even 2FA have avoided this issue? Or even some even stronger measures like enforcing use of hardware security keys.
- anotheraccount9 3y ago