2 ms·

"The hackers initially got access to around 14,000 accounts using previously compromised login credentials, but they then used a feature of 23andMe to gain acce

"The hackers initially got access to around 14,000 accounts using previously compromised login credentials, but they then used a feature of 23andMe to gain access to almost half of the company's user base, or about 7 million accounts, the company previously told Business Insider." Okay, so first off no software team would be surprised to know that you have millions or tens of millions of customers and as many as 14k reused logins from elsewhere. Second, if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base you've made a terrible, terrible decision when adding features that allowed that. Reused username/password pairs is a known challenge, and we should all be aware that our software will be used with compromised logins. Plan for that and don't assume that anyone with a login is both allowed in the door and not there for malicious reasons.

Aachen 3y ago
> if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base The article implies that (probably for sensation), but I don't think this is what it means. I assume they got enough matches between these 14k customers to view some level of information on their relatives such as their name. Genetics being what they are (pretty stable between generations), that resulted in a ton of data being shown cumulatively But that's just my reading, per my understanding of 23&M's business model. Maybe they did find a vulnerability that allowed actual account access, but that would be bigger news by itself and the article would be exceedingly likely to mention that explicitly Edit: this other top-level comment seems to confirm that https://news.ycombinator.com/item?id=39116561 https://news.ycombinator.com/item?id=39116561
deleted 3y ago
[deleted]
jefftk 3y ago
> if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base If someone gets access to my facebook account they can read anything my "friends" have marked as "friends-only". Lots of users want that kind of restricted sharing (both with Facebook and with 23andMe).

Aachen 3y ago

> if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base The article implies that (probably for sensation), but I don't think this is what it means. I assume they got enough matches between these 14k customers to view some level of information on their relatives such as their name. Genetics being what they are (pretty stable between generations), that resulted in a ton of data being shown cumulatively But that's just my reading, per my understanding of 23&M's business model. Maybe they did find a vulnerability that allowed actual account access, but that would be bigger news by itself and the article would be exceedingly likely to mention that explicitly Edit: this other top-level comment seems to confirm that https://news.ycombinator.com/item?id=39116561 https://news.ycombinator.com/item?id=39116561

deleted 3y ago

[deleted]

jefftk 3y ago

> if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base If someone gets access to my facebook account they can read anything my "friends" have marked as "friends-only". Lots of users want that kind of restricted sharing (both with Facebook and with 23andMe).