Technology

59174 readers

1073 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

777

23andMe tells victims it's their fault that their data was breached | TechCrunch (techcrunch.com)

submitted 10 months ago by Eezyville@sh.itjust.works to c/technology@lemmy.world

246 comments fedilink hide all child comments

Hope this isn't a repeated submission. Funny how they're trying to deflect blame after they tried to change the EULA post breach.

you are viewing a single comment's thread
view the rest of the comments

[–] mp04610@lemm.ee 19 points 10 months ago (1 children)

From these 14,000 initial victims, however, the hackers were able to then access the personal data of the other 6.9 million million victims because they had opted-in to 23andMe’s DNA Relatives feature.

How exactly are these 6.9M users at fault? They opted in to a feature of the platform that had nothing to do with their passwords.

On top of that, the company should have enforced strong passwords and forced 2FA for all accounts. What they're doing is victim blaming.

[–] Falcon@lemmy.world 5 points 10 months ago* (last edited 10 months ago) (1 children)

users knowingly opted into a feature that had a clear privacy risk.

Strong passwords often aren't at issue, password re-use is. If un-{salted, hashed} passwords were compromised in a previous breach, then it doesn’t matter how strong those passwords are.

Every user who was compromised:

Put their DNA profile online
Opted to share their information in some way

A further subset of users failed to use a unique and strong password.

A 2FA token (think Matrix) might have helped here, other than that, individuals need to take a greater responsibility for personal privacy. This isn’t an essential service like water, banking, electricity etc. This is a place to upload your DNA profile…

[–] Hegar@kbin.social -2 points 10 months ago* (last edited 10 months ago)

users knowingly opted into a feature that had a clear privacy risk.

Your aunt who still insists she's part Cherokee is not as capable of understanding data security risks as the IT department of the multi-million dollar that offered the ludicrously stupid feature in the first place.

People use these sites once right? Who's changing their password on a site they don't log into anymore? Given that credential stuffing was inevitable and foreseeable, the feature is obviously a massive risk that shouldn't have been launched.