this post was submitted on 07 Jan 2024
205 points (96.0% liked)
Technology
59589 readers
2891 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
They're not wrong, this is because of users re-using passwords and an unrelated hacked database being used to brute-force access to 23andMe by checking to see if users re-used passwords. Shocker, they did.
I'll ask a question: What is a security system supposed to do when provided with the correct login credentials?
Hopefully it will inspire more companies to force 2FA, like 23andMe is doing now. That's honestly the biggest part that is their own fault, not forcing MFA from the get-go on their customer base.
I'm downvoting you even though I believe the users are negligent and partially to blame here. However, does the site not lock log in attempts after the first 10 login attempts or something? At this point, something so sensitive like ancestry and health information should be mfa required at the bare minimum a phone number 2fa would help a bit.
Not sure of this specific case, but typical brute force attacks are done locally on the database that was acquired from the breach, not on the site itself. This way lockouts aren’t an issue.
In this case it was a credential stuffing attack against the live login form on the website based on the information released.