this post was submitted on 07 Jan 2024
205 points (96.0% liked)
Technology
59627 readers
2807 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
They're not wrong, this is because of users re-using passwords and an unrelated hacked database being used to brute-force access to 23andMe by checking to see if users re-used passwords. Shocker, they did.
I'll ask a question: What is a security system supposed to do when provided with the correct login credentials?
Hopefully it will inspire more companies to force 2FA, like 23andMe is doing now. That's honestly the biggest part that is their own fault, not forcing MFA from the get-go on their customer base.
I'm downvoting you even though I believe the users are negligent and partially to blame here. However, does the site not lock log in attempts after the first 10 login attempts or something? At this point, something so sensitive like ancestry and health information should be mfa required at the bare minimum a phone number 2fa would help a bit.
They had accurate credentials. They didn't hit a login wall because people were re-using their passwords. They hit a login-wall for people who didn't re-use their passwords. They got accurate credentials from an unrelated hack, from people re-using passwords. How many times does a system "block" you when you have the right username and password the first time?? Zero, I'm pretty fucksure.
(Also, it's usually more like three attempts.)
I am very confused at what people think computers are supposed to do when given the correct login information? The point of login information is to prove who you are. If you have the correct information, the computer cannot know who is behind the keyboard.
On this point, I agree. 23andMe seems to now as well, considering they just rolled out required MFA for all their users. However, we live in a world basically zero data privacy laws in the US. The US can't even fucking pass a budget, so good luck waiting on privacy laws. You want that kind of consideration, you gotta move to Europe.
Like 23andMe, companies don't really care until something has already happened, since there isn't legislation forcing them to care.
Finally, phone 2FA is garbage that can be intercepted. It shouldn't be used. The fact that it's still the default means this won't be the end of data breaches. People need to embrace security keys like YubiKey.
Perhaps a better question would be to ask why they are allowing 14k separate logins from (what was probably) the same IP address? If you ask any big email provider, they will tell you they immediately shut down any access from that IP due to suspicious behavior, while simultaneously resetting the passwords of all the accounts that appear to be compromised. Typically you should have records of the IPs used for previous logins so it's fairly simple to compare records having suspicious activity and see if the accounts in question had any previous relationships with each other. And once you have that information on hand you can use it to monitor the compromised accounts for any further login attempts by unknown IPs and then block THOSE addresses as well.
When you have that many active user accounts, you do not just settle for simply accepting the correct credentials.
You are aware that IP spoofing exists? It's not impossible for the hacker to have appeared to have been connecting from many different connections.
Yes I am, as I'm sure you are aware that IP spoofing is pretty much only relevant where you are sending outgoing packets (like in a DDoS attack) and do not expect to receive any information back. If you need two-way communication over TCP, spoofing doesn't work because the returned information naturally gets routed back to the host of the real IP and not to the spoofed address. Obviously these attackers received some information back.