this post was submitted on 16 Sep 2024
228 points (98.7% liked)
Technology
59589 readers
3376 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What an absolute failure of the legal system to understand the issue at hand and appropriately assign liability.
Here's an article with more context, but tl;dr the "hackers" used credential stuffing, meaning that they used username and password combos that were breached from other sites. The users were reusing weak password combinations and 23andme only had visibility into legitimate login attempts with accurate username and password combos.
Arguably 23andme should not have built out their internal data sharing service quite so broadly, but presumably many users are looking to find long lost relatives, so I understand the rationale for it.
Thus continues the long, sorrowful, swan song of the password.
Wide-spread adoption of passkeys can't come soon enough.
I don't think it's going to get much more broadly used than it is now. I work in cyber security and there have been password hacks like this since practically the beginning of the internet. It's called a rainbow table attack, It mostly relies on the victims being complete idiots.
You don't even need to have a particularly secure password to be safe from it, you just have to have a unique one from site to site. Even if in other respects it's relatively weak it will still defeat a rainbow table attack.
The point is this stuff has been going on for decades and people are still making basic fundamental errors, so I can't see how that's going to change in the future. Maybe we should require everyone to take some sort of basic proficiency test before they're allowed online.