Hacker Reacts to 23andme Data Leak

=[ 📄 Info. ]=


Support LiveOverflow:

=[ 🐕 Social ]=

Chapters:
00:00 - Intro
00:50 - 23andme Data Theft
03:44 - 23andme responsibilities?
05:33 - Facebook Cambridge Analytica
06:40 - Compromised Accounts Paper
07:44 - Personal Responsibility
10:54 - Outro

=[ 📄 P.S. ]=

Hack the Planet!

[rumplstiltztinkerstein]

23andMe has a feature where we can find our relatives? Do they have a feature that does the opposite? It would be great to be warned whenever a relative is in within a certain mile radius so I can get away as fast as possible.

[eaad]

I'm all for people taking responsibility, but in this case people that were doing everything right got breached because of other people that didn't. And I think it was 23andme's responsibility to make sure this couldn't happen, for example by *requiring* 2FA before you can opt-in for the "find my relatives" feature. We know for a fact that there are people that will reuse passwords and not use 2FA. While you can't protect these persons, you should at least make sure they won't put others at risk.

[mrt_]

Back in primary school they claimed that we needed a kind of bike pass to bike to school alone, and we got one after proving that we knew how to bike safely in the 4th grade.
They couldn't really enforce it, and I found it stupid at the time, but now, I think it was more useful to have it be like that.
So, yeah, I agree with you, there should be some kind of drivers license for the internet.
If not just a course in cyber security/OPSec that everyone has to take.

[lawrencejob]

23andme could have done more - require 2FA for people who opt in to access other people’s genetics; rate limit and geovalidation as you say

Furthermore why isn’t 2FA mandatory for anything with medical sensitive information? IMO 23andme should require multi factor login because of the nature of their product

[parstrm]

the fundamental idea of a publicly available service which you put an abundance of sensitive information into is inherently insecure by default. many security professionals argue against similar digitization (e.g. NHS records in the uk) for the same reason.

[PhrNoBr]

Many Discord servers require 2FA for mods, because with that role you might endanger others. Probably would have been a good idea to require 2FA for features like the relative search.

[ndm]

THANK YOU for this take. It's so frustrating to eee so many people not even read the article on this.

[minifreddusch]

I don’t quite understand why such a sensitive platform wouldn’t enforce 2-factor authentication, which is now state of the art. Hard to blame it all on the users when there are technical measures they failed to implement.

[yeetyeet]

just going by the math, the people doing credential stuffing at 23andme had to test at least 5 MILLION passwords

Given the sensitivity of this data tho, people will probably have used the strongest of their often reused passwords, meaning it was likely a lot more than 5 million (2x), which really brings into question whether 23andme fucked up rate-limiting.

Facebook and WhatsApp fucked up rate-limiting, so it's not unlikely a small biotech *grift* like 23andme wouldn't have the same shitty security practices.

[casperes]

Passkeys help. Basically automated password managers built into everything and instead of a page asking you to make a password it automatically creates an entry in the database on your system and it's random every time

[ruinedbectorem]

O and about not expecting the car manufacturer to stop you from driving off a cliff...

Tesla: Hold My Kombucha!

[InfiniteQuest]

Yes, 100%. Thank you for spreading the word!

[christophschneider]

I'm forcing my family to use a password manager for this exact reason. My younger siblings don't really care about security (the "i have nothing to hide" argument) and my parents... well they're now using a password manager, so issue solved :)

[Play_it]

In general I understand your point, but the security is many times not high enought to prevent such trivial attacks. Just using rate limiting of 1 second per login attempt would add seconds or 57 days and some hours. It would have taken nearly 2 months longer to gather all this data and this is just the number of successful logins.

I see 23andme at fault.

[Lampe]

Hmmm… Why does this remind me of the Füllerführerschein I made in elementary school? XD

[sudo]

hey can please you do a video on binarly's logofail uefi vulnerability

[drewalleman]

Could you create a YouTube video discussing the platform's guidelines on ethical hacking, including key dos and don'ts, and share your insights from past experiences with strikes? I faced a channel strike after posting a malware analysis video and would appreciate your expertise on navigating these rules.

[jonathan-._.-]

imagine being in the convenience store buying a phone, and the clerk asks for your internet passport :D

[tqotbel]

well said. as we know, credential stuffing doesn't just affect the one user. critical infrastructure gets targeted and breached with reused passwords all the damn time.
i will say that expecting adults to act like adults is extremely wishful thinking.

[ruinedbectorem]

Thanks for saying what we are thinking.