Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

23andMe told victims of data breach that suing is futile

arstechnica.com

Post reply on HN
Print view View original

11–20 of 34 posts

Re: 23andMe told victims of data breach that suing is futile

#11

Post by jacquesm »

tjpnz wrote: post #6
chii wrote: post #2

even if there's no financial compensation for the victims, it makes sense to make an example out of a company that doesn't actually take data privacy and security seriously.

The allegation is that they weren't taking reasonable steps to safeguard customer data under California law, the problem is that it's not stated what reasonable is. What's needed here are clearer regulations.

Common sense tells you that if you set up a service for the gullible to send you their DNA that none of your customers are going to be security and privacy conscious. You need to engineer your service accordingly.

Re: 23andMe told victims of data breach that suing is futile

#13

Post by ticulatedspline »

jacquesm wrote: post #9
ticulatedspline wrote: post #8

Earlier quoted context omitted.

And what exactly where their responsibilities that they failed to understand?

That they should have offered (and enforced) 2FA from day #1 because users will re-use passwords because they are utterly unaware of the implications of doing that. A company the size of 23andme in charge of a very large amount of medical data and PII should be aware of those implications. To blame the users here is beyond stupid and irresponsible. You don't engineer a service like 23andme without doing some risk ass…

they do offer 2fa. Personally I do blame the users, it's like if I robbed your house and then you sued the city because there wasn't a law that required you to put steel bars on your windows and have 3 locks and your argument is "I moved into a area where crime could occur, the city should have known I was too stupid to secure my stuff, we want a nanny state!"

as long as they weren't actively inhibiting security by not offering 2 factor or disallowing strong passwords, I don't think it's legally a company's responsibility to make their users eat their vegetables. good idea? maybe, but not required.

Re: 23andMe told victims of data breach that suing is futile

#14

Post by synicalx »

jacquesm wrote: post #9
ticulatedspline wrote: post #8

Earlier quoted context omitted.

And what exactly where their responsibilities that they failed to understand?

That they should have offered (and enforced) 2FA from day #1 because users will re-use passwords because they are utterly unaware of the implications of doing that. A company the size of 23andme in charge of a very large amount of medical data and PII should be aware of those implications. To blame the users here is beyond stupid and irresponsible. You don't engineer a service like 23andme without doing some risk ass…

As another commenter pointed out elsewhere, they do offer MFA. However from what I can gather it looks like they, like most other companies, don't mandate it's usage. Like you've said though given the kind of data they have they 100% needed to do better here and their response is bonkers.

Re: 23andMe told victims of data breach that suing is futile

#15

Post by synicalx »

ticulatedspline wrote: post #13
jacquesm wrote: post #9

Earlier quoted context omitted.

That they should have offered (and enforced) 2FA from day #1 because users will re-use passwords because they are utterly unaware of the implications of doing that. A company the size of 23andme in charge of a very large amount of medical data and PII should be aware of those implications. To blame the users here is beyond stupid and irresponsible. You don't engineer a service like 23andme without doing some risk ass…

they do offer 2fa. Personally I do blame the users, it's like if I robbed your house and then you sued the city because there wasn't a law that required you to put steel bars on your windows and have 3 locks and your argument is "I moved into a area where crime could occur, the city should have known I was too stupid to secure my stuff, we want a nanny state!" as long as they weren't actively inhibiting security by n…

While it might not be "legally" required (or maybe it is, courts haven't decided yet) it's in 23andme's own best interest to at least take some steps to ensure the technically illiterate users aren't leaving the front door wide open because if they don't then they end up in situations like this.

They can blame anyone they want but at the end of the day it's their brand that's getting dragged through the mud right now and after this NO ONE will trust them ever again.

Re: 23andMe told victims of data breach that suing is futile

#16

Post by cassianoleal »

synicalx wrote: post #10

From what I understand, the hack was due to a large number of people re-using passwords and the company doing nothing to prevent or detect this. Security practices and their ludicrously bad response aside, I cannot fathom why someone would send their literal DNA to a company and then take no steps to secure that information. Is technical literacy really this poor amongst the general population? Even my retiree dad wh…

> the company doing nothing to prevent or detect this.

How would they do that?

I'm not defending 23andMe but I really don't see how a service can detect that the password I chose on their website is the same I chose on a different one. Not without: a) them knowing what my chosen password is; and b) them knowing my passwords on other websites.

Re: 23andMe told victims of data breach that suing is futile

#17

Post by noduerme »

ticulatedspline wrote: post #7
chii wrote: post #2

even if there's no financial compensation for the victims, it makes sense to make an example out of a company that doesn't actually take data privacy and security seriously.

It would be dangerous precedent though. assuming they have a reasonable password policy it seems the breach was in no way related to a failure by 23 and me. they even offer 2 factor https://customercare.23andme.com/hc/en-us/articles/360034119... sure they could do better, but are they legally required to be better? They could force 2fa, or 3fa, or 4fa, and disable accounts that go inactive for more than a week and re…

I think it's more a question of encrypting data on the backend. The data wasn't stolen by phishing 16 million individual users' passwords. Companies that deal with sensitive genetic data should be subject to the same level of HIPAA compliance as those that deal with medical data, for instance.

Re: 23andMe told victims of data breach that suing is futile

#18

Post by ticulatedspline »

synicalx wrote: post #15
ticulatedspline wrote: post #13

Earlier quoted context omitted.

they do offer 2fa. Personally I do blame the users, it's like if I robbed your house and then you sued the city because there wasn't a law that required you to put steel bars on your windows and have 3 locks and your argument is "I moved into a area where crime could occur, the city should have known I was too stupid to secure my stuff, we want a nanny state!" as long as they weren't actively inhibiting security by n…

While it might not be "legally" required (or maybe it is, courts haven't decided yet) it's in 23andme's own best interest to at least take some steps to ensure the technically illiterate users aren't leaving the front door wide open because if they don't then they end up in situations like this. They can blame anyone they want but at the end of the day it's their brand that's getting dragged through the mud right now…

oh absolutely they look bad, and they could certainly have chosen a more tactful response. Most people won't even understand the nature of the data loss, and it's likely to affect their bottom line. And honestly IMHO that's more than enough lesson to start forcing security down their customer's throats.

But as I see it right now they have no legal culpability and calling for them to be drawn and quartered over it isn't exactly productive. Honestly I'd worry more about an industry knee-jerk reaction slapping crappy but CYA security on all kinds of sites if they lose the legal battle over this.

Re: 23andMe told victims of data breach that suing is futile

#19

Post by devinegan »

cassianoleal wrote: post #16
synicalx wrote: post #10

From what I understand, the hack was due to a large number of people re-using passwords and the company doing nothing to prevent or detect this. Security practices and their ludicrously bad response aside, I cannot fathom why someone would send their literal DNA to a company and then take no steps to secure that information. Is technical literacy really this poor amongst the general population? Even my retiree dad wh…

> the company doing nothing to prevent or detect this. How would they do that? I'm not defending 23andMe but I really don't see how a service can detect that the password I chose on their website is the same I chose on a different one. Not without: a) them knowing what my chosen password is; and b) them knowing my passwords on other websites.

Use a previously breached password database like the one haveibeenpwned offers. https://haveibeenpwned.com/Passwords

Re: 23andMe told victims of data breach that suing is futile

#20

Post by ticulatedspline »

cassianoleal wrote: post #16
synicalx wrote: post #10

From what I understand, the hack was due to a large number of people re-using passwords and the company doing nothing to prevent or detect this. Security practices and their ludicrously bad response aside, I cannot fathom why someone would send their literal DNA to a company and then take no steps to secure that information. Is technical literacy really this poor amongst the general population? Even my retiree dad wh…

> the company doing nothing to prevent or detect this. How would they do that? I'm not defending 23andMe but I really don't see how a service can detect that the password I chose on their website is the same I chose on a different one. Not without: a) them knowing what my chosen password is; and b) them knowing my passwords on other websites.

I have been defending them but there are things they could do, though I don't think they should be legally required to do so.

Where I work the security team monitors PW leaks and run them against our userbase if we find matches we lock their accounts and force a reset, that password also goes into a file and becomes pema-banned from being chosen.

we also force multifactor, which isn't bullet proof (heck if you used the same TOTP in 2 sites your hex key could get stolen) but it does go a long way. 2 factor is super annoying though and lots of places only offer crap methods like SMS (I loath to give out my phone number). personally I'd rather use just a strong site-specific password than be forced to provide my phone number.

Post reply on HN