Hacker leaks millions more 23andMe user records on cybercrime forum | Hacker News Reader

Hacker leaks millions more 23andMe user records on cybercrime forum

techcrunch.com

490 pointscoloneltcb394 comments

> 23andMe blamed the incident on its customers for reusing passwords, and an opt-in feature called DNA Relatives, which allows users to see the data of other opted-in users whose genetic data matches theirs. If a user had this feature turned on, in theory it would allow hackers to scrape data on more than one user by breaking into a single user’s account.

23andMe's blame is an obfuscation of the problems which underlie this situation.

1. There is the matter of having insufficient granularity in their sharing options within the DNA Relatives program. It comes with two general levels, which is not enough.

2. 23andMe limits one to seeing the closest 1500 matches who have opted-in to DNA Relatives. That would have allowed a hacker to collect data on most people in the database despite having only a few thousand compromised accounts. (Haplogroups, ethnic origins predictions, names, profile data, a list of relatives, and information on geographic origins.)

3. The 1500 match limit would be helpful, in theory, however for some time (recently) it was possible to see profiles beyond those 1500 matches. I'm not certain if these were limited to only those who shared matching DNA segments but who fell outside of the 1500 match limit. And I can't be certain if this was part of the method exploited by these malicious actors.

The 23andme page on "DNA relatives" says this though:

> If you choose to participate in the DNA Relatives feature, you have multiple privacy options to suit your individual preferences. For complete privacy, you can opt out of DNA Relatives entirely.

How is a feature opt-in if you need to opt-out to get "complete privacy"? What does complete privacy mean in this case and how does it compare to privacy that you can reasonably expect?

I call bullshit on their statement that the feature is opt-in.

When you sign up they present you with the option to fill out a profile for use of the DNA relatives feature. You can either fill it out and join, or click a different button saying you don't want to join.

Maybe before, but that wasn't my friend's experience when signing up.

there's laws around this topic and what is accessible for the sake of murder and kidnapping cases that requires people opt in, so i don't think that would be the case

I think this might just be a slight difference in language usage. "opt-in" and "opt-out" as adjectives mean "something that is default off/on (respectively) that you can choose to select the other mode".

But "opt in" and "opt out" as verbs mean "choose to/not to participate". So you can in fact "opt out" of an "opt-in" feature. It means choosing to keep the default of not opting in.

That's a misuse of those terms. If you're presented with a switch that's in the the on position you don't switch it off, it's arguable that you've opted to leave it on. If you never realized the switch existed it would definitely be incorrect to say that you've opted to leave it off, since you can't make decisions about things you don't know exist. Yet, both cases would appear the same if all you know is which users had an opt-out setting in the in position.

The verb “to opt” just means to make a choice. Programmers created the “opt in/opt out” binary as a useful way of describing how new features got rolled out. But it’s perfectly fine to say (for example) that I “out out” of voting, even though voting is an “opt-in feature” of our society (depending on where you live).

You could rephrase the 23andme statement to be something like “users of this feature can choose from a range of privacy settings. For complete privacy, do not use this feature (which is the default setting).”

It's not a misuse, it's the natural language meaning of the word "opt", which long predates anything like the opt-in/opt-out usage that refers to default settings.

Wow. What a shit company. It isn't the user's responsibility to secure the data that you store, it is 100% on you. If the user is reusing a pwd that might be the reason a single account got hacked but to beat a dead horse, you can mitigate that easily as a company.

Karma seems to always work things out.

I also regret giving them my data. At work, we bought one of their first kits. We were doing genetics research and my boss got some for Christmas and gifted them to everyone in the group.

Technically, 23andme is also pretty bad, which is hard to understand given that they employ very competent people and they are well funded. Seems like a space ripe for disruption. Their biggest competitor, DecodeME, never really aimed at B2C and just used customers to harvest data, then sold to a pharma.

23andme genetic risk scores are mediocre at best. Promethease makes better predictions. For example, in my case I have a high risk MHC allele, which is both trivial to predict and well understood since the 1980s. Never popped up on their reports, yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself.

From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company.

Back then, few people had the mindset of, "if they own my data, they own me." But we're starting to see it take hold.

I don't know about that. Geneology has been a hobby for me for a couple decades and I'd say only tech illiterates were willing to trust 23 and me. I've never seen any company I've worked at do well enough with security that I'd trust them with my DNA and with the constant data breaches across the industry with zero consequential penalties, this seems like the norm. Have you ever seen security done right anywhere? In my experience, it's always the bare minimum. Banks are about as close as it gets and that's only because they have higher obligations than most.

> 23andme seemed like a solid, reputable company.

One thing I've come to realize over the past couple of decades is that with internet/tech/VC startups in particular, the statements they make about goals, philosophy, core values, and ethics are subject to change as needed to secure more funding, increase revenue, or in case of acquisition.

You really cannot trust what any company says until they've been in business at least ten years with an unbroken record of responsible, trustworthy operation. And even then it can all change with a merger.

Well, maybe. I for one _absolutely_ didn't participate b.c. I didn't want my DNA and personally identifying information owned by any company. I can't imagine that there aren't many others like me.

I would, however, love to send my DNA to a company if they could provide the results without knowing any information about me whatsoever. For instance: I would be more than willing to buy the kit with cash and send it back with a burner email. Has anyone heard of such a service?

> Back then, few people had the mindset of, "if they own my data, they own me." But we're starting to see it take hold.

People have been screaming this from the rooftops even back then.

This is hilarious, and completely absolves everyone from bad decision making like this. My immediate reaction to 23andme was "there's no way in hell I'm sending something as private and personal as my DNA to a private company".

Why? Because there's no telling what happens to it. It's a failure of judgement to believe that just because a company is reputable today that it will be reputable tomorrow. Companies change owners, they change board members, they get bought and sold. And _hacked_.

So let's stop this nonsense of giving everyone a free pass because it was a "solid, reputable company". Maybe we can give grandma a pass, but someone on a technically minded forum such as HN should know better.

>Back then, few people had the mindset of, "if they own my data, they own me." But we're starting to see it take hold.

Really? You're being either very generous or very naive here, because even back then it seemed blindingly obvious that it's a bad bloody idea to trust a tech company of nearly any kind to safeguard your data securely or honestly. Then double the paranoia when it comes to your genetic information. For somebody working in the tech space in particular to have not been be cynical about this is plainly absurd.

From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company.

I am interested in genetics, but I didn't trust google, and I trusted a google spouse company even less (it's like John Lennon's Google, and Yoko Ono's 23andMe, when I didn't trust Lennon to begin with) and my data hasn't been spilled. Half of you are thinking of all sorts of epithets to call me, but fact is, I was right about 23andMe. From a decision-making standpoint, slam dunk for me and anybody who listened to me. It was not an unusual position to take. "What. Could. Go. Wrong?"

(I'm fully aware they probably already have my data from numerous blood tests I've taken from normal medical checkups, etc. but what could I have done about that?)

I forgot which company I used, but part of their deal was that you had the ability to delete your DNA data. Which I guess would’ve come in handy for a lot of people with 23andme. If you had chosen to do so of course.

This seems to be more a consequence of being FDA regulated. Promethease is just providing a lookup service, cross-referencing a genotype file with SNPedia, which offers no direct prediction claims IIRC.

https://www.snpedia.com/

> yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself.

If you had not mentioned this i would have thought they weren't testing people at all.

Have you deleted your data? They provide a clear button to do so...

Do you trust that your data, that they fully control on their system, is actually deleted? Including their backups that reside elsewhere? I just assume they set your record's "delete" field to "true" when you press that button. No way for us plebs to be certain about what they do.

Yeah, right. ANYTHING you put in the cloud or any other digital media no longer belongs to you. I suspect 23 sold this valuable data, that any insurance company would kill for, to the highest bidder. When will we learn we cannot trust any company with our info?!?

I eventually did, and also opted out from trials and sharing with pharmas prior to that.

23andme doesn’t delete your data. By law, they have to keep it for several more years before deletion

Facebook has this same feature!

> Seems like a space ripe for disruption.

I think there's plenty of room for a new competitor to make money, but you can bet that any similar service is going to be just as bad for people's piracy and security. Nobody is going to collect and store that kind of data without either selling it or being forced to turn it over.

Personally I think this crime forum just democratized whatever unethical activity 23andme was probably doing anyway.

Not probably, they've certainly sold dna data

https://www.forbes.com/sites/nicolemartin1/2018/12/05/how-dn...

I mean, the people whose data was sold did consent, and doing this was always 23&Me's mission. With the exception that the results have been less than stellar, I've generally thought having large-scale genomics data from consenting patients to work on human health problems is a generally good idea.

So companies shouldn't allow users to use poor passwords?

Because it seemed harsh to me, maybe I don't care about them security of some data and so use a weak password; that's on me, surely?

As someone who reads hackernews and works on security systems, yes, absolutely. Run their passwords through haveibeenpwned and disallow anything that shows up.

Based on the feedback I hear from my non-tech friends and family, not allowing them to use their single password used for everything would be a good way to exclude those folks from using whatever service you're trying to sell them.

I was being argumentative there, I think the email-based auth is probably right for a site like this. Force complex passwords and people will often just do a reset every time anyway.

2FA is the standard these days for accessing PID. I can't think of data more sensitive or personal than your DNA.

Companies have legal (and moral) obligations to protect user data. Those obligations don't go away for users that don't personally care.

Perhaps not legally, but morally? I'll have a good chin-scratch on that one. Thanks for your comment.

Look at the leadership’s connection with google and this becomes easier to understand.

Then again we walk about touching things, leaving convenient DNA samples for anyone to collect throughout the day. It’s only because sequencing is relatively high cost at present that we have the illusion of privacy. Once we go in equivalent terms from mainframes to single board computers in the DNA world, then anyone can pretty much have at your personal genome.

Would love to see how the criminal forensic science guys adapt their narrative to this impending reality.

How would you mitigate a password reuse?

I also don't understand why more companies don't also implement reasonable rate-limiting and abuse detection. A suite of hacked accounts should not be able to scrape millions of users worth of data.

This doesn't sense, hackers don't have to use your intended API. They probably got access the the database directly.

According to the article this data was acquired by scraping data from a subset of compromised accounts.

There is no reason to not rate limit your user frontend. I have several pages with rate limits because of prior bot attacks and I regularly rate limit pages against bots with 'interesting data' for scraping

Man #2 reminds me a lot of the mechanism by which Cambridge Analytica exfiltrated so much Facebook data. I wonder if the 23andMe CEO will be dragged in front of congress for the next 10 years.

would it matter if they did? Who at facebook or Cambridge Analytica is behind bars right now because of what they did?

Its just a DNA based social network…

Where you get to waive privacy for all of your close relatives.

The issue is 23andMe is a honey pot. Thats fundamentally whats at play here.

What do you mean by honey pot?

I only know the meaning where it is a deliberate thing to attract bad actors. Is the entire company not meant to provide genetic information?

The entire Internet is a honey pot. You get something shiny, companies and governments get increasingly intrusive amounts of data about you.

A honey pot is just a place where sensitive and valuable information is centrally stored.

They can be unavoidable but need to be well protected. Most companies fail at this.

All it takes is one employee to pip install the wrong library or fall victim to a phishing attack or 3rd party vendor attack and its over. And on a long enough time scale, it happens.

GP is correct, you are using the term to mean something different from everyone before you:

https://en.wikipedia.org/wiki/Honeypot_%28computing%29

TL;DR: A honeypot is like a bait car in a police sting operation; It's something that looks like a vulnerable system with something of value to attackers, but in reality is a fake meant to catch intruders or collect data on them.

Using opt-in for features that worsen user privacy or security is gross behavior. It should be disqualifying for any company that handles sensitive information and they deserve all of the blame for the negative effects that follow. Trying to weasel out of that blame makes the company even more sleazy.

You'd prefer they be opt out so privacy is only available to the most attentive?

There is confusion about the terms “opt-in” and “opt-out” which companies have gladly exploited. See Google Fi recently with a disclosure stating that Google will “opt you in” to their customer data-selling policy.

I think we shouldn’t describe this as a confusion or ambiguity or anything like that. “Opt you in” is simply a nonsense phrase. Opting in means to proactively agree to something. It is impossible to be opted into something.

They are just lying, and you know they know they are doing something unethical, because they wouldn’t need to make up nonsense phrases otherwise.

23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah.

It sucks since I have zero trust that they would actually delete my data if I asked them too, and even if they do is that data still living somewhere fed into some model or research or whatever.

I hate to say that there is a part of me that kinda doesn't want to know if my data is a part of this, this just feels different than a credit card or some shopping data leaking.

Even worse since I have not gone to 23andme in a while, I feel like this was likely also before I cared about proper password security so it would not surprise me.

It doesn't really matter. The genetic matching models are so primitive that there's really not much of value in the data anyway. Facebook and Google have a far more accurate picture of what can be used to manipulate you. 23andme is little more than a curiosity.

My data is probably in this breach too, and I am not going to waste one second of my life on regret over it.

Stay tuned to find out if you get something from the class action lawsuit. Like the experion hack, you may at least get an interesting coffee table artifact when they mail you a pathetically small check.

The one issue is, unlike social data, you’ve not just given up your data, but you’ve condemned your entire future lineage to this leak. All their genetic information can be partially imputed from this info.

Maybe this doesn’t matter today but who knows what it’ll be valued at 50 years from now?

Don’t upload your saliva to the internet folks.

This is also my opinion: they stole a really poor social graph, that's all

Knowing who's related to who is a very useful social graph if your goals are unethical.

Or if your goals aren’t unethnical!

Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics.

You think terrorists need genetic data to find some Jews to target?? That's certainly not the low hanging fruit ... sounds like an urban myth to me.

Endogamy was also historically common in the Jewish diaspora before the Contemporary Period, so on average they will probably see a lot more distantly related people via 23andMe which creates an exponential increase in the amount of data scraped per user account.

You know, I hadn’t considered that as a consequence of endogamy! You’re totally right.

> Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics.

There are easier ways to find Jews...

They are? Source?

https://www.wired.com/story/23andme-credential-stuffing-data...

https://www.nbcnews.com/news/amp/rcna119324

https://www.washingtonpost.com/technology/2023/10/06/23andme...

https://www.jta.org/2023/10/13/health/23andme-sued-after-ash...

As cute as the implication I just read several of the articles and see no specific evidence about the terrorist groups, just the leak. I'll finish the last one but that's a weak association if I've ever seen one.

> 23andme is little more than a curiosity.

If you call criminal convictions "little more", sure.

Many people consider that a good thing, but I'm not talking about moral valence or vibes - the point is they are an industry supplier of PII that sends people to jail.

What a strange thing to say. If you committed a crime and the genetic information you gave to some company leaks, and someone is able to use that information to prove you're guilty, what sends you to jail is the fact that you committed that crime. The existence of this company and the leak enabled this particular way of proving you guilty, but you were still guilty, so you might have been successfully proven guilty by other means. But most importantly, you're guilty. You're going to jail because of your actions, and for no other reason. It's not like there's someone out there using this information to frame other people of crimes they didn't do.

What puts you in jail is the combination of laws and their enforcement mechanism. Having everyone’s DNA makes enforcement of any law (good or bad) a lot easier.

Your argument only makes sense if you believe you are innocent of all present and future crimes, which is an impossible fact to know by the very fact that you do not know the laws in the future.

>It's not like there's someone out there using this information to frame other people of crimes they didn't do.

pretty bold claim -- as with any additional justice element the innocent will be trampled to some degree.

Here's the thing : it doesn't just open up criminals for prosecution, it also opens up the 23andme population to an even larger arrangement of possibilities for self-incrimination and 'incorrect or misdirected pursuits of justice'.

It's nice that a well known murderer was found out, but the reality of the situation is that we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services. It looks bad on the law enforcement agencies and it looks bad for the corporation.

Or, you had some connection to the victim or scene of the crime and the presence of your DNA is treated as proof of your involvement, because juries are often swayed by technospeak and irrational arguments.

You must be quite certain your government will never break bad.

I'm a data hoarder and considered ordering my complete genetic sequence (not from 23, there are others that send you back an HDD with somewhere around several-gigs to 1tb+ of your genome). But I resisted because I would have no idea what to grep for. Without a biotech background it would simply be a waste of my time.

Every time you see an article about how some gene makes people like to eat potatos, or grow toenails really fast or something, you're about a minute of searching away from finding exactly what you need to grep for to see if you're a match.

What about this? https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t...

Seems like there is at least some value.

There's arguably societal benefit to the broader availability of DNA data but very little of that passes down to me personally and there are risks. I have very few close relatives but it's not hard to imagine the widespread use of this data by law enforcement would pull in some people with more extended families into investigations they'd rather not be involved in.

Sure , there are several big issues in compromised DNA profiles. See also: https://www.ecseq.com/blog/2019/privacy-implications-of-gene...

But let's wait until it's clear whether raw data was actually leaked.

Isn’t the raw data pretty much guaranteed to be leaked ?

I remember a few years ago there was a button to download raw data.

So if you can log in you can just download.

Doh! Didn't get the fuss over DNA data before but that scenario definitely makes it clear.

I was really curious too and did one of the major services, that's likely been hacked too by now.

But I registered under a false name, gave the test kit to my dad, and had him test one of my aunts too.

So it wasn't as exact but it was good enough to sate my curiosity.

Everything gets hacked sooner or later. A famous hacker once said that you should assume that everything you say or write will one day be public information.

Edit: And before anyone says "how could you do that to your father", if you knew him you'd understand. He's practically off grid and he's going to die soon, the aunt is already dead.

>that data still living somewhere fed into some model or research or whatever

Do you mean like for drug discovery and other medical research? Why would that be a bad thing?

On paper there is nothing bad with that.

But it still removes my ability to delete my data, especially when 23andMe has proven that they are not properly safeguarding this data.

Also me donating this data to a research organization vs being lured in by 23andMe's marketing are drastically different things.

Oh god, that's made me realise. Does a GDPR right to removal extend to LLM's that have been trained on your data? What probability of retrieval counts as still storing your data?

GDPR recital 26 covers your question.

Excerpt for the second part:

> To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

So they don’t call for an exact probability, but if you can prove you did appropriate threat modelling and put controls in place to counter those threats you should be fine. You are literally doing more than most companies if you manage that.

My understanding is you kind of don't even need to screw up on this one, just be related to some one who did and you're more or less in there anyway.

Wait, you didn't ask them to delete it? If you did the hacker probably wouldn't have your data.

Meh, it's just some stuff they extracted from your spit. I wouldn't get bent out of shape over it. Who knows, we might all get a decent payout from a settlement. You certainly won't regret when that happens.

It's also one of my biggest regrets, and I never did it.

My mom did.

She never asked me, or anything. But half my material is right there, in an irrevocable database, now leaked online for the world. And I have no genetic rights or any claim, even though half is explicitly mine.

Hang on can I understand your position? As I read it your (biological) mum took a swab of her own mouth and sent it to 23 and me. And you argue she should have asked your permission before doing so because she would be giving them half of your DNA?

Honestly I am not sure where I stand on that issue. Or rather it's probably to do with society wide regulation not individual rights ...

Should an identical twin be required to get their twin’s consent? That would be 100% of their DNA. What about their twin’s children?

No, and there's no moral ambiguity about it. Separate human, separate decisions.

It's an interesting issue.

If a stranger had asked OPs mom for OPs phone number out of the blue, there are many moms that wouldn't share a PHONE NUMBER without asking the phone number holders permission.

But fewer would ask their relatives if it's ok to stick a decent portion of their DNA into a database.

Wait till they find out that 99% of our genes already got leaked to the public by the Chimpanzees.

What if OP lives with their mom and so when the stranger asked mom for her number, she also revealed OP’s.

Should mom not be allowed to give out her number. She had it first. Or should mom need to clear every use of her data with her kids because it might affect them.

Should OP get mom’s permission before emitting genetic material on a lover because that material is half of mom’s dna?

I think this is not a path that can be exactly logiced out, so I stick with “do what you want with your data.”

We used to have this thing called a phone book! Imagine the dystopian horror!

There are also a lot of moms out there that would give up a phone number without hesitation if not even suggesting the person should have it without being asked.

And if their father also did it, 100% would be in there.

Except the data is randomized at conception

It was required of my sister to participate in 23andMe for an anthropology class of hers in college. I cringe now at what a violation that was. Even if she had the option to decline (which I am not sure she did), it's hard to say no to your professor when you're 19.

The ethics issues with that assignment would make for an interesting study all by itself.

I don’t know if holding a grudge against the naive parents of the world is productive, although I can understand the frustration.

Anger is better directed at legislators for not regulating these sorts of businesses under HIPPA and similar laws. Your mom’s medical records also contain a bunch of sensitive information about you and yet you probably don’t get mad each time she visits the doctor despite the privacy risk this incurs.

Treating 23andme like a lighthearted way to enhance your genealogy hobby or whatever is actually so fucking wild. This shit is not a game, only a SMALL fraction of the victims are 23andme’s customers. 23andme’s responses to me are proof enough the entire company should be shuttered because they are grossly negligent and don’t understand what business they are in or what they just did or how they fucked up.

The actual genetic data was not leaked. Why do people keep saying this?

Because nobody actually links to the leak proper. It ends up that people talk about writing about writings, rather than see what it is. And the prior post I did was auto-dead.. My guess is from the forum link. Cause we're not allowed to talk about breaches? Sheesh. (I edited enough stuff to review, but no direct links to leak documents.)

And digging around the breachforums DOT is/Thread-23andMe-Great-Britain-Originated-4M-Genetic-Dataset , you see stuff like

"The data includes information on all wealthy families serving Zionism. You can see the wealthiest people living in the US and Western Europe on this list."

This link combined with the 2nd one doesnt look good in any stretch of imagination. These are antisemitic leaks intended for harassment and/or hit lists. It definitely looks BAD. But again, it's already in the world now.

-------------------------

Here's the schema of said data ( breachforums DOT is/Thread-DNA-Data-of-Celebrities-1-million-Ashkenazi-REPOST ):

profile_id; account_id; first_name; last_name; sex; birth_year; has_health; ydna; mdna; current_location;region_1;region_2;region_3;region_4;region_5;subregion_1;subregion_2;subregion_3;subregion_4;subregion_5;population_id1;population_id2;population_id3

> 23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah.

I've had someone give one as a gift, so glad I didn't do it.

how has 23andme affected you in reality? (not hypothetically)

I discovered that I have the apoe4/4 gene, which not only explained why keto -despite helping me lose weight- threw my cholesterol to dangerous levels, but also explain some other important things about my family and genetics (some things that weren't even in the results, but they let you download the raw data of your genome so I did some bioinformatics). It helped me with changing my lifestyle and having a clear picture of what the focus on.

Even though I'm not a direct customer, it affected me: I now know I have tens or more half siblings throughout the US. It's mildly unsettling but I guess I'm happy that people were able to find my dad, who is also their dad.

Sperm donor. At some point in the future, I'm going to have an entire classroom of people figure out who I am based on suggestions of my relatives in their family tree. I deleted my data years ago, doesn't matter.

They have an option to destroy your data and the original sample you sent in

They could never get my DNA when i tried it. They sent out 2nd test kit that didn't work either. Would they have kept the samples?

Not that i really care, you're not going to find a password or my first pets name in my DNA.

Have you seen Blade Runner?

I’m one of the leaked. I’m highly technical, security literate. I use unique secure passwords for everything.

Fuck these guys. Fuck their bullshit misdirection.

This is the equivalent of corporate doxxing. Until individual execs in these mega-corps that piss in the face of their users bear individual consequence for this type of thing it’ll keep happening.

Because until then there’s no requirement to actually really give a shit. We’re grist in the money mill.

The lack of consequence has me seething more than the breach.

> Edit: the victim shaming in comments here is staggering.

23andMe is trying to have us believe that multiple tens of thousands of their customers were hacked in a credential stuffing attack. With 1500 matches per person, assuming no overlapping relatives, you'd need somewhere around 10,000 successfully hacked accounts to get the amount of data they have (~14 million). In reality, many people have overlapping relatives with other people, so many more than 10,000 accounts would have needed to be attacked, all without 23andMe noticing anything suspicious. This seems very unlikely to me.

And while 23andMe claims that a credential stuffing attack was at the root cause of this leak, the hacker(s) who first posted about this leak on Hydra Market over 2 months ago claim that they simply used (abused?) an API that 23andMe offered to their academic and research collaborators.

The hacker(s) claimed to have 300TB of data, including raw data, but have not proven that the scope of the attack was that large. But if their claim is true, then the breach was definitely not due to a credential stuffing attack, but fits well with the hacker(s) claim of using an API.

So, if the extent is as claimed by the attacker(s), then it is much more likely that one of 23andMe's API was used to scrape everyone's data, not a credential stuffing attack. Either one of their collaborating researchers got hacked, or they had (have!?) an access control vulnerability in their API which allowed the attacker to again scrape everyone's data.

I cannot find much information about the API 23andMe offers, but I did find one on RapidAPI (https://rapidapi.com/23andme/api/23andme), and indeed if there was some sort of access control vulnerability or some sort of hack of an escalated user then with even 1 individual as a starting point, they could download the data using various endpoints (there's even an endpoint for the entire individual's genome...) and then get the relatives of that individual (an endpoint for that too) and then recursively do the same for all relatives until every person has been downloaded once.

At this point in time, I am highly suspicious of 23andMe's defense but until the attacker releases proof that they have raw data we can't really prove that they're wrong/lying about the actual magnitude of the attack. But I do believe their claim of using an API makes a lot more sense than the way 23andMe proposed, so I am very worried.

> and then get the relatives of that individual

so you're saying they used a genetic algorithm ? sorry, couldn't resist.

What's crazy is that onlyfans content creators get so much slack for sending out video and audio of their phenotype.

23andMe grabs a person by the source code and somehow that isn't considered obscene.

You shared your DNA data on the internet, time to review your security fundamentals.

You can get my entire DNA data, https://my.pgp-hms.org/profile/hu80855C I can assure you I know more than a little about security, considered all the reasonable risks, and concluded that it's not really increasing my risk and is unlikely to do so any time in the future.

If that's really you, I give you a lot of credit for being bold. You and the CEO of LifeLock both. Hopefully your confidence doesn't blow up in your face the way his did, but when/if it does, you'll probably never know why it's happening to you exactly. The easier it is to link that data to your identity the riskier it'd be. I haven't seen the 23andme data, but if it includes names, addresses, email addresses, family members, etc they're going to be a lot worse off than you likely are.

My real name is David Konerding, so the linkage now is trivial. Again, I've evaluated the risk profile associated with my genome data and concluded that it's effectively non-existent, and will continue to be so.

My data isn't 23andme- it's a whole genome. 23andme's data collection is very limited, and in my experience, fairly optimistic about its predictive ability for health.

Hah, nice, my data is here: https://globatic.blogspot.com/2013/10/the-23andme-full-and-r...

Even if you didn't they'll likely have a relatives data.

True, but we should be responsible for ourselves to start with.

I do not understand why anyone with tech knowledge would have participated in this honeypot. Please help me understand why there was trust.

Please help me understand what negative consequence I am likely to experience because of this. Not something conceptual like "you don't have privacy!" - be specific.

People of Ashkenazi jewish descent might have a more tangible grasp on the negative downsides of this leak.

So you're saying - someone in the US is going to discover my ancestry and... do what? You can find far more inflammatory things about me online. Besides, if someone really wants to attack Jews, it would be a lot easier to find the address of their local synagogue. Or search the phone book for obvious last names.

There are a lot of lessons to learn from the 20th century, but I don't think "you have to hide your ancestry" is one of them.

Because I don't care about privacy and I wanted my DNA tested, duh.

I don't understand privacy nuts.

is the essence of the privacy concern that data showing predisposition for diseases (or whatever sort of weakness) can be dystopia-used to discriminate (insurance, etc)? Or just privacy in general?

How about creating a virus to give a disease to everyone of a specific race

That's science fiction. No matter what you read in the popular press or scientific journals, engineering a virus specific enough to perfectly target a group of people sharing a common genetic history with perfect specificity and sensitivity, is still not something we could do. I also don't see this as being technically possible for some time.

Assuming that technology even exists, you wouldn't need 23andMe to get the relevant genetic data.

you'd have to define "race" but the idea seems legit considering crispr-cas9

Because I needed to know whether I had genetic health issues. I assume you use a smart phone. If so, you've already given up your privacy. You're like the people that scream about someone having Alexa in their house while simultaneously carrying Siri everywhere in your pocket.

What exactly is someone going to do with my DNA? Any entity that's a threat to use it for something nefarious is going to get it from me pretty easily. They could grab any number of physical items that I've touched or left my hair on etc.

Should they do a better job of protecting the data? Yes. Am I going to freak out over something that will likely not affect my life in any way? Nope.

Privacy nuts are always going overboard about things that mean very little.

Genetic data sounds important but in the bigger scheme of things, it's probably the least manipulatable data about a person on the internet.

My genetic data is less weaponizable than if I uploaded hundreds of pictures of myself and my shared my social graph to Facebook, if I shared my political opinions on Twitter, if I commented/posted on Reddit boards of my interests and hobbies. It's also less weaponizable than the multitude of "invisible" data that I feed to Google, my incompetent local government, service providers, every shop that is shipping something to my home address.

I lose genetic data everywhere I go, every day. 50-100 hairs fall of my head, and I leave fingerprints on everything I touch. I "lose privacy" every day by walking into somebody else's photo/video/TikTok, and by mishandling of it by poor government/business entities.

Life's too short.

Did you use a fake name and a prepaid debit card to make your purchase? Well I’m glad I did though they can just track me based on relatives that also use the platform if they really wanted to.

How are you verifying you were in the leak?

>Until individual execs in these mega-corps that piss in the face of their users bear individual consequence for this type of thing it’ll keep happening.

No, Until individuals stop using these mega-corps that piss in the face of their users and also bear individual consequence for this type of thing it’ll keep happening.

How do you know? Where can you check?

I would also like to know.

The email I received from them said "If we learn that your data has been accessed without your authorization, we will contact you separately with more information." So I guess receiving such an email is how you know at this point.

I did 23andme and although I'm not happy about this, I admit I'm growing numb to all the leaks of information, and I kind of went into it with the assumption that it might be leaked at some point.

https://www.nih.gov/news-events/news-releases/nih-s-all-us-r...

https://www.nytimes.com/2013/06/18/science/poking-holes-in-t...

As you can surmise from those, the issues about DNA sharing are more general than 23andme, or even private companies.

I mean, therapy notes have been leaked, and hospitals have had medical records compromised.

I do genetics research and although 23andme does have sensitive information, the level of information they have is relatively low. People with certain polymorphisms might be at risk but most of it is pretty crude, and I suspect many of the people affected might know through nongenetic ways that they were at risk anyway. I think the genetics revolution people were predicting doesn't exist, or to the extent it does, it will require something different than what 23andme has.

Google or Apple has more damning and accurate information about someone than 23andme. If 23andme or anyone else had some mind-blowing insights into you personally based on your genes, they'd certainly sell that to people and they don't. Most of their selling points are in genealogy and things like that.

I don't mean to sound dismissive, this sucks and 23andme could/should have done things differently. It's just I think as a society we need something other than "live as a technohermit" or "implement such strict security you're at risk of shutting yourself out" and "become a permanent victim of darknet hackers and authoritarian tyrants". I also think people overestimate the information value of the genetic information 23andme has. Yes, it's significant, but it's really at this point limited to what they offer. There's no would-be 8yo serial killers out there that, if we only had 23andme information, would be able to "prevent" them from killing in some real-life version of Minority Report crossed with Gattaca. Maybe someday, with different information, but not now.

"23andMe blamed the incident on customers reusing passwords"

I'm not sure how they worded this but it's their shortcoming, not their customers. Customers reuse passwords and will continue to do so. For sensitive PII it's far easier to enforce 2FA or Google SSO than to change customer behaviour.

Eh, millions of accounts hacked via credential stuffing on one platform because of reused passwords? I don't buy it for one second.

It wasn't millions of accounts, it was an undefined number relying on scraping dna relatives after the breach. This article mentioned it, but last week I saw a better more detailed explanation.

Regardless, the key quote from the linked article:

"23andMe blamed the incident on its customers for reusing passwords, and an opt-in feature called DNA Relatives, which allows users to see the data of other opted-in users whose genetic data matches theirs. If a user had this feature turned on, in theory it would allow hackers to scrape data on more than one user by breaking into a single user’s account."

And even if it is true, that is still the fault of 23andMe. It is kind of a fool me once scenario. Some occasional password stuffing is excusable and can be blamed on users' laziness. Millions of accounts hijacked through password stuffing and something is fundamentally wrong with 23andMe's approach to security for not identifying such a large scale attack.

100%

Related: what fool decided to call compromised credentials "stuffing"? Nothing is being stuffed.

You take all the breach dumps you can find and "stuff" the username/password pairs into other sites.

Credential stuffing is a specific type of attack which uses compromised credentials.

Not all compromised credentials are used in credential stuffing attacks.

Agreed. They could have done email link verification which wouldn't require the user to set up 2FA on their side.

Or provided their users with randomly generated, secure passwords themselves

I saw this idea somewhere on here a few months ago, and since then, granting users the ability to set their own passwords seems like a dumb thing to do!

Depends on what you’re trying to protect against and who your average user is.

Forcing passwords onto users is a sure fire way to get people to write their passwords down and constantly get locked out of their account. In some circumstances that’s not a problem. For local domain access, that’s completely unworkable. For websites it makes a little more sense since users can use password reset via email, but if you’re going to expect people to rely on that then you might as well allow them to set a password and use email as 2FA.

There was a time when random passwords seemed like a bad thing, because users would write them down, and that was an obvious risk. We are way past that of course, but that line of thinking is still informing security decisions.

They do have it but they probably have millions of accounts that were created before that feature and never logged back in and set it up. It's also through an auth app and not texts which is more secure but more of a hassle for not allowing users which might affect adoption.

It is very inexpensive to check your customer passwords against HIBP [1] or strongly encourage MFA. They choose not to.

[1] https://haveibeenpwned.com/API/Key

(23andme customer using Apple SSO, have strong opinions on customer IAM, passwords must die)

Doesn't that require you to know the password in plaintext?

Depending on your use case and implementation details, not necessarily.

https://www.troyhunt.com/understanding-have-i-been-pwneds-us...

.. can't those old accounts be flagged to require email verification to log in ?

Most old accounts would probably never try to log in again anyway. After you learn that you're 3/64-ths Irish you've gotten what you wanted, why log in again?

Yeah I know there's the whole genetic disorder screening thing which might receive more updates in the future, but I think most of their customers probably did this for the novelty of knowing where they came from.

Oh, you lost your email account access? Please send a matching DNA sample and $99 to unlock your account.

I mean, 23andme has one of the ultimate methods of account recovery available to it. (ignoring that people tend to leave copies of their DNA everywhere, but then you could just mail that in under a John Doe and find out all the same info anyway).

Whatever way you put this, handling the support load of the few customers who can't log in - and by this argument aren't ever logging in anyway - is better than having this degree of PII leaked and the company reputation ruined.

It could be easier and cheaper for some to get someone's hair or saliva than cloning a SIM card...

The Facebook way...sign up with email, get instantly restricted, need to verify with a mobile number to unlock.

> created before that feature

Which feature? Unless they didn't ask their user's email (which I'd find surprising), they could have added e-mail based TFA any day without asking their users to do anything.

They failed to enforce MFA.

Exfiltrating 300TB of customer data without 23andMe noticing seems like negligence. Shouldn't there have been some alarms?

“Hey Bob— why is our AWS bill so high this month… oh shit”

You joke but one of many organizations weakest points is lack of prompt alerting. I think the FBI recently put out a list of weakest points and this was maybe number 4 or 5 on the list. I’ll do some googling and see if I can find it.

This is a forum of engineers and builders - if a lot of data were being exfiltrated from your cloud accounts right now, would you know? What would your response plan look like? Maybe this could be a good way for all orgs to review those practices and make sure they have a plan.

we've caught a few "oops I almost spent a million dollars" through cost alerting on AWS. Unfortunately, the time resolution for billing isn't great. I will say, much to my surprise, AWS comped us for the money we wasted even when it was our own fault.

I think if you're likely to not notice spending a million bucks right away, you're the kind of firm amazon wants to hang on to.

Lol. "Hey Bob - why are we in the news for a breach?" Seems closer given the news reporting and their tardy response.

if its not cred stuffing, a few GB per day per IP to defeat volume anomalies. you would hope 23andme would have detection/controls on customer storage to flag new geo locations since there is no way they spoofed each customer's destination. or an authorization flow to even access the data with an audit trail/approval flow for god accounts.

Wow, blaming paying customers for their inability to secure their systems. You cannot control users, but you can control your security posture. 23andme's management can fuck right off with their bad attitude and poor judgement.

The attitude that oozes out of these reactions is not that they are sorry that the data was leaked, but that they are sorry they can no longer profit from it.

23AndMe's product is their user's DNA, packaged nicely in easy to digest formats.

They aren't sorry they can't profit from it, they will continue to profit from it anyway. One of their membership tiers includes an annual payment so you can get the newest easily digestible thing with your data.

Shame on them for slacking off on security when bad actors could do actual dangerous things with that DNA data.

If they couldn’t detect millions of records stolen from credential stuffing I don’t think that makes them look any better. But Ill die before i see a company take ownership for their actions im sure so it’s no surprise

23andMe came out when I was in high school, and one of my science teachers spent an entire class period telling us how bad an idea it would be to ever use their service. Probably the most valuable lecture I ever had tbh, I've never even considered going near it as a result.

Makes me think that "data privacy" should be added into schools' mandatory health class requirements or something. Though most likely any prescribed curriculum would have been lobbied to death & not actually teach valuable information.

Why is the lecture so valuable? Why was another commenters biggest regret using 23andme? (Talk about first world problems).

What is private about dna?

Nothing, you abandon many viable samples of it wherever you go.

This relates to the biggest problem with biometrics: it represents an effectively static attribute about an individual. It cannot be reset and therefore we place this enormous responsibility on the reading mechanism and pipeline to the authentication process to attest that the human using it is doing so with consent.

Recent and related:

23andMe Sued over Hack of Genetic Data Affecting Thousands - https://news.ycombinator.com/item?id=37895586 - Oct 2023 (20 comments)

Who hacked 23andMe for our DNA – and why? - https://news.ycombinator.com/item?id=37886543 - Oct 2023 (3 comments)

23andMe Accounts Hijacked and Data Put Up for Sale on Hacker Forum - https://news.ycombinator.com/item?id=37810755 - Oct 2023 (2 comments)

>The type of information genetic-testing companies collect is currently not protected by the Health Insurance Portability and Accountability Act (HIPAA), our nation’s health privacy law.

Nice work by the genetic testing industry lobbyists.

If physical DNA were PHI, then everywhere we deposit DNA would need to have the same security as your doctor's office.

But the data revealed in analyzing the DNA (e.g. if you have a genetic disorder) should be PHI.

It's odd how something could go from "not PHI" to "now this is PHI" just by processing something like a piece of hair.

"At what point does it turn into PHI" would be a difficult question to answer.

IMO protection of DNA related data deserves something different than HIPAA.

I might be wrong, but I don't think a genetic sequencer is something that's easy to build in your garage without anyone knowing. So if loose hair is not PHI but the information that the owner of that hair has or not a genetic disorder is PHI, we could say that the PHI starts once the genome of a human is sequenced from a tissue sample. So, yes, anyone who has a genetic sequencer must have the same level of security as a doctor's office. That doesn't seem like a terrible requirement.

it's not impossible to do DNA sequencing in your garage- either by buying a sequencer on ebay, or implementing your own. However, most of the data you'd generate wouldn't be that useful, instead, I think you could make a spotted microarray, which was one of the early examples of DIY process automation in biology (around 2000), that could be turned to nefarious uses with much less time and capital.

Do you have a reference for this? Was it ever actually considered? Or are you just making things up?

https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-g...

>“We plan to engage constructively with policymakers on the best enforcement regime,” Haro said, reiterating that the coalition wants “a uniform national data privacy law” that treats all companies the same.

HIPAA applies to health care providers and health insurance companies. If you give some other type of entity your PHI they are not beholden to HIPAA. You said that this wasn't part of HIPAA specifically because of lobbying. You haven't provided anything that says that anyone was even considering expanding HIPAA to cover other entities. 23&Me wasn't even around to lobby when HIPAA was penned.

From the same article, 23&me is lucky they are not covered under HIPPA...

>The federal Health Insurance Portability and Accountability Act, a.k.a. HIPAA, includes penalties ranging from $100 to $50,000 per violation — that is, per hacked record. Violations also can carry criminal charges resulting in jail time.

The laws and regulations around genetic information seem to be (intentionally?) easy to misread.

Health and Human Services has a FAQ page[1] which states:

> genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse.

However, according to many other sources[2][3], the interpretation of these rules DOES NOT apply to companies like 23&Me. I assume the company is not considered "a covered health care provider, health plan, or health care clearinghouse", but (again) the HHS definitions are (intentionally?) vague/misleading[4].

I suppose you need to be very familiar with regulatory law to actually make sense of this junk. (I don't know the history of these regulations and carve-outs, but the tin-foil-hat part of me wants to blame lobbyists/legal-corruption for the lack of common-sense and simply worded regulations.)

[1] https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hip...

[2] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/

[3] https://lawforbusiness.usc.edu/direct-to-consumer-generic-te...

[4] https://www.hhs.gov/hipaa/for-professionals/covered-entities...

I think the problem is that HIPAA is less strict than the zeitgeist believes. Makes perfect sense since your family doctor will have you sign an acknowledgement yearly. The reality is that health data is for sale from all kinds of vendors including pharmacies. As long as it’s “not identifiable” it’s fair game. My work health plan uses a separate “pharmacy benefit manager” to end run around the restrictions on what it can do with that data.

I used a fake name and one-off email address when submitting my results in anticipation of exactly this scenario.

That would make it a bit harder to link to you, but definitely not impossible. It would definitely have been better to not do it at all.

Wow, such a bad security combo: 1- Not enforcing 2fa for new accounts and migrating old ones to app 2fa on login + requiring mail code enter before that to create a temporary weaker 2fa, this way some users will spot the problem and click that they're hacked 2- lack of data encryption for servind data to client(so that 23me has full access to unencrypted db on isolated servers, but users will need to enter some additional password 3- not checking against existing pwned dbases and autoreset the password 4- better control for sharing dna data for ppl discovery. Why on earth they provide 1.5k matches, they could limit to 100 closest ones for example and provide 1.5k for additional pay

For such a company that handles this data, I would have expected much harder security measures

Wouldn't it be better (for users, not for profitability) if such companies would delete the data after analysis?

DNA analysis is very important, and probably, should be mandatory for everyone planning to have children (to reduce the number of people with incurable or very expensive to treat diseases and save healthcare budget), but with current level of privacy protection the data will just leak around. Also, when DNA screening will become mandatory, government will probably require that it gets a copy of everybody's DNA. Looks like this war is already lost.

The raw data wasn't leaked, and the data changes over time when other users join. Many people expect this.

23&Me allows you to delete your data and your account if you no longer want to participate.

Do we need to submit a new story to HN covering that the raw genetic data wasn't leaked? Everyone is screaming that sky is falling and ignoring the facts

Eh, for some people the sky is falling. For instance, the original hacker was specifically offering profiles of Ashkenazi Jew, which included full name and location information. I understand how that could be scary in the hands of the wrong people.

Yeah but you could do that by hacking any social media platform and scraping real names and locations to very accurately identify Jews

Yea, that's true - but has little to do with the fact it's a genetic data site. A family tree site with private profiles would have the exact same risk.

The fact that the genetic data isn't involved means this story isn't relevant to people panicking about sharing their genetic data with 23&me.

Don't forget to change your DNA.

pretty much everyone has already done so?

https://en.wikipedia.org/wiki/Retrovirus

I refused to try this service for years despite having friends suggest it to me over and over. At best they were going to sell your data to insurance companies and governments. At worst, criminals would end up with it. Why anyone would trust a private "viral" company like this with their DNA is beyond me. Best of all, you paid to give it to them.

Probably also because sign up for the product is done through their app rather then a browser where people have password managers handy.

Of the three leak files released so far there are 5,150,779 unique entries (I wanted to check if I was in them, so far I'm not).

Where are you checking?

The leaked files; don't want to link here directly but I think they're all still available at the source

How is this company still in business following this? Personal “genomics” should be treated like the most sensitive type of data out there. Failing to secure it means you are not suitable to carry such tests.

I have already been advising people to be cautious about such online services, or to use fake personal details where possible. I will now advise even harder.

They are in business because people voluntarily pay them. This is what people want, so the market provides it. Many people do not care about preventive privacy.

how to find out if you are affected? 23andme is one of my biggest regrets. I did it when i was 22 and kind of an idiot lol.

Thank you auntie Janice for leaking my genomic data. I'm sure the health insurance companies will love you.

If you live in the US, the Genetic Information Nondiscrimination Act prohibits health insurers from using the data.

I have trust in their ability to find loopholes in the act.

Don't say you weren't warned:

https://jacquesmattheij.com/your-genetic-information-is-not-...

I was mildly curious and thought maybe I should try it, but the more I thought if I really trust this company. I've seen how companies treat their customers' data and imagined that being my genetic data, and it just didn't seem like a good idea.

Then there is the point of what if I found I have some genetic disease and there is not much I can do about it. Not sure living with that knowledge would be better.

It's upsides if something treatable is discovered early, otherwise it is mostly downsides and not just for yourself. Assuming you can trust their analysis in the first place.

What I really don't like about these companies is that they are never transparent, you only find out after the fact what you bought into.

This is a social network that was leaked. I would be somewhat surprised if the same attack didn't also get quite a few of someone's "friend network" on Facebook and the like. Certainly was more likely in the past, but with some of the modern botnets, I have little faith some of my elderly family haven't been hacked in this way.

To that end, I'm curious on how they could have protected this better? Almost certainly doable, but I don't know of many ways you can protect people that are on my contact list from getting leaked if my contact list is leaked. Which is essentially what this is.

Always been a bit curious about 23 and me. But also I'm northwest european so paying money and giving out my data just to find out "100% British isles" or similar did not sound that interesting. Glad I obstained!

I guess the fun part was finding out your real great-grandfather was a Portuguese sailor on a visit to the port of Bristol (or whatever).

This DNA relatives feature begs the question.

How easy is it to submit random DNA (cow, cat, dog, chicken, etc. or even fake?) and get yourself enrolled in their system to then legitimately have access to the next 1500+ "relatives?".

Given a few grand to spend on testing kits I reckon you could get the same results stuffing this DNA, as this "golem" guy did by credential stuffing.

23AndMe made the classic mistake to assume that biometrics are a type of authentication and allowed anyone to access the records of 1500 other people just by submitting some DNA....

> How easy is it to submit random DNA (cow, cat, dog, chicken, etc. or even fake?) and get yourself enrolled in their system to then legitimately have access to the next 1500+ "relatives?".

You really must not fundamentally understand how this works. You are matched to people who also took a 23&me test and share DNA with you. The amount shared is how they infer relations.

There are people who do not even have 1500 matches, submitting a sample of animal DNA will quickly result in sequencing failure as the test is based upon the human genome and is effectively “written in the hardware”.

Fabricating a DNA is extraordinarily difficult because you need hundreds of cells with genetic material in order to even produce results. It would be so much easier to steal a sample from a known relative than it would be to genetically engineer some cells.

As supportive of open source as I am, I had no desire to be open sourced.

Your clones are licensed as Creative Commons

Millions of users reuse passwords. This is nuts. Who are these people?

Most of the world. People that don’t use HN or work in tech.

More importantly how was one person able to log in and download all that data without any alarms going off

This. Every one of these attacks I've worked were loud due to the volume of logins and ratio of failures.

maybe they all share the same password-reuse gene?

this made me spit out my morning coffee. ugh.

I am a data engineer at a fortune 50 company, I do. It's infuriating that I'm expected to have a unique alphanumeric key to every single thing I use on a computer. That would be 100's of keys. It's nuts people think we should have unique passwords for everything.

Have you already been introduced to such concept as password managers?

Yeah, let me just put ALL of my passwords in ONE location. Like that is any better than reusing a password.

Then you are relying on that password manager, what if you lose access to it or the data with your keys? Welp...

> any better than reusing a password

It is. That way you only trust your password manager and not every single app you use (that can easily dump your password when you login, or might even store it as plaintext).

If a password manager is open source and you know how to audit it, you could do that. Otherwise you can ask somebody you trust who knows better.

> what if you lose access to it or the data with your keys

That is a possibility indeed. You should make backups, of course.

> what if you lose access to it

We’ve been working very hard on this problem, and recently devised a scheme known as backups. It’s like a whole copy of your data someplace elsewhere!

Snark aside; popular password managers have extensive recovery and replication capabilities.

> Yeah, let me just put ALL of my passwords in ONE location.

By reusing a password, you're basically doing this already.

This is bait

Like LastPass, for instance. /s

Imagine I was one of those people that their DNA got leaked. How would that could/would/will affect me?

And please, don't say "insurance companies would love that data!".

You'll get to experience the bottom percentile of Hacker News posting endlessly about how getting a cheap genetic test in the mid-2010s was obviously something only a total moron would do, and occasionally slipping in an "insurance companies would love that data!" (I'm not saying it, use-mention distinction) alongside it.

Your raw data hasn't leaked unless it was your account in particular that got used, but you could be put on some guy's "Jew list", which you may or may not care about.

It turns out those that like the idea of giving your DNA to VC's then you are also highly likely to reuse your one true password (password123) on multiple sites.

lol, the other obvious explanation is that 23andMe is simply lying about the cause of the leak.

Lying about it would expose them to a lot of legal trouble. Im guessing they are choosing their words carefully as they have likely been worried about being sued from day one.

Sometimes I think for a microsecond that doing a DNA test would be interesting and then I remember that breaches are inevitable and never do any.

I've been considering creating a distributed sort of human health monitoring/experiment project.

One of the questions is "should I also add my DNA" in there.

And if my DNA has been leaked then it wouldn't matter unless this leak is anonymous.

With that in mind I wonder if you could use this data to sort of populate this project. I also wonder if that would be legal or not.

This company definitely deserves a dooming Netflix documentary with lots of visuals of DNA and network-like structures.

Once precision medicine allows to create viruses tailored to kill or disable single individuals, the world is going to be a very very dark place.

I don't think it's a surprise that COVID normalised it for people to hand over their genetic material to anyone (swabs) without any option for refusal (no test? no live).

I suspect that in the future, regulation of online things will lower the profits available to websites like this.

They should have to pay a shit load of insurance if dealing in this type of business with lots of personal data.

And the mistakes for making this type of mistake should be monumental.

> pay a shit load of insurance if dealing in this type of business with lots of personal data

Chubb's and AXA have been offering this for a couple years now and I know some large companies have taken out a policy.

The issue I've heard is the large providers rarely pays out as the pools are small and the risk profile for breach insurance is still actively being worked on so the exposure is potentially massive, so a lot of companies are forgoing Cyber Liability insurance.

There needs to be active regulatory work to solve this chicken-and-egg situation

“Pandora opened a jar left in her care containing sickness, death and many other unspecified evils which were then released into the world. Though she hastened to close the container, only one thing was left behind – usually translated as Hope.”

It's time to normalize services generating random passwords for users. Literally a password field with a "Reroll" button.

Users shouldn't have to dick around with a more complicated 2FA system just to protect themselves from password reuse.

As a security novice, I do wonder if this is more secure overall. It means users will increasingly either use password management tools or they will write it down, digitally and/or physically. So, it defeats password reuse, but the downsides are:

1. Makes it easier for users to lose passwords

2. Makes the user more susceptible to targeted hacking

3. Increases the number of passwords in note-taking services which may themselves be hacked

Edit:

Also, until a critical threshold is met of adoption among services, some users will just re-use the random password for other services.

A lot of this is mitigated by making the password non-human-friendly, essentially forcing users to use password management tools. That could be too much to put on users, until those tools become much more ubiquitous/effortless for the average computer illiterate user (basically the same point you're making about 2FA).

Sure, but all of that is preferable to someone getting pwned across all of their accounts for one of their accounts getting leaked.

Though I don't necessarily grant your points. Password reuse means you're susceptible to nontargeted attacks which is strictly worse than your concerns, like #2.

i.e. Filtering out weaker attacks doesn't mean you're more susceptible to stronger attacks.

I do agree in that I think individual-targeting attacks are essentially outside the scope of this topic, since you're fucked for a lot more reasons in that scenario, and it's very rare, relatively speaking. I was just listing it to be thorough.

This is the way, I don’t know any of my passwords bar my master password for my password manager.

Or you could just use an actual auth provider that does this stuff right.

How easy/legal is it to obtain breached passwords for legitimate purposes?

If I see a user try to sign up with an email + password in the breach list, I'd like to tell them to pick a different password, for instance.

Check out the https://haveibeenpwned.com API.

There is haveibeenpwned as mentioned, but you could also just use a password list of common passwords and ban those completely. It would stop more attacks, like standard password guessing attacks.

Are there any privacy safe companies out there that provides similar services? I’m interested in the ancestry and health aspects of 23andMe, but I obviously don’t trust the company.

What exact data was leaked? I have an account there but chose not to find potential relatives, which means, according to the article, I wouldn’t be part of the scraping.

I found I have about 10+ brothers and sisters through 23andme. I knew the risk when I signed up and assumed something like this would have happened sadly.

Hey, I found this out too. But I never did 23andme- my dad did, and he was the sperm donor.

I, too, found this out about myself, but on AncestryDNA originally. I did find a previously unknown cousin my the other side of family thanks to 23&me.

It’s a shame because the relative matching is a really fantastic tool and has been able to connect a lot of people who would otherwise not have met.

I don't understand any comments which defend 23andMe. Personal data was leaked on their watch, it's unacceptable, end of story.

That’s what you get for sharing the most precious IP you own to a company that incriminates the relatives of customers.

The most precious IP you own, which you drop in the form of 50-100 fallen hairs every day, and is smeared on everything you touch.

People submit more weaponizable (behavioural) data to Facebook, Google and HN every day.

https://archive.ph/vDb9J

It would be hard to do something worse with this data than what 23andMe would be happy to do themselves for profit

My genome is in All of Us. I don’t think this is such a big deal to have your genome out in the public.

I’d be interested to know to what extent password reuse is genetically determined…

That company absolutely needs to fire their ciso, and likely their full c suite.

Has this landed on HIBP yet?

We'll need a new site for it: Have I Been Cloned

Hope this company burns to the ground. Glad I never used this trash.

Absolutely uninsureable for all genetic curses for generations to come..

I am not sure if companies like this should be illegal or heavily regulated. Where I live (in France) recreational DNA testing is illegal since 1994.

But also, if they were legal, with the GDPR they would have to obey much stricter rules about the data they collect.

if 23andMe knows this is happening, they should probably reset everyone's passwords...

Can those affected sue 23andMe?

Reply on news.ycombinator.com