Hacker News Reader

Comment by op00to | Hacker News Reader

Forced 2 factor authentication for critical biometric data.

Why should someone who is able to choose a strong, distinct password for each service (and keep it safe) be forced into an additional inconvenience.

I think this is a more broad issue, how do you give the same service for all users, regardless of their level of experience.

Because I have no way to verify that you never reused or leaked your own password anywhere. And because your genetic data isn’t just your own. It is shared by your kids, your parents, your extended family.

I’ve never used 23andMe and yet I’m involved in this breach. How is that a fair shake?

“I’ve never used 23andMe and yet I’m involved in this breach.”

How were you notified? I’ve never used the service but wondered what shadow profiles they may hold.

If you have any blood relatives who signed up with 23andMe then you are automatically involved, even if you've never heard of 23andMe.

How would you do this for historical accounts? 2FA needs to be set up by users. It has gone through multiple iterations over the past 2 decades and was not always standard practice. 23andme was founded in 2006.

Force them to change their password, prevent use of the account? If it’s a dormant account, force a password reset using email?

Doesn’t feel like an unsolvable problem, certainly not one without edge cases but surely we can hit 80/20 without too big a hassle.

The thing is, attackers don't need 20%. The article says they used 14k accounts with previously cracked passwords to uncover data of 7 million customers: that's 0.2%

Doing low-hanging fruit isn't enough here. Honestly I just don't feel like the time is right to build such big DNA databases yet. Maybe one day with quantum encryption (can't observe the state without modifying it) or whatever else we may figure out, but today it just seems like you're taking a risk for yourself and half a dozen layers of relatives

You show popup "are you hacker?". If somebody lies, it's not your problem, right?

I’ve had sites that do forced password resets and other annoying things when I come back after years.

23andme bears responsibility more than users like banks bear more responsibility for customers choosing stupid pins. DNA info is valuable they need to design good safeguards.

Yahoo for one: I didn't mind.

Send out increasingly loud notices ahead of time, and try to come up with a secure recovery procedure for the many customers who will fail to react to them. It's not going to be cheap. But losing some kinds of data should be even more expensive.

1. Disable the account from further access.

2. Send a postcard to the billing address where you signed up (verified against credit reports) with a one time verification code, upon which some second factor is set up. Maybe put 20 "rescue codes" on the postcard too, if you like.

3. Force user to enable some sort of second factor authentication on their next login.

Imagine a service you paid for locking your account and sent a postcard to an address you haven't lived at in a decade. What a great user experience!

if you paid for a service, the onus is on you to keep your information updated with that service.

Do you actually update all your address in every service the moment you move?

Ones I care about, yes.

We don't have satisfactory 2fa solutions for consumers yet.

Sure we do. Mail a postcard with codes. Problem solved.

We have different bars for satisfactory.

How critical is this data, really? What could an attacker really do with my genetic profile?

The genetic data could be sold to a third-party that exists outside of any regulations. 23andme allows download of raw data. So its not just genetic profile.

Assume everyone breached now has their dna linked forever with their marketing data graph.

It will be sold and resold so eventually your TikTok feed will be influenced by your genes.

Tiktok know what videos you have watched and liked which is all the targeting data they ever need. They don't need or want your genetics. And even if they did, better Tiktok targeting isn't something that would make me worry enough to not make my password "abcdef".

Advertisers need your dna to sell products that are applicable only to certain dna. Or for higher probability (ie, Alzheimer’s genes).

1. Find relatives you didn't know you had and inform them of the fact, perhaps destroying families by revealing long-concealed/previously unknown secrets

2. Identify DNA sequences and genes associated with various diseases, then contact you AND your relatives to advise seeing a doctor and consider using drugs made by the new owners of your genetic data

3. Sell your data to insurance companies who would pay plenty for early evidence of breast cancer likelihood or Huntington's Disease so they can avoid insuring you

Thinking that large companies are going to buy black market genetic data and deny your insurance is completely unhinged. Not only would they never do it because they would instantly get caught and sued into oblivion, the health insurance industry is actually incentivized against cutting medical costs because of the statutory maximum of 20% gross profit on premiums in the ACA.

>Private equity wants to own your DNA

https://www.cbsnews.com/news/blackstone-private-equity-ances...

This is an acquisition of a company and has nothing in common with a data breach or purchasing stolen data on the black market.

>Theoretically your insurance companies or employers won’t be buying this information off the black market.

"Theoretically" is the operative word here.

https://www.yourdnaguide.com/ydgblog/dna-data

I hate this. I hate that 2fa is becoming mandatory for more and more services because people can't be arsed to keep their passwords secure. I hate having to look at my mail to copy a stupid code every time I log into a website. Please don't do this.

Use passkeys then. Works great for me.

1) Is it free?

2) Is it supported by all websites and apps I use?

3) Is it supported by all devices I use?

Until the answer to all of those is "yes", passwords will remain superior.

Reply on news.ycombinator.com