Hacker News Reader

Comment by masto | Hacker News Reader

I do not reuse passwords, and from what I understand, my account was not accessed directly. The message they sent me was:

"After further review, we have identified your DNA Relatives profile as one that was impacted in this incident. Specifically, there was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor."

So there's nothing I could have done with password security that would have prevented this; my only mistake was using a feature of their site.

View on HN

I understand you couldn't have done anything, but on the other hand, could they have?

My understanding is that the people that were breached were breached outside 23andMe, and their credentials were simply used to log into 23andMe. Not attachking you or anything but haven't you opted in to sharing potentially sensitive information to people you don't know, basically making this information as secure as these people's accounts are? Or, for that matter, as secure as these people are?

Perhaps they could highlight that a bit more (I wouldn't think of that probably if I used this feature). But that's just as much "just" a mistake as "just using a feature".

Using a service like Have I Been Pwned, could companies like 23andMe proactively invalidate credentials that are known to be leaked? The next time those customers try to log in, they're forced to update their credentials through something like an email-based password reset?

Yes, this is exactly what could have been (and in my opinion, should have been) done to prevent this kind of "credential stuffing" attack. By taking known corpus of exposed passwords and comparing the hashed values against existing user password hashes, the company could have proactively locked accounts and forced password resets for users who had previously chosen weak passwords, and prevented new weak passwords from being chosen as well. This is quickly becoming an industry standard practice, and 23andMe likely knows that and is trying to make the argument that it's not their problem and has nothing to do with them (wrong).

They could have mandated stronger security. Wouldn't even 2FA have avoided this issue? Or even some even stronger measures like enforcing use of hardware security keys.

By default, we should offer a choice for levels of security. At least a password, with SMS or 2FA. And if the company makes a few bucks, even more options.

You are correct, I did opt in. I'm not particularly concerned about the security of this data or this breach. But in the context of all this finger-pointing, I thought it was important to point out that 23andme saying "it's your fault for misusing passwords" is a little disingenuous. I was taking some poetic license with "mistake": I don't consider it a mistake, I willingly chose to share that information. My point was that the only way they can blame me for having my information leaked is to blame me for using their product as advertised.

What exactly does the feature do? Share (some of?) your data with people you seem to be related to? If that data is sensitive, it seems a pretty risky thing to share even with relatives who you know quite well.

It shares some information that you optionally choose to share (genealogical data like where your ancestors are from, family names, etc., and which segments of DNA match).

One thing reading Hacker News has made clear is that people have wildly differing opinions of what "sensitive" and "risky" mean.

Yeah, that's the thing about defining PII in law. You may simply legally curtail some useful applications.

It shares your name and how much DNA you have in common. These are opt-in features.

I had a similar situation back when Adobe lost their database.

I have a personal domain with a catch all configured. So back then I would just give a name like adobe.com@<personal-domain>.

When they leaked my password I contacted their support and they flatly told me that's not them who lost the password, even though evidently the mail itself was tailored specifically for Adobe.

It is likely the support was told to follow a script when a concerned client contacts them and there is no way they are going to tell you anything else regardless of the specifics of your case or how absurd their arguments are.

Turns out that people who were saying that these kinds of services are going to give access to Government actors, sell their databases or just have them hacked/stolen by malicious actors because of garbage security were, in fact, correct. Color me not surprised.

I will color you cynical instead.

Is it still cynicism if it's accurate?

It is if the future is stupid.

I have bad news for you...

Acuracy does not factor into whether a statement is cynicism.

We only highlight the cases where the cynicism paid off...and in this case praising someone who is saying something pithy _after the fact_.

It's easy to throw out cynical opinions. It's also easy to come along later and say "I _knew_ this would happen"

Sometimes cynicism is well warranted. Security is just very hard to get right, in general, regardless of who you are.

This isn't cynicism. It's intelligence - making an accurate prediction of future events.

Even a broken clock is right twice a day. Intelligence is being able to _consistently_ make accurate predictions of the future.

Just because something ended up being right doesn't mean it was intelligent. Things don't work in absolute, most things are a bet.

If one outcome is 99% likely and the other 1%, the intelligent thing is choosing the 99% likelihood, but that still means that sometimes the person making the bad choice was right.

That doesn't make them intelligent, it makes them lucky.

Cynicism is often a coping mechanism for people that have seen too many such events happen. It's actually only a problem when it guides choices from decision makers ahead of time, there's nothing wrong with some cynicism as long as it doesn't guide your actions.

How is one not cynical today?

Cynicism is a general distrust in other people’s motives. How does one conclude that distrust expressed in a single event constitutes general distrust? Don’t we need many more examples of distrust from this person before branding them as cynical?

If you think that governments are not already building gene pools of their populations, I can color you a hip shade of naive, too, if you consent of course.

Ok, I'll bite. Which governments are you referring to? And how are they doing this? And how do you know of this?

Isn’t it true that it’s already widely known that some US states (or the US itself; can’t remember details) stores DNA of anyone ever booked by the police even if not charged or charged and acquitted?

I’m not the person you’re responding to but their claim doesn’t seem so contentious.

> Which governments are you referring to?

Any that has an intelligence service. (And probably most others too.)

> And how are they doing this?

They get the data from breaches like this or otherwise purchased from services like this.

> And how do you know of this?

I’d suspect less that they know and more that they have a reasonable suspicion. I personally have that suspicion because 1) it’s feasible and 2) governments would be interested in the data.

That's how they caught the golden state serial killer

https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t....

Also, the government keeps all DNA from people arrested (not convicted) for anything

https://www.nbcnews.com/news/world/your-dna-police-database-...

Many nations have public gene banks. These banks contain many indigenous organisms' gene sequences as well as anonymized gene sequences from people from their respective countries, which is used for national and international medical research. These gene banks exchange information regularly. One of the most public ones is US' own NIH GenBank [0].

A small search surfaces a lot of gene banks which store human and non-human DNA. Use your favorite search engine for this.

Generally submissions are done with patients' consent, but I'm not very sure that some of the blood samples are directed to national private databases for countries' own use and research.

The reasons doesn't have to be nefarious. Knowing your population's genetic weaknesses is a good way to defend it, and having access to a wide pool allows a deeper understanding of genetic conditions and how genetic therapies are working.

Also, earlier comments than mine already cited how law enforcement in US is already using this as evidence.

I'm an ordinary person. I don't have access to more information than you do.

[0]: https://www.ncbi.nlm.nih.gov/genbank/

That's crazy that US law enforcement is storing genetic data about people they arrest. I understand that governments would store the data with consent from people, but without consent is not great...

"How to get a free genealogy test, courtesy of the Hampden DA’s office"

https://www.masslive.com/news/2024/01/how-to-get-a-free-gene...

> give access to Government actors, sell their databases or just have them hacked/stolen by malicious actors

one of these is not like the other

It’s a big club, and we ain’t in it!

Still your mistake, so in a sense they were right. I dont use DNA services like these especially for cases like these. /s

I wouldn't say it so starkly. Not overseeing all consequences isn't necessarily a mistake someone can be blamed for

At least part of the issue is not informing people of the risk they're taking by using the feature. That doesn't make for good business, though

Sadly, I have to agree. The amount of convincing I had to to try (and fail) to stop friends from using this specific website before the leak… The sad thing is that it’s not necessarily about malice that you should be wary. Stuff like this is a risk too. But yeah, I was a bit harsh, it’s true.

You're welcome to your own opinion about what you think is a bad idea, but I don't share it. I won't call you paranoid if you don't call me stupid.

Reply on news.ycombinator.com