Hacker News Reader

Comment by posix86 | Hacker News Reader

I understand you couldn't have done anything, but on the other hand, could they have?

My understanding is that the people that were breached were breached outside 23andMe, and their credentials were simply used to log into 23andMe. Not attachking you or anything but haven't you opted in to sharing potentially sensitive information to people you don't know, basically making this information as secure as these people's accounts are? Or, for that matter, as secure as these people are?

Perhaps they could highlight that a bit more (I wouldn't think of that probably if I used this feature). But that's just as much "just" a mistake as "just using a feature".

View on HN

Using a service like Have I Been Pwned, could companies like 23andMe proactively invalidate credentials that are known to be leaked? The next time those customers try to log in, they're forced to update their credentials through something like an email-based password reset?

Yes, this is exactly what could have been (and in my opinion, should have been) done to prevent this kind of "credential stuffing" attack. By taking known corpus of exposed passwords and comparing the hashed values against existing user password hashes, the company could have proactively locked accounts and forced password resets for users who had previously chosen weak passwords, and prevented new weak passwords from being chosen as well. This is quickly becoming an industry standard practice, and 23andMe likely knows that and is trying to make the argument that it's not their problem and has nothing to do with them (wrong).

They could have mandated stronger security. Wouldn't even 2FA have avoided this issue? Or even some even stronger measures like enforcing use of hardware security keys.

By default, we should offer a choice for levels of security. At least a password, with SMS or 2FA. And if the company makes a few bucks, even more options.

You are correct, I did opt in. I'm not particularly concerned about the security of this data or this breach. But in the context of all this finger-pointing, I thought it was important to point out that 23andme saying "it's your fault for misusing passwords" is a little disingenuous. I was taking some poetic license with "mistake": I don't consider it a mistake, I willingly chose to share that information. My point was that the only way they can blame me for having my information leaked is to blame me for using their product as advertised.

Reply on news.ycombinator.com