23andMe tells victims it's their fault that their data was breached | TechCrunch

I have friends that occasionally removed about the way things are but refuse to engage with whatever systems are set up to help solve whatever given problem they have. "it shouldn't be like that! It should work like X"

Well, it doesn't. We can try to change things for the better but refusal to engage with the current system isn't an excuse for why your life is shit.

That's a lot of fucking

I get that people aren’t a fan of Google, and I’m not either, but this is a reasonable option that would be better than what the vast majority of people are doing now…

Bitwarden is simple, works across platforms, is open source, and isn't trusting your data to a company whose *checks notes entire business model is based on sucking up as much data as possible to use for ad-targeting.

I'll trust the company whose business model isn't built on data-harvesting, thanks.

Also, Firefox is better for the health of the web, Google is using Chrome as a backdoor to dictate web standards, yadda yadda.

I'm not sure how much MFA would have mattered in this case.

23andme login is an email address. Most MFAs seem to use email as an option these days. If they're already reusing passwords, the bad actor already has a password to use for their emails that's likely going to work for the accounts that were affected. Would it have brought it down? Sure, but doesn't seem like it would've been the silver bullet that everyone thinks it is.

If the accounts were logged into from geographically similar locations at normal volumes then it wouldn't look too out of the ordinary.

The part that would probably look suspicious would be the increase in traffic from data exfiltration. However, that would probably be a low priority alert for most engineering orgs.

Even less likely when you have a bot network that is performing normal logins with limited data exfiltration over the course of multiple months to normalize any sort of monitoring and analytics. Rendering such alerting inert, since the data would appear normal.

Setting up monitoring and analysis for user accounts and where they're logging from and suspicious activity isn't exactly easy. It's so difficult that most companies tend to just defer to large players like Google and Microsoft to do this for them. And even if they had this setup which I imagine they already did it was defeated.

The fact that they did not enforce 2fa on everyone (mandatory, not just having the feature enabled) is their responsibility. You are handling super sensitive data, credential stuffing is an attack with a super low level of complexity and high likelihood.

Similarly, they probably did not enforce complexity requirements on passwords (making an educated guess vere), or at least not sufficiently, which is also their fault.

Regarding the last bit, it might noto have helped against this specific breach, but we don't know that. There are companies who offer threat intelligence services and buy data breached specifically to offer this service.

Anyway, in general the point I want to make is simple: if your only defense you have against a known attack like this is a user who chooses a strong and unique password, you don't have sufficient controls.

There are services that check provided credentials against a dictionary of compromised ones and reject them. Off the top of my head Microsoft Azure does this and so does Nextcloud.

I don't think it's possible to make a blanket statement in this sense. For example, Lemmy doesn't handle as sensitive data as 23andMe. In this case, it might be totally acceptable to have the feature, but not requiring it. Banks (at least in Europe) never let you login with just username and password. The definitely comply with different standards and in general, it is well understood that the sensitivity of the data (and actions) needs to be reflected into more severe controls against attacks which are relevant.

For a company with so sensitive data (such as 23andMe), their security model should have definitely included credential stuffing attacks, and therefore they should have implemented the measures that are recommended against this attack. Quoting from OWASP:

Multi-factor authentication (MFA) is by far the best defense against the majority of password-related attacks, including credential stuffing and password spraying, with analysis by Microsoft suggesting that it would have stopped 99.9% of account compromises. As such, it should be implemented wherever possible; however, depending on the audience of the application, it may not be practical or feasible to enforce the use of MFA.

In other words, unless 23andMe had specific reasons not to implement such control, they should have. If they simply chose to do so (because security is an afterthought, because that would have meant losing a few customers, etc.), it's their fault for not building a security posture appropriate for the risk they are subject to, and therefore they are responsible for it.

Obviously not every service should be worried about credential stuffing, therefore OWASP can't say "every account needs to have MFA". It is the responsibility of each organization (and their security department) to do the job of identifying the threats they are exposed to.

It’s called social hacking,