265
23andMe says hackers gained access to data of about 6.9 million people
(www.nbcnews.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 05 Dec 2023
265 points (98.9% liked)
News
21752 readers
3353 users here now
Welcome to the News community!
Rules:
1. Be civil
Attack the argument, not the person. No racism/sexism/bigotry. Good faith argumentation only. Trolling is uncivil and is grounds for removal and/or a community ban.
2. All posts should contain a source (url) that is as reliable and unbiased as possible and must only contain one link.
Obvious right or left wing sources will be removed at the mods discretion. We have an actively updated blocklist, which you can see here: https://lemmy.world/post/2246130 if you feel like any website is missing, contact the mods. Supporting links can be added in comments or posted seperately but not to the post body.
3. No bots, spam or self-promotion.
Only approved bots, which follow the guidelines for bots set by the instance, are allowed.
4. Post titles should be the same as the article used as source.
Posts which titles don’t match the source won’t be removed, but the autoMod will notify you, and if your title misrepresents the original article, the post will be deleted. If the site changed their headline, the bot might still contact you, just ignore it, we won’t delete your post.
5. Only recent news is allowed.
Posts must be news from the most recent 30 days.
6. All posts must be news articles.
No opinion pieces, Listicles, editorials or celebrity gossip is allowed. All posts will be judged on a case-by-case basis.
7. No duplicate posts.
If a source you used was already posted by someone else, the autoMod will leave a message. Please remove your post if the autoMod is correct. If the post that matches your post is very old, we refer you to rule 5.
8. Misinformation is prohibited.
Misinformation / propaganda is strictly prohibited. Any comment or post containing or linking to misinformation will be removed. If you feel that your post has been removed in error, credible sources must be provided.
9. No link shorteners.
The auto mod will contact you if a link shortener is detected, please delete your post if they are right.
10. Don't copy entire article in your post body
For copyright reasons, you are not allowed to copy an entire article into your post body. This is an instance wide rule, that is strictly enforced in this community.
founded 1 year ago
MODERATORS
It's truly a shame that in this advanced age of technology, encryption remains a distant, unattainable dream! In this archaic age of ours, safeguarding customer data is just not possible yet because nobody has ever invented the concept of public private key pairs yet, and hackers are having a field day with our data. Clearly, we're still stuck in the digital dark ages where safeguarding sensitive information is just a pipe dream. 🙄
Seriously, how is it possible that they're still not using key pairs for encrypting this data? It would be so simple, you just include a flash drive, or a qr code, in the box with the key and accessing the website to view the data would require that key, how is that still not something they're doing?
#EncryptionPlease
They accesed the data through compromised accounts. What do you think encryption would have done?
that has nothing to do with it, you just give each user a private key, and in order to view the data you need the key, simple as that, in fact it's even simpler for a user, no passwords to remember
Wut? You mentioned "encryption" over and over (#encryptionplease) and now it "has nothing to do with that?"
You're expecting people to download a GPG encrypted file, handle key maintenance, and offline decrypt it for viewing? And not store the decrypted data on their drives? Almost nobody would be willing to do that. And it's not necessary.
WebAuthn or MFA would have helped in this situation and are far easier for end-users to use properly.
I'm saying that the fact that they accessed the data through compromised accounts is irrelevant. If the data was properly encrypted and only decrypted on the user's machine with the key.
You made a lot of assumptions there.
I'm not really familiar with the entire process of how 23AndMe but based on what the service is I assume that they ship you a box with a vial or maybe a swab to collect saliva, then include a code, maybe a qr code or a redemption id that you can use to register on their website.
The packaging could very easily include a QR code with an RSA or EDCSA key, then the website could ask you to scan that QR code to login.
The website would then use that to calculate the public key based on that private key and make a request to the server for the data associated with that public key, then the user's browser would decrypt that data and display it
What exactly is the problem here? If anything it's simpler than username/password from a user standpoint.
And as for WebAuthn, yeah that would work and it's definitely better than a password, and would perhaps solve part of the issue, but as a user I would feel much safer with my implementation
It was encrypted and only decrypted on the user's machine. It's called TLS.
Well of course I did - all you said was "use encryption" like that meant anything specific.
Your proposed solution has lots of problems and isn't materially more secure than properly implementing WebAuthn or even requiring MFA. All you've added is a public/private key authentication which is what WebAuthn does.
You also need a solution for lost keys, using multiple browsers, etc. or nobody will use it. This is also being provided by WebAuthn.
The problem here is not "encryption" it's "properly identifying who should have access to the data." It's an authentication problem. The data was encrypted from the servers to the browser in a secure manner. At issue here is account security and authentication.
To be clear - you solution would "work" but without the above issues addressed nobody will use it because it will be a giant pain in the ass. It's not like we don't know how to share data securely, it's that doing so is complicated and often relies on users to be sophisticated about security. They're your weakest link so you need a system that:
And this is what WebAuthn promises.
It only has to solve part of the issue. The end-to-end encryption is covered with TLS.
I don't see what your solution would do that isn't covered by existing tech. And it would require a lot of new protocols to be put in place, support by major browsers, good user interfaces, etc.
How is TLS relevant in this discussion? In this specific case TLS only solves MiTM, that's it.
It was an offhand comment in a lemmy post, of course I'm not gonna go into details... but fair enough
This is a bit disingenuous, don't you think? To be clear I like WebAuthn, I think it's a great technology that I've been evangelizing about it to coworkers and friends for years, it's definitely the future of authentication, but that's only marginally relevant, in the case of sensitive data like this you want the data to be both encrypted at rest and during transmission, with a unique pre-generated key, otherwise a rogue employee or in general someone with access to the database can see everything, regardless of anything else.
"If the data was properly encrypted and only decrypted on the user’s machine with the key."
TLS is "encryption" that is "only decrypted on the user's machine with [a] key". I feel like I'm completely misunderstanding what sort of protocol you have in mind though.
This breach was a failure of authentication via reused passwords. It's the exact scenario WebAuthn is designed to mitigate. I have no idea how you could consider it to be "marginally relevant".
I don't know what you mean. Just that the database should be encrypted (I have no reason to believe it wasn't) or that the company should encrypt the data such that the only person who can view it at all is the person whose account it is for?
If they encrypt it, how will they sell them to third parties
because I'm pretty sure they need some of that data to be unencryped;
records of related customers can improve accuracy drastically
~~and they're probably also probably selling it~~
also this "hack" was done by just abusing built-in features ("dna relatives" system), not actually breaking any security.
I don't even think this should be a feature, but, if it has to, then they can have two versions of it, one that they use for training and improving the results and a user can only access their data from a frontend by decryping it (locally) with their key
irrelevant. if you had a key pair no amount of password guessing would get them there
A strange number of engineers think DARE and transmission encryption are sufficient for sensitive data, as though that encryption isn't effectively transparent if the tools designed to access it are compromised.
Fair point!
To be clear I wasn't arguing that DARE is enough, you are absolutely correct that depending on the situation it isn't, but in my opinion in this specific case. if the data was DAREd, and sent to the user in its encrypted state and only decrypted on the user's machine with the user's key, that's not stored in any server, it would have completely fixed this specific issue. Naturally, however, to your point, with encryption there is no one-size-fits-all argument!