this post was submitted on 06 Oct 2023
171 points (93.4% liked)

Technology

58044 readers
3576 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

At least a million data points from 23andMe accounts appear to have been exposed on BreachForums. While the scale of the campaign is unknown, 23andMe says it's working to verify the data.

top 9 comments
sorted by: hot top controversial new old
[–] clearedtoland@lemmy.world 43 points 11 months ago (2 children)

On one hand, it was inevitable. 23andMe is one sweet pot. We’ve always known genetic data would one day be used for nefarious purposes and consumer were warned back then to be cautious with what they were signing up for. On the other, how in the world did they not better safeguard and isolate user data? I’d expect encryption and safeguards on par with a password manager like 1Password.

The company said its systems were not breached and that attackers gathered the data by guessing the login credentials of a group of users and then scraping more people’s information from a feature known as DNA Relatives

I know I have the DNA relative feature enabled but I would’ve never imagined that was scrapeable and a vulnerability.

[–] fiat_lux@kbin.social 22 points 11 months ago* (last edited 11 months ago)

All data is scrapable. It's just a matter of how difficult it is to scrape and whether it's worth the effort.

Assume anything you see or input is being captured, because it almost always is, even if it's just because WiFi can trace your physical outline, or a street camera saw you unlock your phone, or your fingerprint is can be copied from a door handle.

The only place that data is mostly still secure is literally your brain, but even then, that can be compromised with a bottle of booze.

how in the world did they not better safeguard and isolate user data?

It's realistically impossible to 100% do this, unfortunately. 20+ year old security flaws are discovered alarmingly frequently, and once the wrong person knows about the right exploit, they can automate entire global attacks. Automated attacks make up a lot of global internet traffic.

Imagine there are physical medieval castles with moats with crocodiles and turrets and an entire defending army with ballistas... but doors randomly appear in the external walls, and bridges instantly construct over the moat, and entire sections of walls can disappear unexpectedly. When there is an infinitely replenishable enemy army attacking that castle, they're going to get in eventually. That is what the internet is, but digitally.

Humans write code, and humans aren't perfect, so neither is their code. And anything Humans make or do, a different human will try to destroy or exploit it, that is guaranteed. It's a problem we've had for as long as we've been organisms.

[–] SkaveRat@discuss.tchncs.de 11 points 11 months ago

I know I have the DNA relative feature enabled but I would’ve never imagined that was scrapeable and a vulnerability.

if it's viewable in a browser, it can be scraped.

You can make it more annoying for scrapers, but in the end, you need to show stuff to your users, and that's what scrapers basically emulate in the end.

And as for being a vulnerability: Finding the murderer of a cold case

[–] Bishma@discuss.tchncs.de 19 points 11 months ago* (last edited 11 months ago)

From this moment forward I will be grateful that I've never been responsible for securely storing this kind of PII.

[–] northendtrooper@lemmy.ca 11 points 11 months ago* (last edited 11 months ago)

Please don't let this lead to a mini genocide.

[–] ChefTyler1980@lemmy.world 9 points 11 months ago

MFA all the things people..

[–] gabe@literature.cafe 7 points 11 months ago

Ugh. What the fuck

[–] Akasazh@feddit.nl 7 points 11 months ago (1 children)

The full picture of why the data was stolen, how much more the attackers have, and whether it is actually focused entirely on Ashkenazim is still unclear.

From the article, the title is obviously overstated for effect

[–] vector_zero@lemmy.world 5 points 11 months ago

Yeah, that title triggered an immediate and involuntary eye roll.