• SatanicNotMessianic@lemmy.ml
      link
      fedilink
      arrow-up
      12
      ·
      9 months ago

      No, they’ve been heading south for years. I would have loved for it to be a drop in response to the data breach, but this was just a company that was run incompetently.

    • usualsuspect191@lemmy.ca
      link
      fedilink
      arrow-up
      10
      arrow-down
      2
      ·
      9 months ago

      Which data were they negligent with? I thought it was breaches on other sites that gave reused passwords.

      • Hegar@kbin.social
        link
        fedilink
        arrow-up
        12
        arrow-down
        1
        ·
        edit-2
        9 months ago

        Credential stuffing is a well understood part of the threat landscape that 23 and me negligently failed to account for, allowing hackers to access 7 million people’s info after hacking only 14 thousand users.

        • jimbo@lemmy.world
          link
          fedilink
          arrow-up
          3
          arrow-down
          6
          ·
          9 months ago

          …because those 7 million people opted into sharing their data with everyone else.

          • BreakDecks@lemmy.ml
            link
            fedilink
            English
            arrow-up
            9
            arrow-down
            1
            ·
            9 months ago

            No, they opted to share varying degrees of information with authorized users and close genetic matches, and 23andMe failed to protect them from a large scale takeover of accounts that made public the kind of information the company had promised to keep private to semi-private.

            14,000 accounts compromise by the same entity. That’s absolutely the fault of the platform, not the users.

            • jimbo@lemmy.world
              link
              fedilink
              arrow-up
              1
              arrow-down
              2
              ·
              edit-2
              9 months ago

              You’re making a distinction without a difference. Nobody has any fucking clue who their “genetic match” will be nor does anyone have any fucking clue who else is using 23andMe. Sharing that information with other 23andMe users is not meaningfully different than just sharing it with the world at large.

          • Hegar@kbin.social
            link
            fedilink
            arrow-up
            8
            arrow-down
            1
            ·
            9 months ago

            It’s not the responsibility of your grandma who’s researching family history to be aware of potential data security threats. It’s the responsibility of the multimillion dollar online company with massive, valuable data troves to not offer a feature that was just a data breach waiting to happen.

            • afraid_of_zombies@lemmy.world
              link
              fedilink
              arrow-up
              3
              ·
              edit-2
              9 months ago

              I remember when the housing market crashed and hearing all these rich folks talk about how it is poor people who are responsible for not knowing they couldnt afford their homes.

              Yeah so why exactly do we have a credit rating system if it isn’t rating credit?

              You are completely correct. It is not on regular people to be experts on cyber security and somehow know that the company is doing their job and will do their job forever.

      • tiredofsametab@kbin.social
        link
        fedilink
        arrow-up
        9
        ·
        9 months ago

        There are still all kinds of things a company can do to mitigate at least some of this. New browser, new location, forced two-factor auth, etc.

        • wreckedcarzz@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          8
          ·
          9 months ago

          Cmon, we know their target market was dumbasses. How many dumbasses do you know that use mfa, or that actually look at a login notification before hitting “yes, it’s me”?