23andMe admits hackers stole raw genotype data - and that cyberattack went undetected for months | Firm says it didn’t realize customers were being hacked::Firm says it didn’t realize customers were being hacked
23andMe admits hackers stole raw genotype data - and that cyberattack went undetected for months | Firm says it didn’t realize customers were being hacked::Firm says it didn’t realize customers were being hacked
Look, I’m as ready as anyone to jump on companies for mishandling data. I work daily with extremely private medical information protected by an ungodly amount of laws, and it pisses me off how whimsical most companies are with customer data. This one wasn’t exactly their fault though. If you use the SAME EMAIL AND PASSWORD across multiple different sites it’s not site B’s fault when site A gets hacked and your login information is attempted on site B. It’s also not even that surprising given people willingly giving up information this private aren’t exactly the most privacy literate.
Could they have enforced multi-factor 2FA? Sure, and it would’ve mitigated some of the damage. However, I think we can all reason that they probably had the same password for their email and phone provider. Hardware keys aren’t cheap, and most people just don’t have them. It’s also pretty reasonable that it would take a super long time to figure out someone logging in with a username and password was “hacked”.
You have a point. However, I think they should’ve forced 2fa from the start.
Everyone already has the hardware for 2fa in their pockets too. This was simply a decision this company made to minimise barriers to their customers wallets.
Maybe a lot of us do but the general population might not even know what hardware tokens are and if they exist.
I’m all for security, but god I hate forced 2fa. I’m a power user with a password manager that generates 64 characters long random passwords, different for each site. I don’t want to be bothered to take my phone every time I want to login.
Use a password manager that also does totp.
If this guy is this lazy then this might be a good option? Bitwarden comes with one included but I still use a separate app (Aegis) and my yubikey.
I try to keep my fingers in my keyboard as much as possible and having to take out my phone is just a waste of time. I do not need 2fa. Let me do my own security.
Maybe requiring 2fa for passwords shorter than 60 characters would be a good solution. Most people would use 2fa but people with strong passwords can live without it.
I highly disagree with not having 2fa. Even having one in your password manager, allowing you to not take fingers off of keyboard is better than nothing.