Breach exposed more than one million DNA profiles on a major genealogy database

Re:Breach exposed more than one million DNA profiles on a ma... by varenc on Thursday July 23, 2020 @05:25AM (#23925592)

“As a result of this breach, all user permissions were reset, making all profiles visible to all users”

This seems like the opposite of how a sensible permissioning data model should work.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by 0x00000000 on Thursday July 23, 2020 @06:49AM (#23925972)

“But A/B testing showed more ‘user engagement’ when you default to public”

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by isbvhodnvemrwvn on Thursday July 23, 2020 @09:23PM (#23934693)

I think it's an older issue. Before it was sold, GEDmatch was ran by several part-time developers. It was running some old PHP 5 version the last time I checked. In general I advise to be very sceptical of amateur-ran genealogy sites - I know of at least 3 search engines with obvious SQL injection issues (which allow me to run better queries, but still). All of the major commercial sites had some sort of leaks as well (I'm not sure about FamilySearch).

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by W-_-D on Thursday July 23, 2020 @10:08AM (#23927505)

Who are you quoting there?

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by woolinsilver on Thursday July 23, 2020 @10:27AM (#23927686)

wooosh

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by marsrover on Thursday July 23, 2020 @06:50AM (#23925981)

I thought the exact same thing when I got the email. I would have much preferred a permission reset resulting in profiles being locked down tightly.

[ Parent | on HN ]