Ongoing discussion,

Genetics firm 23andMe says user data stolen in credential stuffing attack (https://news.ycombinator.com/item?id=37794379)

So, why was this post removed from the frontpage? (Yes, I feel a bit guilty.)

Comments moved thither. Thanks!

How do you exfil data on 1.3M users by guessing a few passwords?

Well, it seems they took advantage of a feature that indicates who you may be related to, so they must have guessed Genghis Khan's password.

[email protected] and password "SHADOW_RAIDERZ123" that was easy.

They're not guessing passwords, they have a list of e-mails and passwords from other leaks and are hoping the users are using the same credentials on all their accounts. Since password managers aren't mainstream yet it works.

How do you hide authenticating 1.3+m unique accounts? A distributed system? A mess of VPN's? Or they don't hide it because the auth system is not checking for 1.3 million auth attemps?

The latter. Forget tracking auth attempts:

> The researcher added that he discovered another issue where someone could enter a 23andme profile ID, like the ones included in the leaked data set, into their URL and see someone’s profile.

Ah, so they were able to use a few accounts, then fuzzed the URLS to victory...

Amazingly incompetent.

I recently had to explain to a tech lead that you can "never trust the client," because any dedicated party can just curl around your UI and send whatever HTTP request they want.

I remember when this first occurred to me from me deciding that I didn't want to click download a series of things on some website where this was the intended use. I wrote a small shell script to curl it for me, and somewhere during the process of writing the script, I realized the true "power" of this. Ever since then, GET with search queries were protected against in everything I wrote from that point forward. Luckily, that was in the late 90s, so it's been a minute.

Each valid login+password got the scrapers many many profiles.

23andMe has a feature that lets you see people you're related to and view their profiles. My guess is this feature had few rate limits and allowed you to view the profiles of people very distantly related. So perhaps with a couple thousand valid account logins you could eventually look up the profiles for 1.3M users.

Do we need to feel sorry for those that entrusted their whole livelihood to a startup?

23andMe is a 17 year old public company with almost $300m in revenue. I’d hardly call that a startup.

No, but you should feel sorry for all the people who refused to entrust 23andMe but whose relatives didn't get the memo. They'll be hurt by this too.

anything that has connections to google is going to be a privacy nightmare

[dupe]

More discussion over here: https://news.ycombinator.com/item?id=37794379

Maybe they could send me my dad's account password he lost years ago and no longer has the email address.

You should be able to lookup the email on https://haveibeenpwned.com/. If it's there, they might have your password.

I visited the site in the screenshot and saw someone peddling NATO leaks from their Philippines visit including "PLANCTON, CRONOS, CA SIRIUS, EMADS, MCDS, B1NT etc" And one more list of some ukrainian citizens database from 2023.

please don't kill me CIA! I swear I accidentally saw it.

welp! time to head back to my work.

That's exactly what a spy would say. Get'em boys!

what site is it?

$75k. Tell me the government doesn’t take privacy seriously without telling me that government doesn’t take privacy seriously.

> Three weeks ago, genetic testing firm 1Health.io agreed to pay the Federal Trade Commission (FTC) a $75,000 fine to resolve allegations that it failed to secure sensitive genetic and health data, retroactively overhauled its privacy policy without notifying and obtaining consent from customers whose data it had obtained, and tricked customers about their ability to delete their data.

I already find the narcissistic "welcome to you" message on the package inducing of extensive amounts of vomit. And then they only get $75k for this? I want them go DOWN.

The FTC takes the its_not_about_the_money.jpg meme very seriously.

Capitalism being backwards as usual. If we really take privacy seriously we should fund them $75K to fix their privacy problems.

If you take away $75K from their engineering budget they will only do a worse job, and more data will leak.

That sounds like a good way to ensure monthly data leaks

I'm just going to do my monthly HN login to say, and possibly skirt ethics here because your comment truly deserves it, that this is the dumbest thing I've read on here in a long time. I can't tell if this comment is satire or being real.

What? No. If we really take privacy seriously, we might consider giving them a discount on their use of our genetic data once they have shown responsible care in handling that data -- similar to how no-claim bonuses work in insurance.

Wouldn't this incentivize insecure practices and bad practices so they can get 75k? Wouldn't that be the effect, everyone tries to as little as possible until they get paid?

That's a fairly unconventional approach. Not a subscriber to traditional incentives-drive-behaviours theories I guess?

Capitalism brings abundant choices. Many or most people don't care enough to protect themselves by choosing differently.

[delayed]

And if fined $75000 the first thing they would do is lay off that security expert.

Provide the security expert to them at no cost, taxpayer funded, as a collective effort to stop identity leaks.

Err, no. If you give them $75k then everyone else will be incentivised to leak data so they too can get a free $75k.

I wouldn't. If I leaked data due to honest coding bug and someone gave me $75K with even a handshake agreement to put it towards fixing the problem I would put 100% of that money towards fixing the problem. That's my moral standard, if money with even a verbal agreement to put it towards a certain purpose, I either honor that purpose or don't take the money.

If they took away $75K I might be forced to lay off someone, possibly one who could have fixed the problem.

We’re not actually seeing the kinds of boogeymen people like to trot out when this kind of data is leaked. Nobody is conducting banned genetic research, nobody’s insurance rates are going up, nobody is getting ethnically cleansed as a result of this info…

A few stolen identities, some bank fraud, but largely the systems in place can handle it. It’s caught at the other end.

If you want big fines, prove big consequences.

A single stolen identity can cause years of emotional harm and turmoil. Someone’s life is often completely uprooted from this. That one person alone should receive significantly more than $75k

A single car accident can end a life, yet we drive cars. The value gained by technology like 23andm3 is vastly outweighed by the cost of some occasional negligence or theoretical harm.

Besides, if you can find a specific person who was specifically harmed by this exact breach, I bet you could sue for damages, and get more than $75k.

If I significantly harm someone with my car, even unintentionally, I do in fact get sued successfully for far more than $75k

Which is my point; there's no "significantly harm" here at a large scale, and if there is one at an individual scale, that person can sue.

The $75k fine is exactly proportional to the complete lack of concrete harm done. Nobody gets fined for cars existing.

Whoopsie daisy.

I wonder if companies will seriously start to rethink "transitive permissions" or "network permissions". This is very similar to what bit Facebook in the ass years ago: I have permissions to see all the data of my friends, but in the past I could also click a button to let someone who requested see not just my own info, but also all the info from my friends.

From a "computer science" perspective this makes sense: if I say you can view all my data, I lose control with who else you share that data with. But from a "human" perspective, most people don't think that if I give you access that I'm essentially giving access to the rest of the world.

These types of network permissions make any company who holds them a prime target because it means bad guys only need to hack a few accounts to get exponentially more data.

> also all the info from my friends

They would only see the subset of what your friend shared, the set configured by its author as visible to friends of friends, right?

No, IIRC this predates that entire permission model. "Friends of friends" today means just what it sounds like - my friends and all of their friends can see the data Iark that way.

Back in the late 00s/early 10s when lots of "Facebook apps" were a bit of a craze (think Farmville), you could give an app maker permission to view your personal data and all of the data that you could see about your friends. This is how Cambridge Analytics was able to build profiles of 87 million Facebook users when only a few hundred thousand actually installed the "your digital life" app: https://www.theguardian.com/news/2018/mar/17/cambridge-analy...

According to this tweet, the hackers likely got ALL of the data but only leaked a subset, 1.3 million records (only the ashkenazi Jews)

https://x.com/mattjay/status/1710370423311888724?s=20

as a 23andMe user with a high percentage of Ashkenazi genes I expected my data to be in the leak but it wasn't so it's probably not all of the Ashkenazi data

How did you verify? I am ashkenazi

assuming your last name is the same as in your HN username you are not in the file either

(as to how I verified: the file is still available on the leak site)

OK, that CSV is just a subset of the data they claim to have.... so our data might still be out there even if it wasn't in this file.

These are the headers:

  profile_id; account_id; first_name; last_name; sex; birth_year; has_health; ydna; mdna; current_location; regions; subregions; population_ids

First entry is

  Elon;Musk;Male;1971;...

There's a whole debate about whether Elon Musk has Jewish ancestry. Are you saying he is?

I have almost 6% myself, but to me it feels like, if I don't even know about who it might have been in my family tree, it doesn't really count.

But yes, for EM it said "Ashkenazi;Balkan;British Irish" - no percentages in there - and I believe 23andme has confirmed the authenticity of the data.

Glad I used 23andMe with a fake name and UPS PO Box

What did you use to pay for all of it?

Prepaid visa that I bought with cash at the supermarket. It’s a lot of work but it… worked.

That would explain how they got so much data with a probably small number of compromised accounts. Ashkenazi Jewish people were relatively genetically isolated from the rest of Europe and started from a relatively small founder population. Genetically, then, they're all detected as distant cousins of each other using standard metrics.

This means a typical Ashkenazi Jewish customer of 23andMe has a lot more relatives than most other customers, and so they'd be able to view that many more profiles.

Great, more neo-nazi terror. I love the 20's /s

Oh god, of course it’s a Jewish thing

If I live a hundred years I will never understand people’s obsession with the Jews

That tweet has zero evidence this is anything more than using reused passwords. Certainly not all data.

This is why no matter how many interesting ads or tiktoks, I will never do these genetic testing kits. I wouldn't be surprised military is working on CRISPR like infections that target your specific DNA when sprayed in the air.