23andMe says hackers gained access to data of about 6.9 million people
nbcnews.com
Genetic testing company 23andMe said Monday that hackers were able to access the data of about 6.9 million people, far more than the company previously acknowledged.
The finding is the result of an investigation 23andMe launched in October, after at least one list of people whom the site identified as having Ashkenazi Jewish ancestry was posted online.
You are viewing a single comment
It's truly a shame that in this advanced age of technology, encryption remains a distant, unattainable dream! In this archaic age of ours, safeguarding customer data is just not possible yet because nobody has ever invented the concept of public private key pairs yet, and hackers are having a field day with our data. Clearly, we're still stuck in the digital dark ages where safeguarding sensitive information is just a pipe dream. 🙄
Seriously, how is it possible that they're still not using key pairs for encrypting this data? It would be so simple, you just include a flash drive, or a qr code, in the box with the key and accessing the website to view the data would require that key, how is that still not something they're doing?
#EncryptionPlease
because I'm pretty sure they need some of that data to be unencryped;
records of related customers can improve accuracy drastically
and they're probably also probably selling italso this "hack" was done by just abusing built-in features ("dna relatives" system), not actually breaking any security.
I don't even think this should be a feature, but, if it has to, then they can have two versions of it, one that they use for training and improving the results and a user can only access their data from a frontend by decryping it (locally) with their key
irrelevant. if you had a key pair no amount of password guessing would get them there
They accesed the data through compromised accounts. What do you think encryption would have done?
that has nothing to do with it, you just give each user a private key, and in order to view the data you need the key, simple as that, in fact it's even simpler for a user, no passwords to remember
Wut? You mentioned "encryption" over and over (#encryptionplease) and now it "has nothing to do with that?"
You're expecting people to download a GPG encrypted file, handle key maintenance, and offline decrypt it for viewing? And not store the decrypted data on their drives? Almost nobody would be willing to do that. And it's not necessary.
WebAuthn or MFA would have helped in this situation and are far easier for end-users to use properly.
I'm saying that the fact that they accessed the data through compromised accounts is irrelevant. If the data was properly encrypted and only decrypted on the user's machine with the key.
You made a lot of assumptions there.
I'm not really familiar with the entire process of how 23AndMe but based on what the service is I assume that they ship you a box with a vial or maybe a swab to collect saliva, then include a code, maybe a qr code or a redemption id that you can use to register on their website.
The packaging could very easily include a QR code with an RSA or EDCSA key, then the website could ask you to scan that QR code to login.
The website would then use that to calculate the public key based on that private key and make a request to the server for the data associated with that public key, then the user's browser would decrypt that data and display it
What exactly is the problem here? If anything it's simpler than username/password from a user standpoint.
And as for WebAuthn, yeah that would work and it's definitely better than a password, and would perhaps solve part of the issue, but as a user I would feel much safer with my implementation
It was encrypted and only decrypted on the user's machine. It's called TLS.
Well of course I did - all you said was "use encryption" like that meant anything specific.
Your proposed solution has lots of problems and isn't materially more secure than properly implementing WebAuthn or even requiring MFA. All you've added is a public/private key authentication which is what WebAuthn does.
You also need a solution for lost keys, using multiple browsers, etc. or nobody will use it. This is also being provided by WebAuthn.
The problem here is not "encryption" it's "properly identifying who should have access to the data." It's an authentication problem. The data was encrypted from the servers to the browser in a secure manner. At issue here is account security and authentication.
To be clear - you solution would "work" but without the above issues addressed nobody will use it because it will be a giant pain in the ass. It's not like we don't know how to share data securely, it's that doing so is complicated and often relies on users to be sophisticated about security. They're your weakest link so you need a system that:
And this is what WebAuthn promises.
It only has to solve part of the issue. The end-to-end encryption is covered with TLS.
I don't see what your solution would do that isn't covered by existing tech. And it would require a lot of new protocols to be put in place, support by major browsers, good user interfaces, etc.
How is TLS relevant in this discussion? In this specific case TLS only solves MiTM, that's it.
It was an offhand comment in a lemmy post, of course I'm not gonna go into details... but fair enough
This is a bit disingenuous, don't you think? To be clear I like WebAuthn, I think it's a great technology that I've been evangelizing about it to coworkers and friends for years, it's definitely the future of authentication, but that's only marginally relevant, in the case of sensitive data like this you want the data to be both encrypted at rest and during transmission, with a unique pre-generated key, otherwise a rogue employee or in general someone with access to the database can see everything, regardless of anything else.
"If the data was properly encrypted and only decrypted on the user’s machine with the key."
TLS is "encryption" that is "only decrypted on the user's machine with [a] key". I feel like I'm completely misunderstanding what sort of protocol you have in mind though.
This breach was a failure of authentication via reused passwords. It's the exact scenario WebAuthn is designed to mitigate. I have no idea how you could consider it to be "marginally relevant".
I don't know what you mean. Just that the database should be encrypted (I have no reason to believe it wasn't) or that the company should encrypt the data such that the only person who can view it at all is the person whose account it is for?
If they encrypt it, how will they sell them to third parties
A strange number of engineers think DARE and transmission encryption are sufficient for sensitive data, as though that encryption isn't effectively transparent if the tools designed to access it are compromised.
Fair point!
To be clear I wasn't arguing that DARE is enough, you are absolutely correct that depending on the situation it isn't, but in my opinion in this specific case. if the data was DAREd, and sent to the user in its encrypted state and only decrypted on the user's machine with the user's key, that's not stored in any server, it would have completely fixed this specific issue. Naturally, however, to your point, with encryption there is no one-size-fits-all argument!