23andMe tells victims it's their fault that their data was breached | TechCrunch
techcrunch.com
Hope this isn't a repeated submission. Funny how they're trying to deflect blame after they tried to change the EULA post breach.
You are viewing a single comment
What should it do? It should ask you to confirm the login with a configured 2FA
Yeah they offered that. I don’t think anyone with it turned on was compromised.
This shouldn't be "offered" IMHO, this should be mandatory. Yes, people are very ignorant about cyber security (I've studied in this field, trust me, I know). But the answer isn't to put the responsibility on the user! It is to design products and services which are secure by design.
If someone is actually able to crack accounts via brute-forcing common passwords, you did not design a secure service/product.
[Edit: spelling]
I've noticed that many users in this thread are just angry that the average person doesn't take cybersecurity seriously. Blaming the user for using a weak password. I really don't understand how out of touch these Lemmy users are. The average person is not thinking of cybersecurity. They just want to be able to log into their account and want a password to remember. Most people out there are not techies, don't really use a computer outside of office work, and even more people only use a smartphone. Its on the company to protect user data because the company knows its value and will suffer from a breach.
You're right, most people either don't care, or don't even know enough to care in the first place.
And that's a huge problem. Yes, companies have some responsibility here, but ultimately it's the user who decides to use the service, and how to use it.
So you admit they don't have access to the knowledge needed to make better choices for their digital security. Then immediately blame them. I think your bias from the point of view of a one that is already more informed on this sort of thing. If they don't know they need to know more, how can they be expected to do any research? There's only so much time in a day so you can't expect people to learn "enough" about literally everything.
I don't intend to blame them, I'm just making an observation.
The fact that they don't know is a problem in itself too, and spreading awareness about cybersecurity and teaching general tech literacy and common sense is not done as much as it should be.
It's exactly like you say. They don't know, and how would they? No one is ever giving them the information they need.
That's exactly right. I was about to say how people usually don't even "not take it seriously" but rather don't even think or know about it. But you already said that yourself haha :D
Or, worse, they don’t even understand it. I definitely have people in my life who know about the idea of cybersecurity and are terrified of getting hacked, but constantly do things the wrong way or worry about the wrong things. Because it’s just too confusing for them, and it’s always changing.
Just use a VPN bro and you're fine /s
Fuck mandatory 2FA. Most sites just throw SMS on there and leave it at that. I’m so tired of putting yet more of my information into services that don’t require it to utilize the service.
If TOTP was more prevalent (getting there) I might agree but then we’d be talking about how the typical user doesn’t know how to set that up.
Companies pay SMS, TOTP is free for them (just a computation...). It is utterly dumb to implement the same logic with a paid service rather than TOTP (or security keys, at this point). So yeah, I agree with the idea, but I think nowadays most 2fa is TOTPs (sadly, some require their shitty apps to do just that - Blizzard once was one of them, maybe still is).
It’s a thinly veiled method to gather more info from users when SMS is the only option.
2FA should be forced, it's not a hard thing to do.
To badbiometric data couldnt be used....