▲ 828 ▼ 23andMe tells victims it's their fault that their data was breached | TechCrunch (techcrunch.com) submitted 2 years ago by Eezyville@sh.itjust.works to c/technology@lemmy.world 275 comments fedilink hide all child comments Hope this isn't a repeated submission. Funny how they're trying to deflect blame after they tried to change the EULA post breach.
[–] Thann@lemmy.ml 40 points 2 years ago (5 children) IP based rate limiting IP locked login tokens Email 2FA on login with new IP permalink fedilink source parent hideshow 5 child comments replies: [–] Umbraveil@lemmy.world 21 points 2 years ago* IP-based mitigation strategies are pretty useless for ATO and credential stuffing attacks. These days, bot nets for hire are easy to come by and you can rotate your IP on every request limiting you controls to simply block known bad IPs and data server IPs. permalink fedilink source parent [–] CommanderCloon@lemmy.ml 13 points 2 years ago (3 children) The attackers used IPs situated in their victims regions to log in, across months, bypassing rate limiting or region locks / warnings I don't know if they did but it would seem trivial to just use the tokens in-situ once they managed to login instead of saving and reusing said tokens. Also those tokens are the end user client tokens, IP locking them would make people with dynamic IPs or logged in 5G throw a fuss after the 5th login in half an hour of subway Yeah 2FA should be a default everywhere but people just throw a fuss at the slightest inconvenience. We very much need 2FA to become the norm so it's not seen as such permalink fedilink source parent hideshow 3 child comments replies: [–] Fiivemacs@lemmy.ca 3 points 2 years ago (1 child) I'm cool with 2fa, I'm not cool with a company demanding my cellphone number to send me SMS for 2fa or to be forced to get a 2fa code via email...like my bank. I can ONLY link 2fa to my phone. So when my phone goes missing or stolen, I can't access my bank. Only time I have resisted 2fa is when this pooly implemented bullshit happens. permalink fedilink source parent hideshow 1 child comment replies: [–] JackbyDev@programming.dev 2 points 2 years ago Pro tip, when making a new Google account and putting your phone number in be sure to look into more options. There is a choice to only use it for 2fa and not for data linking. permalink fedilink source parent [–] unphazed@lemmy.world 3 points 2 years ago 2 factor beats the hell outta that "match the horse with the direction of the the arrow 10x" bs permalink fedilink source parent
[–] Umbraveil@lemmy.world 21 points 2 years ago* IP-based mitigation strategies are pretty useless for ATO and credential stuffing attacks. These days, bot nets for hire are easy to come by and you can rotate your IP on every request limiting you controls to simply block known bad IPs and data server IPs. permalink fedilink source parent
[–] CommanderCloon@lemmy.ml 13 points 2 years ago (3 children) The attackers used IPs situated in their victims regions to log in, across months, bypassing rate limiting or region locks / warnings I don't know if they did but it would seem trivial to just use the tokens in-situ once they managed to login instead of saving and reusing said tokens. Also those tokens are the end user client tokens, IP locking them would make people with dynamic IPs or logged in 5G throw a fuss after the 5th login in half an hour of subway Yeah 2FA should be a default everywhere but people just throw a fuss at the slightest inconvenience. We very much need 2FA to become the norm so it's not seen as such permalink fedilink source parent hideshow 3 child comments replies: [–] Fiivemacs@lemmy.ca 3 points 2 years ago (1 child) I'm cool with 2fa, I'm not cool with a company demanding my cellphone number to send me SMS for 2fa or to be forced to get a 2fa code via email...like my bank. I can ONLY link 2fa to my phone. So when my phone goes missing or stolen, I can't access my bank. Only time I have resisted 2fa is when this pooly implemented bullshit happens. permalink fedilink source parent hideshow 1 child comment replies: [–] JackbyDev@programming.dev 2 points 2 years ago Pro tip, when making a new Google account and putting your phone number in be sure to look into more options. There is a choice to only use it for 2fa and not for data linking. permalink fedilink source parent [–] unphazed@lemmy.world 3 points 2 years ago 2 factor beats the hell outta that "match the horse with the direction of the the arrow 10x" bs permalink fedilink source parent
[–] Fiivemacs@lemmy.ca 3 points 2 years ago (1 child) I'm cool with 2fa, I'm not cool with a company demanding my cellphone number to send me SMS for 2fa or to be forced to get a 2fa code via email...like my bank. I can ONLY link 2fa to my phone. So when my phone goes missing or stolen, I can't access my bank. Only time I have resisted 2fa is when this pooly implemented bullshit happens. permalink fedilink source parent hideshow 1 child comment replies: [–] JackbyDev@programming.dev 2 points 2 years ago Pro tip, when making a new Google account and putting your phone number in be sure to look into more options. There is a choice to only use it for 2fa and not for data linking. permalink fedilink source parent
[–] JackbyDev@programming.dev 2 points 2 years ago Pro tip, when making a new Google account and putting your phone number in be sure to look into more options. There is a choice to only use it for 2fa and not for data linking. permalink fedilink source parent
[–] unphazed@lemmy.world 3 points 2 years ago 2 factor beats the hell outta that "match the horse with the direction of the the arrow 10x" bs permalink fedilink source parent