Genetic testing company 23andMe said Monday that hackers were able to access the data of about 6.9 million people, far more than the company previously acknowledged.

The finding is the result of an investigation 23andMe launched in October, after at least one list of people whom the site identified as having Ashkenazi Jewish ancestry was posted online.

  • Danny M@lemmy.escapebigtech.info
    link
    fedilink
    arrow-up
    1
    ·
    edit-2
    11 months ago

    It was encrypted and only decrypted on the user’s machine. It’s called TLS.

    How is TLS relevant in this discussion? In this specific case TLS only solves MiTM, that’s it.

    Well of course I did - all you said was “use encryption” like that meant anything specific.

    It was an offhand comment in a lemmy post, of course I’m not gonna go into details… but fair enough

    […] isn’t materially more secure than properly implementing WebAuthn or even requiring MFA.

    This is a bit disingenuous, don’t you think? To be clear I like WebAuthn, I think it’s a great technology that I’ve been evangelizing about it to coworkers and friends for years, it’s definitely the future of authentication, but that’s only marginally relevant, in the case of sensitive data like this you want the data to be both encrypted at rest and during transmission, with a unique pre-generated key, otherwise a rogue employee or in general someone with access to the database can see everything, regardless of anything else.

    • atzanteol@sh.itjust.works
      link
      fedilink
      arrow-up
      1
      ·
      11 months ago

      How is TLS relevant in this discussion? In this specific case TLS only solves MiTM, that’s it.

      “If the data was properly encrypted and only decrypted on the user’s machine with the key.”

      TLS is “encryption” that is “only decrypted on the user’s machine with [a] key”. I feel like I’m completely misunderstanding what sort of protocol you have in mind though.

      [re: WebAuthn] but that’s only marginally relevant,

      This breach was a failure of authentication via reused passwords. It’s the exact scenario WebAuthn is designed to mitigate. I have no idea how you could consider it to be “marginally relevant”.

      in the case of sensitive data like this you want the data to be both encrypted at rest and during transmission, with a unique pre-generated key, otherwise a rogue employee or in general someone with access to the database can see everything, regardless of anything else.

      I don’t know what you mean. Just that the database should be encrypted (I have no reason to believe it wasn’t) or that the company should encrypt the data such that the only person who can view it at all is the person whose account it is for?