There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

Chickenstalker ,

Bring out the guillotines!

Doxatek , (edited )

I worked at McDonald’s to be able to afford to go to college and they sold my fingerprint data. I got like 50 dollars in the mail for compensation. Always thought that was fucked. They probably made more selling it all than the settlement was. I should’ve gotten a lot

tiny_electron ,

I am honestly surprised you got anything at all

Doxatek ,

Honestly same as well

Garbanzo ,

This logic is equivalent to a bank saying, “It’s not our fault your money got stolen; you should have had a better lock on your front door.”

Isn’t that exactly what the bank would tell you if someone stole your personal info from your home and used it to empty your account?

This author is a dumbass.

starman2112 ,
@starman2112@sh.itjust.works avatar

It seems to me like the biggest problem was that in accessing just 14,000 accounts, they got some amount of personal information of nearly 7 million people. Less “you should have had a better lock on your front door” and more “your neighbor’s cousin should have had a better lock on his front door.”

totallynotarobot ,

And a little of the old “it’s really your fault for listening to us when we said you didn’t need a better lock because wE tAkE cUsToMeR pRiVaCy VeRy SeRiOuSlY.”

Appoxo ,

Read DNS and wondered why those are supposed for that to happen lol.

In regards to the headline: Just don’t use that service and discourage anyone in the family?
Seems more like a gimmick to me.
If I’d need something like that, I’d go to a professional lab.

Darkassassin07 , (edited )
@Darkassassin07@lemmy.ca avatar

Maybe you shouldn’t use the same user+pass across dozens of different services then.

The data from 23 and Me was stolen using the legitimate login credentials of users acquired from an entirely different services data breach. Not via their own lax security policies.

You can’t expect a corporation to protect you from yourself. And they certainly shouldn’t be punished for your ineptitude.

Don’t get me wrong, these corporations are not your friends, and shouldn’t be trusted implicitly; but you have some responsibilities too.

/edit:

But when the chips are down and our data is leaked, they hide behind the old “we were not hacked; it was the users’ old passwords” excuse.

This logic is equivalent to a bank saying, “It’s not our fault your money got stolen; you should have had a better lock on your front door.” It’s unacceptable and a gross abdication of responsibility.

I completely disagree with this point. The service obviously has to provide you with access to your information/account. If you give out your login credentials for that access to a third party (another service), that third party loses your information, and it’s then used to access stuff posing as you. That’s your fault. You should not have shared (re-used) those same login credentials with others.

Rinox ,

Well they should have 2fa, but yes, if that’s the case I agree with you.

Use Bitwarden or KeePass

Darkassassin07 ,
@Darkassassin07@lemmy.ca avatar

Unfortunately, even that’s not enough.That’s often a user choice to enable, and otp itself is a flawed system. (be that email, sms, or timed)

Really, services should be transitioning to Passkeys, however adoption of a new standard always takes time. There are not a huge number of services that have implemented them yet. Here’s a list

Appoxo ,

TOTP is better than no TOTP/2FA.

Darkassassin07 ,
@Darkassassin07@lemmy.ca avatar

It sure is. My point is that users often don’t enable 2fa even when available, while those that do are still at risk anyway.

Id rather see a much less flawed system implemented, particularly for important services like ones that store your genetic code.

starman2112 ,
@starman2112@sh.itjust.works avatar

I don’t like passkeys. There’s the old thing about good security being the thing you have, the thing you know, and the thing you are–a key, a password, and biometrics. I don’t like keys or biometrics for anything online. Mainly because of 5th amendment issues (police can hold your finger to your phone to unlock it, but they cannot compell you to say what your password is), but also because either it’s more secure than using a password (if you lose the thing you have, you’re fucked) or it’s the same as using a password (if you lose the thing you have, you can enter a password to get it back).

Why can’t we just normalize memorizing complex passwords? It isn’t that hard if you dedicate some effort to it instead of lazily making it Currentmonth123!$

Darkassassin07 , (edited )
@Darkassassin07@lemmy.ca avatar

I currently have 75 different accounts stored, each with a unique 16 character randomized password. My memory cannot handle remembering each one alongside their username and which service they are used for. I don’t think it’s reasonable to expect anyone to.

You are not required to secure passkeys with biometrics, you can just use a password to encrypt them if you want, removing the possibility of forced unlock.

With that many logins, I use a password manager anyway. Regardless of whether I use passwords or passkeys; that is always going to be target. With passkeys, that manager+my device are only possible targets to gain access to my accounts. With passwords every service is also a target, along with every connection I make to that service.

A random example: If I login to twitter with a password using a work computer, that password is more than likely now sitting in a log file on the corporate firewall that performs https inspection. That could be used to gain access to my account later.

Replace that password with a passkey, and now there’s no ability to harvest and use login info from those logs. All they saw was the passkey challenge and response sent back/fourth with no ability to replicate it later.

While yes, you can usually recover you passkeys with a password and the appropriate access to the systems where they are backed up; the difference is very rarely using a password as a recovery code, vs using a password regularly giving much more opportunity for it to be intercepted or mishandled. The systems my password manager backs up to are also my own and not publicly accessible. (you don’t have to use google/apples managers)

Also the passwords used for account auth are stored in my password manager, where as my password managers password is only stored in my mind. One is easy to remember, 75 is a bit much…

Rinox ,

Why can’t we just normalize memorizing complex passwords? It isn’t that hard if you dedicate some effort to it instead of lazily making it Currentmonth123!$

This is just a stupid take. I bet you either reuse your passwords regularly or you don’t really use the internet that much. I just looked it up and I have 270 unique logins, with as many 20 characters long passwords, with letters numbers and special characters.

Now tell me with a straight face that you think everyone can memorize that.

starman2112 ,
@starman2112@sh.itjust.works avatar

Anything I have to log into frequently gets memorized. Anything I set and forget gets reset every time I log in. I don’t know my Xbox password, and I don’t need to, because the next time I need to log in I can just use my email address and reset it to like 2023!TheDayBefore$ucked! or something stupid and unguessable like that. Then 6 months later, when I can’t even fathom what I would have set it to, I’ll reset it again.

And then ofc the few super important things like my bank and email get special unique 20+ character passwords that I memorize

YoorWeb ,

While a one-time passcode can be lost or stolen, nobody can steal your face.

https://lemmy.world/pictrs/image/f75e1173-284d-401e-9830-a46c60d8d838.png

Rinox ,

Thanks for the link, I wanted to read up on passkeys since the other day, as GitHub asked me to set one up with Bitwarden

PowerCore7 ,

The first link is basically an “advertisment hidden in a normal, professional-looking article”. All they’re saying is how these ways are not secure, but most importanly, how their solution is more secure, published under their own site.

When you take this into account, their claims start to break down: while yes, email and SMS MFA might be inherently less secure since the code could be transmitted via an insecure channel, saying TOTP is not not secure because “you device can be hacked” is a kinda bad take: if your device is already hacked, you’d have a much bigger problem: even if you are using security keys, the hacker would already have access to whatever service you might be trying to protect. As for the lost/stolen case mentioned in the article, if you put TOTP code in a password manager (as most would probably do if they’re doing this), that shouldn’t be a problem. The only way this would be a problem is that the TOTP secret is stored in plain text, which would be the same for any authentication methods.

bandario ,
@bandario@lemmy.dbzer0.com avatar

You nailed it. Users cannot be trusted to not re-use login credentials.

I know we all hate it, but proper 2-factor authentication via authenticator apps must be the default position for everything.

chatokun ,

I work in IT and don’t want to have to use annoying long passwords, so I’ve been team mfa for at least a decade now. I had physical code devices for SWOTR and FFXIV until I got a software one for the latter. I don’t play the former much but I still have a working physical key somewhere.

In fact, I’m more annoyed when a service still uses texting your phone and no option to use a mfa app.

spudwart ,

Legit have had conversations with people where they position themselves as superior because they use “the same password” but with an @ instead of an a, or an extra 0 at the end.

Password Managers are really the best solution to using 1 password everywhere without actually putting yourself at risk. 1 password, to unlock the manager, that lets you copy/paste logins.

But nope 99% of all bullshit I experience in my friends and family is “but thats too complicated” or “thats too hard” when its 200% fucking not.

I’m calling them out. These are shit excuses for what their real issue is which is “i don’t wanna change my habits” which is just childish and ignorant.

Even if its easier, even if its safer. If its different, then they don’t want to even try it.

There are some people who will have “always used” a spoon to dig holes, and if you showed them a shovel, they’d complain that it’s too hard or too complex, and go back to using the spoon.

alienanimals ,

Life in prison for the executives.

douglasg14b ,
@douglasg14b@lemmy.world avatar

Because users used bad passwords and had their accounts logged into by with these legitimate passwords…?

Seems like misinformed outrage to me.

WashedOver ,
@WashedOver@lemmy.ca avatar

Many of my friends and family sent their DNA away to these outfits. Early on I just ruled it out as I heard they were able to link cold cases to people in these databases. Combine that with the grave miscarriages of justice when they railroad people into convictions my “I haven’t done anything to worry about” still did not want to be a part of that machine.

I didn’t even think of this reality which is pretty bad. I’m glad I didn’t sign up despite some interest in knowing more about my fractured family connections.

Mamertine ,

They don’t need your DNA to connect you to solve a cold case. They determine we shares tiny chunks of DNA with a sample from a crime. With that, they find the family tree of the known person and can often determine who the guilty party is.

As in they know the suspect shares a paternal great grandfather with this person and a maternal great great grandmother with that person so we know it’s one of these people. Then the police collect trash to find who from the limited pool the crime DNA belongs to.

PopcornPrincess ,

That’s some Minority Report type shit, scary stuff.

abbotsbury ,
@abbotsbury@lemmy.world avatar

Collecting evidence after a crime is the opposite of Minority Report.

homesweethomeMrL ,

The 23andMe breach saw hackers gaining access to a whopping 6.9 million users’ personal information, including family trees, birth years and geographic locations. It brings to the fore a few significant questions: Are companies really doing enough to protect our data? Should we trust them with our most intimate information?

Well . . . NO. But that has never not been the case. These fucking cheese-brained twits who pour out every scrap of personal - and genetic! - info to the tatty basket of whatever Zuckerberg their moron friends are using has been a problem from day one.

Nothing has changed. Google is evil, Twitter went fascist, facepals is an arm of the FSB, and All Your Genes Are Belong To Us. No fucking shit.

Using computers for everything requires understanding them and most. People. Don’t.

peopleproblems ,

I like entertaining the idea that purchasing technology should require some form of license like a firearm.

The only problem with the idea is that I would probably be out of a job pretty quick, given no one would be able to use computers.

Appoxo ,

I had to explain where the windows key is.
That says enough.

BearOfaTime ,

Twitter has always been a cesspool. Thanks for noticing finally.

sramder ,
@sramder@lemmy.world avatar

I swear this headline was just a comment the last time this got posted…

autotldr Bot ,

This is the best summary I could come up with:

The recent 23andMe data breach is a stark reminder of a chilling reality – our most intimate, personal information might not be as secure as we think.

The 23andMe breach saw hackers gaining access to a whopping 6.9 million users’ personal information, including family trees, birth years and geographic locations.

Government overreach is certainly a possibility, as the FBI and every policing agency in the world is probably salivating at the thought of getting access to such a huge data set of DNA sequences.

This logic is equivalent to a bank saying, “It’s not our fault your money got stolen; you should have had a better lock on your front door.” It’s unacceptable and a gross abdication of responsibility.

The fact that the stolen data was advertised as a list of people with ancestries that have, in the past, been victims of systemic discrimination, adds another disturbing layer to this debacle.

I’ve long argued that after the Equifax breach, the company should have received the corporate equivalent of the death penalty.

The original article contains 734 words, the summary contains 171 words. Saved 77%. I’m a bot and I’m open source!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •