<story><title>23andMe tells victims it&apos;s their fault that their data was breached</title><url>https://techcrunch.com/2024/01/03/23andme-tells-victims-its-their-fault-that-their-data-was-breached/</url></story><parent_chain><item><author>JohnMakin</author><text>Where your first argument falls apart is the other several million users who had their data breached didn’t have compromised accounts. It quite literally isn’t their responsibility or problem at all.</text></item><item><author>ziddoap</author><text>On one hand, I have to somewhat agree with 23andMe here. If someone uses the password &amp;quot;password1&amp;quot; for some service, they should not be able to turn around and blame that service when their account is compromised.&lt;p&gt;On the other hand, 23andMe should have definitely done much more to reduce the blast radius of this attack. Mandatory 2FA, disallowing known-compromised passwords, geolocation of login IPs, etc.&lt;p&gt;I guess the question shakes out to: where do we draw the line on personal responsibility vs. service responsibility? Services can&amp;#x27;t be responsible for 100% of user security. But they also can&amp;#x27;t be negligent in their own security and mitigations.</text></item></parent_chain><comment><author>lolinder</author><text>When you send people secure information through any means, you are accepting that the security of that information is now equivalent to the &lt;i&gt;worst&lt;/i&gt; level of security practices of all the people who received that information. When the recipients are a large collection of random strangers on the internet, you should assume the data is as good as public, because the average random stranger on the internet has terrible security practices (not to mention the non-zero probability that they&amp;#x27;re actively malicious).&lt;p&gt;23andMe could have done a better job communicating the risks of sharing your data with random strangers on the internet, but it&amp;#x27;s also not unreasonable for them to put some level of blame on users. If you wanted to treat that information as secure, you shouldn&amp;#x27;t have opted in to sharing it with an arbitrary number of strangers.</text></comment>
<story><title>23andMe tells victims it&apos;s their fault that their data was breached</title><url>https://techcrunch.com/2024/01/03/23andme-tells-victims-its-their-fault-that-their-data-was-breached/</url></story><parent_chain><item><author>JohnMakin</author><text>Where your first argument falls apart is the other several million users who had their data breached didn’t have compromised accounts. It quite literally isn’t their responsibility or problem at all.</text></item><item><author>ziddoap</author><text>On one hand, I have to somewhat agree with 23andMe here. If someone uses the password &amp;quot;password1&amp;quot; for some service, they should not be able to turn around and blame that service when their account is compromised.&lt;p&gt;On the other hand, 23andMe should have definitely done much more to reduce the blast radius of this attack. Mandatory 2FA, disallowing known-compromised passwords, geolocation of login IPs, etc.&lt;p&gt;I guess the question shakes out to: where do we draw the line on personal responsibility vs. service responsibility? Services can&amp;#x27;t be responsible for 100% of user security. But they also can&amp;#x27;t be negligent in their own security and mitigations.</text></item></parent_chain><comment><author>ziddoap</author><text>They opted-in to the sharing feature though?</text></comment>