• 3 Posts
  • 275 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle




  • It should be $0 because this was a credential stuffing attack (Using breached passwords people reused), and affected people who knowingly shared their data with other people.

    23&me didn’t leak data, they didn’t have any database breaches, their infrastructure wasn’t compromised due to negligence…etc The majority share of negligence is in the users here.

    Yes, they should have MFA, but also no, most sites and services don’t force you to use MFA to begin with, and that’s not a regulatory requirement anyways.

    This is, for the most part, the fault of the folks using terrible security practices such as refusing passwords and sharing their data with other users. And this is a shitty precedent to set where the technical reasons for this event are thrown out the window in favor of the politics of it.
















  • I’m not sure why you’re so dismissive of this? It’s kind of asinine.

    Does everyone everywhere only ever use computers in an enclosed room? Is everyone with something value to exfiltrate easily accessible to kidnap and beat with a wrench?

    This is valuable for corporate espionage, political purposes, or for nation states. If miniaturized, even easier for targeted attacks where it might be difficult to inject malware, or for broad attacks on office workers.

    And the best part is that it doesn’t leave a trace which beating someone with a wrench and malware would do…