Genetic testing company 23andMe said Monday that hackers were able to access the data of about 6.9 million people, far more than the company previously acknowledged.
The finding is the result of an investigation 23andMe launched in October, after at least one list of people whom the site identified as having Ashkenazi Jewish ancestry was posted online.
I’m saying that the fact that they accessed the data through compromised accounts is irrelevant. If the data was properly encrypted and only decrypted on the user’s machine with the key.
You made a lot of assumptions there.
I’m not really familiar with the entire process of how 23AndMe but based on what the service is I assume that they ship you a box with a vial or maybe a swab to collect saliva, then include a code, maybe a qr code or a redemption id that you can use to register on their website.
The packaging could very easily include a QR code with an RSA or EDCSA key, then the website could ask you to scan that QR code to login.
The website would then use that to calculate the public key based on that private key and make a request to the server for the data associated with that public key, then the user’s browser would decrypt that data and display it
What exactly is the problem here? If anything it’s simpler than username/password from a user standpoint.
And as for WebAuthn, yeah that would work and it’s definitely better than a password, and would perhaps solve part of the issue, but as a user I would feel much safer with my implementation
It was encrypted and only decrypted on the user’s machine. It’s called TLS.
Well of course I did - all you said was “use encryption” like that meant anything specific.
Your proposed solution has lots of problems and isn’t materially more secure than properly implementing WebAuthn or even requiring MFA. All you’ve added is a public/private key authentication which is what WebAuthn does.
You also need a solution for lost keys, using multiple browsers, etc. or nobody will use it. This is also being provided by WebAuthn.
The problem here is not “encryption” it’s “properly identifying who should have access to the data.” It’s an authentication problem. The data was encrypted from the servers to the browser in a secure manner. At issue here is account security and authentication.
To be clear - you solution would “work” but without the above issues addressed nobody will use it because it will be a giant pain in the ass. It’s not like we don’t know how to share data securely, it’s that doing so is complicated and often relies on users to be sophisticated about security. They’re your weakest link so you need a system that:
And this is what WebAuthn promises.
It only has to solve part of the issue. The end-to-end encryption is covered with TLS.
I don’t see what your solution would do that isn’t covered by existing tech. And it would require a lot of new protocols to be put in place, support by major browsers, good user interfaces, etc.
How is TLS relevant in this discussion? In this specific case TLS only solves MiTM, that’s it.
It was an offhand comment in a lemmy post, of course I’m not gonna go into details… but fair enough
This is a bit disingenuous, don’t you think? To be clear I like WebAuthn, I think it’s a great technology that I’ve been evangelizing about it to coworkers and friends for years, it’s definitely the future of authentication, but that’s only marginally relevant, in the case of sensitive data like this you want the data to be both encrypted at rest and during transmission, with a unique pre-generated key, otherwise a rogue employee or in general someone with access to the database can see everything, regardless of anything else.
“If the data was properly encrypted and only decrypted on the user’s machine with the key.”
TLS is “encryption” that is “only decrypted on the user’s machine with [a] key”. I feel like I’m completely misunderstanding what sort of protocol you have in mind though.
This breach was a failure of authentication via reused passwords. It’s the exact scenario WebAuthn is designed to mitigate. I have no idea how you could consider it to be “marginally relevant”.
I don’t know what you mean. Just that the database should be encrypted (I have no reason to believe it wasn’t) or that the company should encrypt the data such that the only person who can view it at all is the person whose account it is for?