6 ms·
So, to play devil's advocate, 23andMe shouldn't allow credential stuffing to happen by rate limiting logins after so many failed logins, or locking accounts aft
by maxrecursion 3y ago
So, to play devil's advocate, 23andMe shouldn't allow credential stuffing to happen by rate limiting logins after so many failed logins, or locking accounts after failed logins.
They could've blocked source IPs making all the login requests, but that was probably being changed to not set off alarms. However, there wasn't enough information in the article to go on, but since they suffered so many breaches of user accounts, they probably had to do something wrong. I'm too busy to dig into the specifics.
- RajT88 3y agoNot just rate limiting logins, but rate limiting queries against their user base (10k logins compromised, and data on ~6 million people scraped). Additionally, they don't support 2FA/MFA which of course would mitigate some of the risk of password re-use. There's plenty of things they could have done to prevent this breach.
- adrianmonk 3y agoContinuing devil's advocate, we don't know that they didn't do those things. Maybe they did and that's why it's only 14,000. If an attacker works off lists of compromised usernames and passwords from various sites, for a given user there's always a chance that the first one they try is correct. Especially for the kind of user who recycles the exact same password on 50 different sites. (Incidentally, you should probably try to hack that kind of user first, and for each user, try their most-recycled passwords first.)