• 0 Posts
  • 16 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle







  • Yes, it is. The only change being made is that WebKit home apps are being allowed. Since Apple couldn’t create the Home app frameworks for third party apps, they disabled all of them to comply with the new rules. This just means that, unless the EU says otherwise, Home Screen WebKit apps are still ok without needing to open to third-party engines. This is a non-story as that is already the currently released functionality and the change was only made because Apple was attempting to be conservative with its compliance.


  • I’m seeing so much FUD and misinformation being spread about this that I wonder what’s the motivation behind the stories reporting this. These are as close to the facts as I can state from what I’ve read about the situation:

    1. 23andMe was not hacked or breached.
    2. Another site (as of yet undisclosed) was breached and a database of usernames, passwords/hashes, last known login location, personal info, and recent IP addresses was accessed and downloaded by an attacker.
    3. The attacker took the database dump to the dark web and attempted to sell the leaked info.
    4. Another attacker purchased the data and began testing the logins on 23andMe using a botnet that used the username/passwords retrieved and used the last known location to use nodes that were close to those locations.
    5. All compromised accounts did not have MFA enabled.
    6. Data that was available to compromised accounts such as data sharing that was opted-into was available to the people that compromised them as well.
    7. No data that wasn’t opted into was shared.
    8. 23andMe now requires MFA on all accounts (started once they were notified of a potential issue).

    I agree with 23andMe. I don’t see how it’s their fault that users reused their passwords from other sites and didn’t turn on Multi-Factor Authentication. In my opinion, they should have forced MFA for people but not doing so doesn’t suddenly make them culpable for users’ poor security practices.