Genetic testing company 23andMe said Monday that hackers were able to access the data of about 6.9 million people, far more than the company previously acknowledged.
The finding is the result of an investigation 23andMe launched in October, after at least one list of people whom the site identified as having Ashkenazi Jewish ancestry was posted online.
How is TLS relevant in this discussion? In this specific case TLS only solves MiTM, that’s it.
It was an offhand comment in a lemmy post, of course I’m not gonna go into details… but fair enough
This is a bit disingenuous, don’t you think? To be clear I like WebAuthn, I think it’s a great technology that I’ve been evangelizing about it to coworkers and friends for years, it’s definitely the future of authentication, but that’s only marginally relevant, in the case of sensitive data like this you want the data to be both encrypted at rest and during transmission, with a unique pre-generated key, otherwise a rogue employee or in general someone with access to the database can see everything, regardless of anything else.
“If the data was properly encrypted and only decrypted on the user’s machine with the key.”
TLS is “encryption” that is “only decrypted on the user’s machine with [a] key”. I feel like I’m completely misunderstanding what sort of protocol you have in mind though.
This breach was a failure of authentication via reused passwords. It’s the exact scenario WebAuthn is designed to mitigate. I have no idea how you could consider it to be “marginally relevant”.
I don’t know what you mean. Just that the database should be encrypted (I have no reason to believe it wasn’t) or that the company should encrypt the data such that the only person who can view it at all is the person whose account it is for?