dpkonofa

Considering that the court already determined that Apple is owed the commission for the initial lead, it absolutely would survive a court challenge.

That’s not really relevant. OP said they would deny any warranty work if there was even a drop of water on the outside. I’m proving that hyperbole isn’t true.

This is not true. I fully submerged my phone in a pool and took video underwater and they replaced it under warranty.

>even if a drop of water gets on the external case, they will refuse to honor the warranty

This is both not true and so hyperbolic it's ridiculous. IP68 is only colloquially "waterproof" as none of the IP ratings have an indefinite exposure time.

That's IP68 Water Resistance. That's not the same thing as Waterproof.

None of those things would trip the internal liquid sensors, though. That's the entire point. If the phone is actually up to spec (which, I have to assume it is), then any internal liquid damage would have to come from using the phone out of the spec.

Yes but the triggers are inside the phone, not inside the port. This detection is only for liquid in the port so as to prevent corrosion and damage to the port itself.

Are you a lawyer, by chance? Because this is the exact argument I keep making and the part that I really don't understand at all at the anti-Apple positions people take. If they were truly a monopoly, I'd be all for breaking it up but they're really not and I don't see how this falls into that definition for exactly the reasons you've stated.

You probably won't answer this now since it's so much later but can you point out where I was snarky? I'm being absolutely serious here because I don't understand where I was snarky to where you jumped to "So maybe save your downvote next time until you know what you’re talking about." Just trying to avoid the immediate escalation in the future and maybe I'm being aggressive and not knowing it?

The analogy does fit. You're just mischaracterizing it. To continue on with your example, that's not what happened with 23andMe. If you gave your son access to your checking account via some account info sharing feature and someone gets access to his account, they have access to the same accounts he does and only those. Your business partner's info is safe unless he also shared his account with your son and his parents' info is safe unless they also shared with him.

The only info that was available form the 7 million accounts was specific info that they chose to share with the other account. If they chose to share everything, then everything would be available. 23andMe can't prevent their users from being idiots.

For starters, I didn't downvote you and couldn't even if I wanted to since HN doesn't allow you to downvote replies to your own comments.

For another, I got the threads confused and thought you were talking about the accounts that shared access with compromised accounts. Sorry. Relax yourself before you jump to immediately into your persecution complex.

Yeah… you can’t protect users from themselves and, apparently, others.

I think you misunderstood my Tor reference. The person that exhilarated the data from the hacked site attempted to sell the data via Tor, not that Tor somehow leaked user’s data.

> We’re talking about raw DNA data here that is accessible

No, we’re not. Have you ever used 23andMe before?

The current info that's been released seems to indicate that they used a botnet over the course of several months and had access to the "last known login location". So there wasn't any "smashing" happening and no "you're signing in from a different location" blocks either.

This is the part you don't have right:

>approximately all of which did nothing wrong

They shared some of their data with the users who messed up. All of their info wasn't accessible. The only data that was accessible was the data that was shared with these users - in other words, opting in to sharing data with total strangers (which could be argued but is the #1 use case for 23andMe).

It's not unfair. The data that was exfiltrated is data that was accessible to the users.

If someone gives their routing number and checking number to a scammer, that is also considered "using the platform in any way other than intended". In 99% of cases, you'd be providing that information to someone you had an actual business relationship with. My employer, for example, might have that info in order to process my direct deposit payments. A debtor may have that info in order to process ACH payments. Giving that info to a total stranger would be an issue but that wouldn't be the bank's fault. Neither would it be the bank's fault if you chose a poor or reused password.

That's what happened here. Users shared data with total strangers who requested their connection to their DNA data based on some percentage of shared DNA. Users accepted those requests. The users who reused their passwords had all their info accessible. The users who accepted sharing requests with those users had their shared info accessible. Both cases are "using the platform as intended".

I think you're being a bit dishonest with these replies. By any definition of the word "system", you're implying that they act in concert as a single unit. The entire point of a botnet is that none of the endpoints are individually distinguishable from the rest.

I still don't understand how so many people can have that info public. Blows my mind...

That's not what happened. The 7 million users didn't have their data stolen. The compromised accounts had access to data that those users opted-in to share with those accounts.

Imagine that you have a bank account and you share access to it with a family member. If they use "Password1" for their password and someone gets into their account and then, by extension, has access to whatever level of access you've provided them to your account, is that the bank's fault? Is it yours? Is it your family member's?

That assumes that haveibeenpwnd knew about this leak which would only be possible if the leaked data was posted publicly. It doesn't seem to have been as the hacker was looking to sell the information.

How would you know they're compromised before you know they're compromised? According to the info I've read about this, the site and database that was breached was not published publicly but was sold privately on the dark web.

You can't see just anyone's DNA. You have to opt-in to the program and share it with specific users, in nearly every case someone who is a distant relative that is tantamount to a stranger.

No, we're not playing a semantics game. The access wasn't "unauthorized" if the person that "hacked" it was using the person's right email and password. MFA was also available and the hacked accounts did not have it enabled. It's not 23andMe's fault that users reused passwords and chose not to enable MFA. This isn't about weak passwords or passwords that were known to be leaked on sites like HaveIBeenPwned. Was there more they could have done? Of course. Is it their fault? Absolutely not. Are they liable in any sort of legal sense? Absolutely not.

A botnet is not a single system. It is a network of multiple compromised computers or devices, in all kinds of locations. Each piece of a botnet could be in a different country or even city.

HIBP only knows about breaches that are made public. Based on the current evidence, this was not a breach that was made public. It was a breach being sold.

That’s the problem. There wasn’t anything suspicious. From what I’ve read, the “hackers” used a botnet, aided with location/IP data from the leak. There would be nothing suspicious about a login with the correct email and password coming from the right location.

I think you’re misunderstanding what happened in this situation. Nothing was stolen from 23andMe and no 23andMe accounts were “hacked into”. The “hack” happened on another site and the hacker got a database leak of usernames and passwords for that site (not 23andMe). Some of the users of that site used the exact same email addresses and passwords for their 23andMe accounts.

If you use “Hunter2” as a password for all of your accounts and AOL gets hacked, the hackers know your password is “Hunter2”. If they get into your Facebook or Gmail account because you also used “Hunter2” there, that is neither Facebook’s or Gmail’s fault. It is your own fault.

You won’t have to. They could have forced MFA and been done with it. That doesn’t make it their fault that they didn’t. It just means they could have done better and assumed that at least some users (read: most) are ignorant about best practices with sensitive data. It’s not something they would be legally culpable for, though.

You don’t know that they weren’t. HIBP is not omniscient. It doesn’t automatically get a list of leaked account info unless that info is published publically. Based on the current evidence I’ve seen so far, that’s not the case. It seems like the breached data was sold privately on the dark web and was tested for months via a botnet. It also seems like the leaked data included either IPs or last known login location info which means someone with a sizable enough botnet could have used that info to login from nearby locations, thereby bypassing any prompts triggered by “new locations”.

How would they know which passwords were breached? The data leak was from a different site and not from 23andme. Additionally, current evidence suggests that the breach was not known on haveibeenpwned prior to it being used and the reused credentials were tested over a period of months using a botnet.