[tgsovlerkhgsel]

> Why are you letting people log into an account from a brand-new IP with no additional verification?

Because having to play a game of "Simon Says" every time I try to log into an account pisses off customers.

Humble Bundle, for example, lost several sales because you can't even buy a game for an e-mail address that has an account without logging into the account, which requires not just the password (stored in my password manager that I may not have with me everywhere I have my credit card), but also logging into my e-mail and clicking a link.

The EU has decided to force banks and payment providers to implement this nonsense because companies like e.g. PayPal decided to rather eat the cost of non-prevented fraud than putting an extra barrier in front of users and losing the users to competitors (by forcing everyone to do it, they prevented companies from competing on this aspect of UX).

[morsch]

This story about genetic data and other sensitive health data being leaked doesn't really make the case for letting the market solve this particular problem without onerous regulations.

I suppose massively increasing the liability would solve the problem by doing a little of both.

[averageRoyalty]

Private companies should not be holding such data regardless, so the point becomes moot.