(评论)
(comments)

原始链接: https://news.ycombinator.com/item?id=38527965

根据提供的文本,以下是有关最近 23andMe 黑客攻击的一些要点: - 黑客获取了数十万客户的个人详细信息和基因档案,包括全名、出生日期和电子邮件地址。 然而,23andMe 声称用户的密码仍然安全。 - 该攻击发生在该公司于 2016 年转向第三方云计算提供商之后。 - 用户报告收到电子邮件,表明他们的密码在登录后自动重置。然而,23andMe 坚称其系统保持完好,并暗示密码重置是通过旨在识别客户帐户可疑活动的工具触发的。 - 据 KrebsOnSecurity 称,攻击开始的时间早于最初披露的时间。 该公司在发布新闻稿宣布此次违规事件之前近三个月首次注意到异常活动的迹象。 - 撇开是否遵守特定的安全协议不谈,更广泛的问题仍然是,由于世界范围内的家庭和社区相互联系的程度,遗传数据本身往往不能简单地贴上“私人”标签。 此外,这些数据可能会泄露敏感的健康信息,具体取决于分析方式。 - 一些评论员认为,这次袭击的潜在后果可能会对社会的许多方面产生负面影响,从社会耻辱和政治两极分化到就业前景和人寿保险费。 - 隐私倡导者提出的一个主要问题是,鉴于这种敏感的基因数据在跨国界和各大洲的各个亚群体和家庭分支之间明显易于传播和传播,是否可以在法律上将其视为“公共领域”。 另一个关键问题涉及谁最终拥有和控制这一庞大的消费者基因组数据,特别是在企业、政府和其他实体应在多大程度上出于表面上的善意目的(例如科学发现和疾病诊断)而访问这些数据方面。 最后,随着人们越来越认识到特定疾病与某些环境因素之间的长期联系,一个紧迫的问题出现了,即消费者在多大程度上可能因接触与他们度过了重要时光的特定地点相关的毒素而承担经济责任或受到处罚。 中的时间量。

相关文章

原文
Hacker News new | past | comments | ask | show | jobs | submit login
23andMe confirms hackers stole ancestry data on 6.9M users (techcrunch.com)
512 points by helsinkiandrew 1 day ago | hide | past | favorite | 270 comments










This disaster is the perfect counter-argument to those always saying "why do you care so much about privacy. It doesn't affect you when I share things. You can just choose not to do it", except no, I can't choose when we're relatives and you chose to share our genome.

It is so obvious that your relatives sharing their genomic data with 23andMe reveals a lot of information about you. We can only hope people will realize that this also holds true for collecting behavioural data on other people sharing the same background as you.



> This disaster is the perfect counter-argument to those always saying "why do you care so much about privacy. It doesn't affect you when I share things. You can just choose not to do it"

While I agree it's a perfect counter-argument to that, is that what people always say? I'm not sure I've heard that argument as much as "why do you care so much about privacy?" full stop. As in, they don't really understand why anyone should care about privacy. And this isn't really a counter argument to that, any more than any other breach. And to be fair it's not really even a counter argument to that until you show the harm that came from it. What do you think will happen to people who had their ancestry data stolen here?



I think the more common one I've heard is "Why do you care about privacy if you have nothing to hide?"

In the case of 23andme, it's a perfect answer: We don't know what's hiding in our DNA and I don't know how people will use that against me in the future.



Imagine a correlation study between genes and worker productivity, it'd be an interesting study if done correctly, but it might not be done correctly (and to be clear, I don't think it should be done at all). Now imagine you have genes that have a negative correlation with productivity which makes it hard for you to find work.


Its illegal to discriminate on terms like this though. Replace the word gene with demography and you can see why.


Well, thankfully with AI, we all know the answer. If a computer learns enough about you, it can steal all of your money from the bank.


So, the reason for privacy is because the profit motive of capitalism is not sufficiently restrained as to protect citizens from being abused by corporations?


Be careful you don't break something with those gymnastics.

The immediate concern I had with this story is nefarious groups or individuals purchasing this data to target people with violence based on their ethnicities. Imagine if the genome of millions of Europeans was available on the black market in 1930s Europe.



That is one SOLID example of what could go wrong.

It’s similar to the Office of Personnel Management data breach when every Federal Employee was just 0wn3d. It included 21.5 million background investigations into people and the personnel files of every federal employee and most contractors.

Just slightly sensitive stuff. Nobody knows how many people died as a result of the hack, but I’m sure it was non-trivial because a LOT of people got surprised doxed.

This information is still rattling around out there and will have implications for generations.

Imagine if the same could be done for demographics based on genetics — the risk factors for medical conditions, the ethnic ties you’re talking about, etc.

It’s weighty stuff.



Considering one of the hacker's first actions was to offer for sale data identifying people of Jewish or Chinese descent I think that's a very valid concern.


Did anybody actually buy it though? This could be misdirection, or just misguided marketing based on historical instances of abuse. China isn't known for trying to repatriate descendants, and it's not exactly difficult to find Jews.

Ancestry data would certainly be of interest to a particular demographic known to discriminate by caste. There's no escaping your low-class heritage when anyone can look up your stolen DNA profile on the black market.



"not exactly difficult"...

I'm not Jewish, but I feel like there's some sort of reason for them not wanting a list of who they and where they live to exist.



If only Communists wore little hats, followed predictable schedules, performed a particular surgical operation on all males, wore unique symbols, put specific candelabras in the window, associated with many others of their beliefs, and attended service at well-known locations dedicated solely to their cause, we'd have an easier time rounding all of them up.

No, we need DNA profiles to find Jews. They're as elusive as the fucking Illuminati. There's just no way to find them unless we have blood samples and stolen DNA profiles.

Limited time offer: accuse Israel of war crimes on social media. The Jews will come to you.



Yes, because pogroms have solely been targeted against practicing Jews.

There are a ton of Jews who don't follow kosher law, who aren't particularly religious, etc etc. Yet they would be targeted by anti-semites.



It doesn’t matter if it got bought because it’s indelibly available forever now. It’s now available to someone who shouldn’t have it whenever they come around with the intent to misuse it.

And the choice to share or protect this information just got taken away from every one of their customers forever.



I'll take this one step further.

What if you're able to pinpoint unique loci for an individual or group which can serve as a target of a highly specific bio-weapon? Do you think genomic bio-weapons aren't being explored as future weapons?



If a group wanted to do that why bother with the dna data? Easier to just perform the violence. Even in 1930s europe I’d bet the SS would not really be concerned with whatever your dna data said if they really wanted you or your people gone, you’d just be labeled an enemy and sent off same as a jew or a gypsy or a communist.


The proper reason to give for privacy is: I don't need to have a reason for privacy; you're the one that needs to justify violating it.


Or a rival country could create a virus that targets 80% of their enemies population and only 20% of their own


Until that virus mutates its receptor binding protein.


This is tin-foil hat nonsense.


Unless you speak Kikongo.


It is becoming far easier than you are aware then. Sam Harris and Rob Reid discussed in length a few years ago.

https://www.samharris.org/podcasts/making-sense-episodes/spe...



>Rob Reid is a podcaster, author, and tech investor, and was a long-time tech entrepreneur

Ah yeah, exactly who you should go to for bio-engineering advice



How do you make the leap to it being an issue of capitalism? There are plenty of bad actors who could use this information (or other hacked info) who are not a corporation seeking profit.


It’s the ideological form of “when all you have is a hammer, everything looks like a nail”


Like North Korea which by far has the most state sponsored cyber thugs per capita.


Capitalism isn't about corporations, it's about capital.


Yeah, I didn't mean 'a philosophical ideal of Capitalism'. Apologies for my imprecise question. I meant Western Capitalism which of course is a form of corporatism.


My go-to is "what if literal nazis come to power and use this information to kick-start their eugenics program", but I guess rampant capitalism is also on the threat list.


There are already businesses that practice eugenics based on illegal data like this or illegal maps


How is a map illegal?


Governements abuse people more than an economic system ever has. A corporation has never marched people to camps, nor have corporations ever imprisoned anyone for their politics. If I don’t want to deal with a corporation, I have the right not to — unless government forces me to.


> Governements abuse people more than an economic system ever has

This is true on one level, as economic systems are not actors, but abstractions for aggregates of actions; its false on a more concrete level because governments are also not real concrete actors but abstractions for aggregates of real actors.

Both governments and economic systems (and corporations, which you seem to drop in as ig they were the same as economic systems) are abstractions through which real actors act, including to oppress, and very often actions by thr same actors involves all thrre abstractions (even a single action might). Corporations, after all. are themselves creatures of gogernment through law, and economic systems exist only as ideals without being made manifest through legal systems.

> A corporation has never marched people to camps,

You probably don't want to think about most of the best known early joint-stock conpanies (any of the variously East India companies, but especially the British, the Royal African Company, etc.)

> If I don’t want to deal with a corporation, I have the right not to — unless government forces me to.

Corporations—like any individuals—can and do apply coercive force on their own with only after-the-fact review by governments (and, in many cases historically, with obvjecting governments having limited power to apply sanctions), so, no, this isn't correct.



"Corporations have never imprisoned anyone for their politics"

Really?

Let me introduce you to Steven Donziger.

https://www.theguardian.com/business/2021/jul/26/lawyer-stev...

Ho and what about all those corporations that used Jewish slaves during world war 2?

Or just today, Coca Cola killing people protesting them taking their land away or Amazon imposing atrocious work conditions to their employees?

Before blindly defending corporations I'd try and take a look at reality...

It's not as simple as "government bad and corporations good"



Corporations have pushed wars and has people shot and beaten for their politics.

And to you I guess a cotton or sugar plantation was not a capitalist enterprise?



Capitalism bad!


Exploitation good!


> What do you think will happen to people who had their ancestry data stolen here?

Sounds like an absolute treasure trove for a life insurance company. Or, would you disagree?



Yes, but one would hope that if an insurance company was caught using stolen data to calculate the premiums, that would be the end of that company and jail time for management (like the leaders of VW responsible of the emissions testing cheating).


> jail time for management

Funny! We all know it would be a lone rogue engineer that did it in the end and management would apologize on their behalf.



That assumes they do so in a really stupid and straightforward way. LLMs already exist to "AI-wash" copyrighted material in ways that technically don't violate copyright. I'm pretty sure someone will find a way to create a dodgy shell company around a foreign B2B service that reycles this data for them in a way that is technically legal to use.

"Feed personal data into this service and it'll spit out a risk assessment based on a model built on 6.9M historical health data sets."



>Sounds like an absolute treasure trove for a life insurance company. Or, would you disagree?

Disagree. Life insurance companies already requir blood tests and urine tests before insuring a consumer. They already have this data



The test labs wouldn't spend the additional funds to run a genome sequencing, or even a SNP array.


> I'm not sure I've heard that argument as much as "why do you care so much about privacy?" full stop.

I'm not sure I've ever heard anyone I know mention privacy at all, as if they're totally ignorant to it. In reality, the majority of people will just let Google or Microsoft do whatever with their personal information as long as the product or service is slightly more convenient than the last one.



You are not likely to see the statement you are discussing unless you firstly somewhat frequently get into a situation where someone says something like "why do you care so much about privacy?" and then attempt to debate the issue.

It is not necessary to show actual harm from this breach for it to defeat the tacit premise behind the statement you are discussing, which is that their profligacy with their personal data cannot, by itself, reveal any of your personal data.



I wonder if that could be used as a list of possible organ donors. I don't know what else (data) is stored there tbh but if it helps narrow down to find a kidney or heart for someone rich...


> "why do you care so much about privacy?"

Do you talk family problems with all your neighbours ? With strangers ?

How would you feel when your employer will know everything you did last night ?



"People always saying" means two different things to you and the parent commenter. Some people do always (or generally) say that. Other people do not always say it.


I'm in favor of privacy, and I'm willing to go more out of my way to not share than the vast majority of people, but I'm also in favor of individual choice, and I can't think of a privacy model that would disallow other people from sharing their information just because you have some matching information.


I can think of an easy model. Disallow collection of personal information. Pull the rug out from under "services" which are really just data collection fronts turning a profit from selling your data instead of the primary service/good for money transaction.

23andMe could still have operated legally under this scheme. They could have done the analysis and sent you a printed sheet. But no, they had to store everything to be able to double dip by selling the data to pharma companies and whoever else would pay for it.

If you can't turn a profit without underhandedly selling your users' data. You deserve to fail.



> They could have done the analysis and sent you a printed sheet.

Could they tho? The ancestry analysis itself is based on the data of other users in other parts of the world?



They are frank about also selling the data for research, it is not underhanded. It's even opt in...

For example, they talk about it on this page, which is linked from the about menu (so available with pretty small effort): https://www.23andme.com/research/

I expect lots of people also like that they get updates when information about new markers becomes available.



I trust them to opt me out, not at all. It's safer to just assume your data is being used, regardless, because it's free money to them. If/when they get caught selling data marked as Opted Out, they'll get a pittance fine, paid with other people's money and bonuses for making numbers that quarter.

You're welcome to trust them, but no I.



> Disallow collection of personal information

It's all about the money, always. So not gonna happen.



What about people who would want to donate their data to further the research?


They can enrol in studies at actual (non-profit so they don't benefit from selling data, probably public funded) research institutes.


> non-profit so they don't benefit from selling data

Non-profit in the US is a tax status. Many CEOs of non-profits enjoy multi-million dollar salaries and bonuses.



FYI, the police is able to find criminals now by finding DNA sequences similarities with your relatives. Not saying this is good or bad, I am just saying you don't know the extent of the impact to your personal freedom when your relative's DNA is shared.


Well they can narrow it down to the family, unless it was the very DNA giver that left that DNA sample on the scene of the crime.

And since 23andme (as I assume others) don't do these anonymously, there is no hope. Unless people use someone as a proxy (i.e. I-1 give my sample to a male colleague to send it as his-2, he-2 gives his sample to someone else to send it as his-3, and so on..). Police would eventually find the guilty in case of a crime, but the 23andme's of this world will be selling confusing (wrong) data.



There are plenty of cases where DNA is found at the crime scene, run through a database, match is found with a relative. Then the cops start looking at the family and boom there's your shady uncle with priors they got their guy.


Yes it has come up a few times on forensic files usually on cold cases.


If this was someone trying to fly under the radar by using this scheme to buy burner phones or some such, sure. But this is literal DNA, so even in your attempts to obfuscate, they’d know the name and the sample do not line up, but then be able to link the sample to a family and then figure out who you really are


They can narrow it down to individual family members, based on how much DNA overlap there is.


I can help track down distant family members who have committed crimes? Sounds like a plus.

I think the angst about this comes from men who don't want their status as fathers of illegitimate children (or, rapists when they were younger) unmasked.



Your father submits his DNA to 23 and Me.

One of your brothers committed a crime.

The police, during an investigation, find your father's data and realize that one of his children is the criminal.

Congratulations! You are now the target of an investigation, the purpose of which may not be to find the truth, but to successfully convict a suspect.



> You are now the target of an investigation

All you have to do to clear your name for that crime is to turn over your DNA to the police to be in their records forever[1], and Bob's [2] your brother [3].

[1] - You might be able to get a court to order that your DNA records are destroyed after proving your innocence, but it's an ask to believe this would actually happen in every case.

[2] - https://www.merriam-webster.com/dictionary/bob

bob 3 of 7 verb (2) bobbed; bobbing

transitive verb

1) obsolete : deceive, cheat

2) obsolete : to take by fraud : filch

[3] - https://www.phrases.org.uk/meanings/bobs-your-uncle.html



> I can help track down distant family members who have committed crimes? Sounds like a plus.

It's no longer so easy when the definition of "crime" gets expanded. Let's take this scenario:

- you're a first generation Chinese immigrant in the US

- a nephew of yours is in China and critical of the CCP

- you decide to have your genome scanned into 23andme or whatever to determine if you are at risk of genetic illness

- your nephew sprays an anti-CCP tag on a wall somewhere

- the Chinese police gathers DNA evidence from a laxly discarded spray can, but doesn't have fingerprints so they can't immediately link the can to your nephew

- the Chinese government, either via a legal subpoena or via espionage, gets its hands on your genetic profile from the genetic analytics company

- the Chinese government finds your data, now knows that the sprayer must be related to you in some way, and forces everyone of your family to subject to a DNA test

Sounds dystopic? Yes. But this is exactly where we will be headed. Police here in Germany already do DNA tests on petty vandalism [1].

[1] https://www.fuldaerzeitung.de/fulda/fulda-bahnhof-neuhof-dna...



It's precious that you imagine not getting your DNA sequenced will provide any sort of shield against dystopian governments.

This sort of thing looks more like a psychological crutch than an actual effective action.



That’s not what the comment was driving at. At all. It’s about how data you think is innocent can be used in a manner you never thought about nor intended for dark purposes.


Fair. On the other hand, I'm a bit surprised that anti-immigrant forces in the US haven't made DNA sampling compulsory for new immigrants. The argument would be these would be harder to track down by these techniques, because the ancestry information is not as available, giving them an "unfair" advantage over white Americans.


The US does do DNA collection for anyone it detains whether they end up being granted legal status or not.

They were processing so much DNA that they had to write a special rule allowing border agents to _not_ collect it if it would cause operational difficulties to do so.

https://www.federalregister.gov/documents/2020/03/09/2020-04...



I don’t think that fits with how people on this side of the pond think about immigration.


It fits with how some people think about immigration on either side of the pond. That some is close to 50% on the western side of the pond.


I actually had intended to point out the dangers of "scope creep". Everyone is happy with a lot of pretty invasive stuff - dragnet surveillance, targeted surveillance (i.e. bugs placed in a suspect's home/car/computer/phone), DNA and fingerprint mass tests, no-knock raids - in severe crime cases such as terrorism, murder, rape, child sexual exploitation or abduction. So far, so good, and almost all Western countries have such provisions for decades that were introduced under the premise "it's only going to be used for ".

But in recent years, the scope of said "severe" crimes list has expanded massively, across the Western world, driven by both powerful industry lobbies (such as the copyright cartels) and "concerned citizens" aka authoritarians in disguise... and now you got a DNA investigation for about 4.000€ in damages of broken glass and a ticketing ATM. No matter what: this scope creep is not justifiable.

On top of that comes the risk of "what if our governments and the tools/data they and society (both in the form of individuals and companies) possess fall into the hands of authoritarians". For a long time this risk has been laughed off, but nowadays both the far-right (in Europe and the US) and the far-left (in Southern America) have seriously raised the probability of such a scenario.



Why is DNA investigation supposed to be limited to "severe" crimes? It's just another investigative tool. The idea that it should be limited implies there's something sordid about it. Why should I accept that implication?

An amusing thing here is that the arguments against DNA were also made against the use of photography, back in the 1800s. At some point people have to realize that personal unease is not an argument.



> At some point people have to realize that personal unease is not an argument.

that's not how it works though. if you find enough other people that have the same uneasiness, then you can form groups that get people elected to make rules that forces everyone else to comply with your uneasiness.



It's not an argument that anyone else is obligated to treat at all seriously.

You're uneasy? Boo frickin hoo.



Well, I'm in a state that passes legislation as fast as they can that tries to one up how ridiculously they can legislate away the rights of their population. So as flippant as you might try to be about it, doing nothing but making flippant comments on the internet is how we turn into a society that looks at each other wondering WTF happened. Because those with personal unease have mobilized, and now they're in charge.


> Everyone is happy with a lot of pretty invasive stuff

I beg to differ. The fact we're even having this discussion means not everyone is happy with the situation. Maybe Stockholm Syndrome has kicked in for you, but I'm still resisting



> Everyone is happy with a lot of pretty invasive stuff

could you stop repeating this simple fallacy? Because millions of people could not organize and opt-out of something being commercialized, that also benefits government, in the USA Does Not Equal "everyone is happy"

in fact, lots of people are deeply unhappy.. so the statement "everyone is happy" is not only not true, but actively provoking.

It is not in the power of an unhappy or protesting individual citizen, let along an elderly, impoverished or medically vulnerable person, to stop the rollout of Big Tech Thing.



Why do you make this issue gendered, and if you do why would it impact only men father of illegitimate children, and not cheating mothers ?


The mother will already be connected to the child. The father is what would be needing tracking down.

I mean, wasn't that completely obvious?



Cause in the case of cheating mother, it is clear she is the mother. And to confirm fatherhood of husband or partner, no external registry is needed or helpful.


Nobody has perfect 100% individual choice/freedom. By itself, maximizing for it is a non-argument. The best explanation I've heard is that "my rights end where yours begin (and vice versa)". That is not an easy line to draw, so the debate becomes where exactly do we, as a society, decide to draw that line. (Noting that this also is never a singular, fixed answer)

Even without defining a specific model around how genetic data should be handled, I think it's more than fair to say that most people right now don't even consider how their choice to sign up for 23andme might affect their relatives (already born or otherwise). Even if they do, in my experience, it's only to a very surface-level degree.



But if it's genetic information, it's not your data alone. It's your data, your parents' data, your childrens data etc.


Agree. Alternatively: how much do you earn? Do you mind if I read your physical mail? Can I have a key to your home?

I think it is difficult for some people to think about abstract ideas. When you bring it to the physical world everyone understands it is vexing.



> This disaster is the perfect counter-argument to those always saying

Personally speaking, I think Equihax was the better counter-argument; at least with 23andme YOU as a customer had to DECIDE to use their services and weigh the pros-cons of doing so, with Equihax I was forced into a rating system to determine my eligibility in a system that hoovers up any and all data sold to them by 3rd parties and holds all my personal information in order to complete anything from a loan application to a job application.

And when found to have been breached no effective recourse was made, and instead of admitting fault to a very high probability of Identity theft being the end result a token 'credit system monitoring' service was offered, which once again relies on these credit agencies who share/distribute this information without my consent and created the problem are let off scot-free and never suffer any consequences.

In short, it's a naive argument made from often ignorant and self-defeating practices that make others worse off because of their complacency and refusal to take privacy serious.



Completely true. However, Equifax was probably hard to wrap your head around. Whereas 23andme might seem a lot more personal and private to the average person. Of course, nothing is likely to come of this regardless.


Not identity theft. Libel. There's a high probability a bank will libel people whose info Equifax leaked. They'll do that because they depend solely on the same (largely public) data compaies like Equifax collect to identify loan applicants.


Sure the customers decided, but what about their relatives? If any of my relatives uploaded their genetic info to this, it by extension has a huge part of my genetic info too, and my consent was decided without my knowlegde...

What I'm trying to say is: I don't think comparing it to equifax is reasonable in that regard.



To clarify, genomic data was not reported stolen. It sounds like the breach was about genealogical data.

The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location.



Yes, and remember that data is commonly widely shared. Because, its mostly about long dead people?

The real breach is for recently deceased people (here the time span varies greatly, but dead for ~100 years is definitely enough if you ask me) and for living people. Actually in Sweden the death info is publically available generally right away, more or less. You can buy USB sticks with ~all deaths up until very recently.



Maybe we all shouldn’t be so Quic to create bad ideas.


Right, like the person posting an idea on an Internet forum was the first and only person to have that idea. Security through obscurity does not work. It’s much better to open up the curtains and let the sunlight in. It’s the best disinfectant. At least then everyone is working with all of the information.


Touché, although people often identify what pharmacy they prescribe to with parroting other people’s phrases.


Blinds open btw. I’m picking up what you are gracefully throwing down but not without checks and balances.


My checks are bouncing off the heavily skewed balance. These internet posts are pretty much the only "checks and balances", and they do diddly squat.


Written word anywhere always records to the record.


Please provide one concrete example where this leaked information was used to materially impact someone's life that would not have otherwise been possible without the leak.

Absent that, the argument holds that screeching declarations about privacy tend to be overblown.



Goalposts keep being pushed:

* You don't have to care about privacy if you didn't do anything illegal.

* If you do care about it, you can just choose not to share your information.

* If you don't share but your data is still leaked, it didn't affect your life anyway.

The point is an average person is incapable of having boundaries with these corporations who have all their data and benefit from it, and we have no way of predicting how all this data about us will affect us.



This is the first time you and I have spoken in our lives; it's impossible for me to have moved any goalposts.

The point is that these privacy claims are nearly exclusively theoretical. Privacy advocates constantly tell anyone who will listen about the complete destruction of privacy in modern society, and yet nothing even resembling the consequences they claim will occur is actually happening.



Would it materially impact your life to send me a video each time you use the restroom?

Probably not, but that doesn’t mean you’re comfortable with it being shared.



That counts, can you show an example of this data being used in that way? In literally any way at all, has this data actually been used for anything?


It's being sold illegally on the dark web; how do you propose we tell you how it's being used?


When something actually happens.


nobody will listen to your counterargument. They don't care.


I guess I'm feeling a bit philosophical today, but in some sense, aren't we all part of a shared data structure given that we are all somewhat related? While there a few bits that make us individuals, there is much that is shared to the point that privacy doesn't seem truly possible.


How much does that have to do with their TOS update which went out on thanksgiving DAY (the most perfect time to get lost in everyone’s inboxes). The TOS update somehow tries to forbid class actions, requires you to go through an “informal” 60 day process before any legal action, and forces you into binding arbitration.

Functionally you as a customer have next to no legal rights, according to 23andMe lawyers who cooked this up.



Does this hold up in court?

At least in Germany any contracts that are heavily in favor of one side will be declared void if it comes to court.



I'm not a lawyer so I can't answer the question, but it will defintely complicate going to court, and I'm confident that the company has more lawyers and more money for lawyers than the average user. A class action suit may follow, but only if enough people and lawyers are willing, and it'll likely end up with a pittance in damages paid in a settlement, eventually.


What really interests me is "Are ToS changes absolutely binding?"

I am also not a lawyer. But I think there are two types of changes to ToS.

One is purely administrative. For example, they might change the methods available to reach for support. For example, they might say that you are no longer able to send a Fax to get support help. Or that their domain name changed.

Second is something that changes the service that you are receiving. For example, when you have bought their product they said "we are offering free support for all owners or our doodad". But then one day they decide that support is now paid option for all existing customers.

So the question is: can ToS changes that changes the service/product that you have already paid for binding without your consent? If they decide to introduce extra protection from class action, requirement for arbitrage, etc. is this just administrative or is it actually changing the service you are receiving by restricting your rights?



It doesn't really matter in practice, because the discipline around contract law is (typically) based on reasonableness of terms - I can't sign TOS that say I'm a slave, nor will TOS apply if such a clause is introduced at a later stage.

Regardless of whether terms are changed for administrative or product reasons, what matters is the reasonableness of terms imposed on the other party.



Not just "are the changes binding" but also "are the changes relevant". The changes might be binding for future services, but previous services were provided under the old terms; so you can make an argument that any arbitration clause in the new terms doesn't apply to services rendered before the new terms took effect.


Most terms of service include automatic acceptance of future changes, so if you continue to use the service the terms apply to the past too.

“23andMe may make changes to the Terms at any time. If we make a material change to the Terms, we will notify you, such as by posting a notice on our website or sending a message to the email address associated with your account. By continuing to access or use the Services, you agree to be bound by the revised Terms.”



Depends a lot on the jurisdiction several European courts have thrown put EULA's and TOS' agreements as being entirely invalid in a business to customer relationship, but im sure some American court somewhere will declare those as valid contracts.


In the US, yes, these kinds of contracts are unfortunately upheld under current laws and court rulings that are valid nationwide. Of course there are limits and exceptions, but those boundaries have been broadened in recent decades to allow these kinds of terms anywhere in the US, even for consumer contracts.


The US Federal Arbitration Act from 1925 prohibits courts from setting aside valid arbitration agreements. It's recently been interpreted to prohibit almost any kind of interference, so it's being actively enforced if not extended.




Just got an email update from them. It sounds like you can opt out of the new terms. Not sure what the consequences will be.

> We encourage you to read the new terms in full. Please notify us within 30 days of receiving this email if you do not agree to the terms, in which case you will remain subject to the current Terms of Service. If you do not notify us within 30 days, you will be deemed to have agreed to the new terms.

Notification email: [email protected]



Does anyone think privacy of any real sort is maintainable going forward? Machine learning algorithms are learning to identify people just by their walk -- no face recognition required. Algorithms are moving toward being able to decipher text just by the audio of the keyboard being typed on.

In short, given a gestalt of ALL public data and sufficiently advanced algorithms is there really a way for people to maintain what we today consider reasonable privacy without extraordinary measures, unfailingly applied?

To be clear, I'm not value-judging the situation, just expressing what I think the ongoing trend is.



> Does anyone think privacy of any real sort is maintainable going forward

Probably not, but it doesn’t mean we can’t guide the conversations about how it looks in the future. Sitting idly by just means they win, but discussing it in the open means that we might be able to put some safe guards in place.

Oh, who am I kidding. We’re all screwed and evilCorp will win so we’re just wasting our energy and making ourselves crazy fighting. Resistance is futile



> Machine learning algorithms are learning to identify people just by their walk -- no face recognition required.

About a decade ago I knew people researching computer vision algorithms doing non-facial recognition (stuff like ear shape/gait/etc) because companies like Fortinet were trying to build "automated doormans" to apartment/condo complexes where they would scan and analyze any humans walking by the cameras placed at the door.

Not a lick of ethics from anyone involved.

What we need is rabid legislation that encodes a right to be forgotten, because clearly an expectation of privacy isn't enough. I don't think there's anything inherently wrong with automating identification, but I do think there's a lot wrong with companies trying to do it for every human being that they can possibly find without any consent.



> Machine learning algorithms are learning to identify people just by their walk...

Turns out the UK government was working on privacy-preserving walks decades ago: https://youtu.be/eCLp7zodUiI



Agreed, but also "privacy" is an abstraction that layers over the actual thing that people are worried about.

Any answer to why do you care about hiding this information? can all be boiled down to the fear that "[person or group] might use [private data item] to create [bad outcome] for me."

So the thing people actually care about is the risk of bad outcome, not the actual data itself.

If your theory is correct, then the focus should be on the prevention of asymmetric power imbalances in societal transactions that can even create [bad outcome].



> So the thing people actually care about is the risk of bad outcome, not the actual data itself.

It's more than that. Privacy affects the psychological context for daily activity and alters behavior, sometimes subtly, sometimes overty. If a person knows they have no privacy, they will go about life completely differently, and they will think about life completely differently.

Privacy is a freedom-of-thought, freedom-of-action, and also freedom-from-anxiety consideration.



Even taking privacy as a pure abstraction over things that people really care about at face value this conclusion bakes in a ton of assumptions. The assumption a perfect power balance can be attained, the assumption once attained it can be guaranteed to never falter, and the assumption what happens between now and when such a utopia is achieved is an irrelevant concern to the individual at risk now.


I don’t think that’s necessarily true. I don’t think privacy is an abstraction, but rather a very real and visceral concern.

Regardless of the outcome, I’m entitled to my privacy and my privacy is important to me simply for the sake of my autonomy.

Simply having my privacy violated is a bad outcome in and of itself.

Relinquishing privacy in order to participate in modern society in a meaningful way is one of the great frustrations of modern times… for some.



> the focus should be on the prevention of asymmetric power imbalances in societal transactions

The rules governing social systems built to obscure the jungle (e.g., political, legal, and penal systems) can always be trumped by that which they were chosen to tame. This is the unfortunate reality of our wetware.

> the thing people actually care about is the risk of bad outcome, not the actual data itself

"Bad" is subjective, no?

Is it good or bad if a father learns that his teenage son is not his own?



> "Bad" is subjective, no? > Is it good or bad if a father learns that his teenage son is not his own?

I feel like that would depend on the person. If the father wanted to know and the son didn't, that would be good for one and bad for the other, and vice versa.



I personally don’t. I used to lose my mind over the thought of my confidential documents being leaked. Then after seeing how poorly personal information is handled, I realised it’s almost a guarantee. A few things from Australia (which has good privacy laws) that made me recognise the futility of it all:

1) the large hack of Optus in which about half of the population had their credit card details stolen. 2) the large hack of Medibank in which the details of a large portion of private health insurance customer details were stolen. 3) I applied for a mortgage and found out every 2-bit mortgage broker is emailed 100s if not 1000s of sensitive ID documents every year and they definitely do not go through their email and delete them after the closure of deals. 4) Most companies in Australia only require a name, address, and, birth date to verify identity which is easily found with five minutes of searching most of the time. 5) I set up a pin with Telstra that should have blocked administrative changes on my account for years. One day I called in, got my password ready, and they didn’t ask for it. They just did it anyway. It was entirely futile.

IMO the only way that privacy will ever become respected is if we move the onus for fraud onto the actual victims of fraud: the companies. This is the whole ancient joke about someone’s identity being “stolen”. It wasn’t stolen, your verification procedures ultimately failed as a business and you are trying to divert responsibility to avoid having to suffer a loss. This is one of the reasons I use my credit card exclusively these days - if it used fraudulently I know that I can charge back, and that’s about the only mechanism I can use to truly prevent unauthorised access to my money.



Privacy is a policy issue, not a technical issue. We need to focus on advocating for more useful and effective privacy protections as citizens, instead of focusing on technical evasion strategies. Because as you're pointing out, that is a losing strategy in the long run.


Yes, it's absolutely possible. What's not possible is the society respecting privacy. As a whole, nobody respects it anymore, some even engage in half-assed devil's advocating about it.

People are easy to mislead and so that's what's been done. In the future, privacy will have to be enforced through jammers and Faraday cages.

None of the gait and keyboard detection attempts work in field conditions.



Something super creepy that happened to me recently: a hospital where I've been to a few months ago called me and asked me to participate in some DNA analysis program. They said "oh and the best part? You don't need to do anything! We will use blood samples we collected the last time." I obviously declined, but it was a huge wtf to me - they stored biological samples associated with me without informing me and can do a post hoc DNA analysis. This is just insane and a proof of how non existent any privacy laws in the US are. (In EU they cannot freeze any samples without consent and unfrozen ones are ok for at most a few days)


Sweden has a registry of blood samples of every person born in sweden since 1975: https://sv.wikipedia.org/wiki/PKU-registret (Swedish only wiki page)

Predictably?, amusingly? police never had access to this data, until a government minister was murdered in 2003, when a sample from the suspect was retrieved. From what we know it has not been used since. So we can be cynical, but under the circumstances, the police use of the registry has not yet taken hold and is guarded by the courts..



Boy, that "yet" reaaaally makes me feel comfortable trusting government with information it can use to kill entire families.


If the government wanted you gone there wouldn’t be this song and dance about getting dna data from a blood bank. They’d just kill you and that would be that.


They can barely agree on a budget. They wouldn't be able to unify against the public, they're too dysfunctional. You'd need a President willing to defy his oath and two other branches on board with him.

Not happening.



It is interesting how that 'single exception in 2003' really erodes trust in the whole thing. It's very hard to come back from that.


Well they did call you and tried to trick you into letting them use it.

But assuming they obey the law they did not used your samples.

So there are privacy laws in place? Also they could have been cleaning old results/samples and this was one step.



Calling to get more consent for something that was already under consent is not a trick and it's not against the law for them to use the samples.

THere isn't anything nefarious going on here. Just scientific research with medical data.



How do I know they didn't use them? They already did something with my biological samples (storing for a different purpose than when they drew my blood) without my consent nor informing me.

And also - could eg. police use it?



I am not sure, only guessing. But why would they ask for permission in the firs place?

> They already did something with my biological samples

I can only guess you were tested for something in the hospital. Samples are sent to the lab (separate department) to be tested. If additional tests need to be perform they can use the blood they already received. The samples are kept for ready availability if additional tests are requested by doctor. Doctors dont care how its done, they dont have time to inform lab patient x is out home.

After some time they need to be destroyed - due to expiry date on it. Before destroying the lab contacted you and asked for dna permission.

> And also - could eg. police use it?

I don't know that. But you might want to check how medical data is protected in your jurisdiction.



They asked for permission because if you want to use data a hospital already has stored for another use, you need to contact the patient to get additional consent (you already gave them consent to collect and keep the sample).

See https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq... under "Should the initial consent ... be repeated or supplemented?" and I think this is the law: (45 CFR 46.116(b)(5)).



Something does not add up.

"23andMe said the data breach was caused by customers reusing passwords"

Yet 14,000 accounts were breached in one go? Where did these passwords come from? Maybe there was another related breach (something like lastpass can explain this)?

Also, using the "DNA Relatives" features the hackers were able to access personal information relating to 6.9 million individuals. That means each one of the original 14,000 accounts had about 492 unique relatives. What am I missing?



>Yet 14,000 accounts were breached in one go?

That part isn't super surprising beyond the technical issue of the data usurpers probably not being metered or flagged for continuously logging into different accounts. They could have used a massively distributed network to pull all the data, but there probably simply wasn't the detection or protection.

Having said that, in logging into my account to verify how many relatives are shown to add this response, 23andme refused to let me login and demanded that I reset my password because of password reuse. I have always had a very strong password on this account, and it isn't reused anywhere. I even have 2FA on. So it seems that the company isn't entirely comfortable with the notion that it was reused passwords behind it...

However after resetting my password that I never reused anywhere, the DNA relatives panel shows 60 pages of relatives, with each having 25 relatives. So 1500 relatives could be pulled. Grabbing that for 14000 random accounts would be a pretty formidable network someone could build.



I don't find that surprising at all. There are publicly available large lists that compile many historical password breaches, they are easy for attackers (or anyone) to access and it's quite reasonable to expect that at least 0.1% of anyone's users (14k accounts out of 14m+ users) will be reusing a password that has been leaked elsewhere, unless you explicitly attempt to detect and invalidate such passwords e.g. as in yesterday's discussion on HN about Troy Hunt's work.


Seems plausible to me, assuming that my situation on 23andMe is about average when it comes to the number of DNA relatives and the vulnerability of my relatives to being hacked.

A quick search says 23andMe has 14 million customers, so 14000 accounts breached would be 1 in 1000 accounts breached.

The DNA relatives listing for me lists just over 1500 people. If each of those accounts had a 1/1000 probability of being hacked, the probability none of my relatives were hacked would be (1-1/1000)^1500 = 0.223. The probability that at least one of my relatives was hacked would then be 0.777.

I'd then expect, based on my assumption that I'm typical, about 10.8 million people to have had relatives with hacked accounts, which is close enough to 6.9 million that the latter seems plausible.



Genghis Khan got hacked?


I think Genghis Khan usually did the hacking…

With a sword.



For a breach to be caused by password reuse, it must be the case that a set of usernames and passwords got leaked somewhere else. If the usernames and passwords were leaked from 23andMe, that wouldn't be a breach related to password reuse, it would just be someone who found and cracked 23andMe's list of credentials.

It isn't even slightly surprising that a list of credentials leaked from some other website (or a composite list built from leaks from several sites) might have 14,000 users in common with 23andMe.



14000 accounts 7M users? That ratio is a bit skewed.


Its because you can get some data if you opt in to relationship tracking. For instance, my 23andme shows like 1,500 genetic relatives. So saw you are jewish and opt-in to this feature. The person can login to the account and see X amount of other jewish people and their names. This is the data that was stolen from my understanding. Not the actual raw DNA of those individuals. With the current gaza/israel issue, you can see why someone having a list of the names of thousands of Jewish people might cause some concern.


I never seriously considered using 23 and me. Not because of hackers, but rather what government would do with that information. I don't want to be responsible for some random relative getting charged with a crime just because I was curious about my family tree.


Thanks to using 23 and Me. I found out that my dad was not actually my biological dad and that I have a half sister and a large extended family that I did not know existed. I'm fully aware of the privacy and PII concerns, but for me it was absolutely worth it, both to better understand who I am and to find a large group of relative who I never knew were there (and who have been incredibly welcoming to me). It's a trade-off.


I’d really like my 23 and Me info, but I assumed it was only a matter of time before they were hacked or sold to an untrustworthy organization willing to sell out users to make a quick buck.

If the test was done, the results were sent, and then my test data/info were destroyed on their end, or if I could do a home test where the data never left my home, then I’d do it.

I struggle to understand why companies hold on to all this data. It is a huge liability. In this case, maybe it is so they can identify familial relationships, but is that feature worth the risk?



> If the test was done, the results were sent, and then my test data/info were destroyed on their end,

they claim, at least, that this is the case if you delete your account; i got my results, downloaded my data and deleted my account years ago



> I struggle to understand why companies hold on to all this data

To sell it, did you miss the news? https://www.bloomberg.com/news/articles/2023-10-30/23andme-w...



Have they used these sorts of databases to charge things other than murder and rape? The cases I have seen solved by way of this technology, I would very much feel glad that something I did led to stopping someone doing seriously bad things.


You have no guarantee on the type of regime under which you will live in a few years nor on the rules it will enforce. Actually, democracies are perfect regimes for rapid rule change without requiring a regime change.


If you give the government the power to act, it's only a matter of time until they exercise that power.


If that's your only concern, you need to read up on something called "Nazis." Imagine what they would do with a database of genetic information.


Look at what they did without it. Godwin's Law aside, the point is, if a sufficiently powerful group is set on doing something, they'll do it. Such a group won't let "facts" or "accuracy" get in the way. Look at McCarthyism.


People bent on doing evil things are going to do evil things, but perhaps it's a good idea to not build systems that will let their evil be faster and more efficient.


I have yet to see how this allows them to move faster and be more efficient. People have this fear of some orwellian government killing or imprisoning with little regard for ethics or due process except they will stop all of that for careful analysis of DNA. Seems bizarre to me. Either you are getting screwed or you aren’t but this stuff makes no screwing possible that wasn’t already.


Imagine what a racist government would do if they were able to tell who's black!

Sure, now they can start hating on people who have the gene that makes Cilantro taste like soap, but a lot of genetic things are already visible so I don't see this as being fundamentally different.



They'd populate the database by making participation compulsory.


That Nazis could use something for truly evil purposes is hardly limited to this but, I think, the concern is. You can imagine nazis transporting Holocaust victims and soldiers by rail, because they did, but I’ve never heard anyone argue against adding more rail infrastructure because if Nazis take over they could use the rail infrastructure to enable genocide.


Both railways and population registries were blown up by anti-nazi sabotage and resistance groups during WWII.

So place your data like your railways, where you can blow em up when circumstances necessitate it.



Small world. Only yesterday I read that great comment from user adameasterling about credential stuffing in another thread [1]

> Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor, checking against Hunt's hashed password database is also very good and requires no extra work for users!

That user even listed 23andMe [2] as an example but it's from 60 days ago. This incident is referenced on the techcrunch article.

[1] https://news.ycombinator.com/item?id=38521106

[2] https://news.ycombinator.com/item?id=37794379



It does feel at this point that any company collecting data will be hacked, it's only a matter of "when" and no "if"...


Penalties should be strong enough that sites and apps do not collect more than an email address without very good reason. Just wanting to contact me with marketing literature is not a good reason.


I can't help but think that we need is for a class action suit to impose strong enough penalties that insurance companies to insist on proper audits of what data is actually needed and what is just a financial loss waiting to happen.


They even don't need to be hacked if the Government wants to receive/alter the data.


Not because it’s hard work to protect themselves. But because it’s typically not a business priority (at top middle and via coercion and incentives, the bottom/workers too) to invest in security. Most of these big hacks are via well known threats that can be caught in typical good-faith auditing


Recent and related:

23andMe hackers accessed a whole lot of personal data - https://news.ycombinator.com/item?id=38519466 - Dec 2023 (36 comments)

Hacker leaks millions more 23andMe user records on cybercrime forum - https://news.ycombinator.com/item?id=37931383 - Oct 2023 (394 comments)

23andMe Sued over Hack of Genetic Data Affecting Thousands - https://news.ycombinator.com/item?id=37895586 - Oct 2023 (20 comments)

23andMe Accounts Hijacked and Data Put Up for Sale on Hacker Forum - https://news.ycombinator.com/item?id=37810755 - Oct 2023 (2 comments)

23andMe says user data stolen in credential stuffing attack - https://news.ycombinator.com/item?id=37794379 - Oct 2023 (298 comments)



Can we (folks who didn't use 23&me but may still be affected because our relatives might have) file a class action lawsuit?

We haven't signed any licensing agreements with 23&me waiving our privacy, so presumably we still have some rights?



Can someone remind me why we trust tech startups with our personal data, again?


If the hackers could "leak" this data to the public, it would be a tremendous genetic dataset for future generations of pirate researchers...


If anyone who used the service, do you know if you can use it anonymously? I wanted to try it but I was afraid of exactly this.

How feasible it is to use a payment and an address that doesn't directly connect you to your samples?



Given the nature of the service, you should probably treat it as inherently pseudonymous. You're handing over irrevocable genetic data which will link you to relatives. Whatever their data protection assurances are, you have to imagine the worst case scenario - massive data leakage. And if this happens then you will in all likelihood be identifiable.


Obviously I don't trust any assurances, but on the other hand I'm handing over my genetic data all the time because parts of me end up over in the hands of 3rd parties whenever I go outside but they just happen not to run test on those.

If I can have a test that is not connected to my persona, from their perspective the data would be as valuable as running a test on the hair in the barbershop or picking a random leftover of food and running test on the saliva left on the half consumed food.



There's quite a big difference between the DNA you leave in a forensic sense all around you (which would take a lot of effort and expense for someone to gather against your will) versus serving it up on a plate in a format that is trivially searchable for close matches against any relatives. The value is in the fact that millions of people's DNA is gathered in the same place in the same format, not the individual value of your DNA. It's a classic network effect.


What's the difference of taking the DNA from a trash and from a plate delivered with fake information?


I mean, what is your threat model, and what are you trying to get out of DNA/ancestry services?

If you're worried about getting arrested for one of the many crimes you've committed, and you want to meet far-flung relatives, you're kind of in a bind here. Assuming unlimited cooperation between the police and the DNA/ancestry services -- which your threat model in this case would require -- even if they don't have your name or address, they could fabricate a half-sibling/double-cousin in the system and have them reach out to you. What, are you not going to talk to and eventually meet the cop pretending to be your previously unknown half-sibling/double-cousin?



My threat model is about the changing world, essentially activist who feel like having right to tell who lives where. I usually pass by the look, fail by the accent and I intend not to have another data point they can use.


I wouldn't count on any data protections from firms in the United States. There's no responsibility taken by those with the influence to end lives.

Until there's actual punishment for being breached, there will never be data protections in the United States. Even HIPAA and the DMV sell access to businesses.



indeed, if you have a cousin that has already filled in the data about your grandparents, and they do a scan showing "John Doe" is the descendent of Arthur, Betty, Charlie, and Debbie; then you're already linked with a "shadow profile". Chances are they'll have the data from your cousin with your name added too, so now they can link the DNA of "John Doe" with the shadow profile of "YourActualName, cousin of Timmy TakeMyData".

The only solution to this is regulation and enough incentive that companies have to treat data as they treat radioactive waste material. Storing data should be a liability, not an asset.



I had the same question once and dug around the internet a bit. It seems like they don't verify your information.

I'd recommend to use a fake name and not something like "Ano Nymous" as their rules don't allow that.



Right, if they don't do any extra verification on identity then non-perosonal mailing address and a single use payment method should do.


You DNA is shared with others, so any amateur geneaologist is likely to be able to find out who, approximately, you are.

The exact info though should be easy to protect. Just dont give it away.

But remember that other close family members to you are very likely to know who you are, and they may share that info by accident. Normally you can't share data of anyone living on these services, since that is illegal pretty much anywhere, but its enough if one user happen to mark you dead in their tree and has filled in your real data.



I signed up with fake name, delivered to a friends address, and a Privacy.com single use credit card. No one is forcing you to use real credentials anywhere online.


there is no credential more comprehensively solid than your genome


Yeah it's sort of like using Tor to log in to Facebook and expecting Facebook not to know who you are because your IP is obscured.


More like using Tor to create a FB account with made up information and expecting FB not know who you are because your IP is obscured and you use fresh browser profile. In your DNA doesn't tell your identity, there's DNA everywhere and it's not something hard to come by. The analysis is only valuable if can be connected to a persona, otherwise its just chemical reaction.


No, your analogy makes no sense. A fake facebook account is not identifying information. DNA is. They can figure out who you are based on the DNA alone, if they have enough data from your relatives.


There are billions of addresses in the world and you can look it up online. It is an identifying information only when it is attached to an identity. That's exactly the same. DNA is everywhere, it's only identifying when connected to an identity.


It can be tied to your identity, that's the point. Because they'll have your relatives' data.


They can match me with my DNA if they already have complete knowledge of my family structure and all their DNA. So if all Kardashians but one send their DNA for tests providing their true identities and the last one sends anonymously, they can assume the identity of the last one.

So yes, there's a risk but its not much different from going outside and leave behind hair or saliva unaccounted for. That's Putin level of paranoia IMHO(he is known to have men collecting his poo etc. when outside).

Maybe can be useful for insurance companies to match you and price you according to your DNA but they are not allowed to do that and they can only exist within legal structure.



> They can match me with my DNA if they already have complete knowledge of my family structure and all their DNA.

Or just a part of it, which is the point: no, complete knowledge isn't required here.



> No one is forcing you to use real credentials anywhere online.

Definitely not true, many services require KYC and others do it to prevent fraud.



Find a private lab to do the test. It may be a bit more involved, and cost more money, but not by that much.


Do private labs have methods to provide similar information to 23andMe?


The labs don't, but you could upload it to promethease. But they play a role similar to 23andMe so likely it wouldn't address your concerns.


I used a fake name and a masked email address, and no issues so far. I've told close family members that if they get a sibling, child, or uncle show up called "James Brown" not to freak out too much


there was a craze for DNA analysis 10+ years ago, the idea being 'if we can analyze e-commerce transactions, why not the human DNA!' The UPS being mostly around Health than Ancestry. That's flopped in my view.

Recent Gnome sequencing research is revealing that actually a Gene (downstream) doesn't necessitate a Health/Medical Condition (upstream) [1]. I think we need highest security measures, user education and Regulation when it comes to DNA, medical records, and biometric data (face, finger, iris, voice etc).

Charles Darwin & Co documented their theory of evolution well, there's enough ancestry there for most i think, at least as a solid starting point / platform. My guess would be if there was more education around theory of evolution (science), there would be less interest in Ancestry services (DNA based), leaving only a Medical case for them, and hence demanding greater protection/security.

[1] A biological relativity view of the relationships between genomes and phenotypes, Denis Noble - https://doi.org/10.1016/j.pbiomolbio.2012.09.004



23andMe is just pissed that someone or a group of hackers stole the same data they were selling to other companies.


>“We believe that the threat actor may have then, in violation of our terms of service, accessed 23andme.com accounts without authorization and obtained information from those accounts.”

It's funny that they had to note "without authorization".



If the data exists, it's going to get out.

In this case the data is your genome.

I was thinking about getting a DNA testing kit for my parents and my conclusion was that I'd have to advise them that they'd need to be comfortable with their genome being public because over time leaks are inevitable. As the UK marches on towards increased fascism the chances a Tory government will demand access to such data "for security purposes" gets higher.



Im sure someone just gave them access... Given the number of SE attacks on dumbass SaaS companies, seems easy when they all cut corners and overwork everyone...


And still no communication from 23andme for those that could have been affected. Just a prompt about changing your password.


Family members should be able to sue for the loss of their genome's privacy.

Data that isn't about you doesn't actually belong to you.





Does genetic data count as personal information? Just wondering as a EU citizen.


haveibeencloned dot com


Only $24,799.00 + transfer fee, get yours today! /s


This won't change until our government starts punishing (not 10M fines) hacked companies for leaking private data.


You can't punish a corporation, it is a collective and most members of it are worker bees told what to do without a big picture. You have to punish the members of the C-Suite individually if any change is to be seen.


How did they not notice 7 million accounts being accessed through credential stuffing?

Do they have 0 fraud prevention? I doubt the attackers cycled IPs.



So the original "14000" leak is 0.1% of the customers, but now 6.9M is claimed. 14000/6900000 ~ 0.2%, so now half the customers are indirectly leaked?


Yes, likely at different levels. For example, if I log into my myheritage account, I have 27000 DNA matches which I can download a .csv of, which includes the matching parts. I can also access the trees of those users that share theirs. This really does not include personal data, _except_ the information about where our DNA is identical or half-identical. Which has potentially far-reaching implications, but the personal data should not really be available here, unless people has opted in to sharing it.

Since its a site about sharing data, its not weird that its easy to extract data from it. It is sort of the purpose.



"Luckily we are now offering a genome monitoring service. For only $79.99 per month you can be sure that you're alerted any time someone tries to access your genetic record!" - 23andMe


The scumbags received what they deserve. Just don't be a 23andme's used.


I really want to see information about my DNA. So it's very tempting to just give in, pay and send a sample to something like 23andMe...


In my country where the police has a LOT of power I'm more worried about inadvertently getting my relatives arrested for old closet crimes. Am I being too dramatic?


If the police has that much power, they'd probably just find another pretense to arrest your relatives, if the need to put pressure on you arises.


Nice data for a super biological weapon though.


imagine the next hitler... as an immigrant with his data on 23andme, I am pretty scared. I am sure 1 out of the 10 ethnicities that I am affiliated with, will be eventually hated by some group.


Fun fact, they can sometimes narrow down crime scene DNA to just a single person by having enough partial matches from their (potentially distant) relatives. I can't remember which DNA database was used, but some cases were solved this way, IIRC it introduced a bunch of legal questions about if you can search a database in that way.

I think this was the article that talked about this (apologies for the paywall): https://www.nytimes.com/2021/12/27/magazine/dna-test-crime-i...



There have also been a number of false positives because many believe that DNA is infallible. What people tend to forget is that DNA tests used by law enforcement is only using a very small subset of DNA markers. This mean that if you're already in a DNA database you can get an unpleasant knock on the door just because you have 10 DNA markers in common with some random criminal.

Danish police only upgraded from 10 DNA markers to 16 in 2021, forcing them to review 12.000 cases and redoing the DNA test. Resulting in at least one person having the sentence reversed. No word on how many was falsely suspected, but I assume more than a few.



23andMeandHackers


I bet a lot of insurance risk adjusters will make an order for the data, optimize their models a bit, raise a few rates, and make a few new millionaires in the process.

I’m being snarky but isn’t it really scary that 2% of Americans could be impacted by something like that?



That sounds like an issue with the healthcare system rather than genetic analysis, no?


Well, it was a matter of time before something like that happened.


I uploaded my genome to a public database. And it's higher fidelity than this. My children will, too. This isn't a really big deal to me. Hopefully, my DNA (as part of the big database) will help us find out something about humans in the future.


very regretable and very predictable


23andMe should be destroyed, including all copies of its database. I hope EU will fry them.


How about every other site that does, more or less, the same thing?


So people in my family have used 23andMe but I'm assuming my data is also compromised. I've never used the service because I think it's kind of weird and gross. But it probably doesn't matter that much if both of my parents and my brother have. Health insurance companies in the future can still charge me different prices based on my risk profile.


[flagged]



Your original comment was already flagged, you don't have to create a new account and "encode" your anti-semitic bu11sh!t and think it'll be accepted.


[flagged]



Do you have any material evidence or you just throw your prejudices at the wall and see what sticks?


[citation needed]


How convenient.


"hackers stole" == "company sold"


False


sed s/"hackers stole"/"company sold"/g


Was my comment that bad?


Cool, now they can hack the DNA of millions and transform them into frogs or something.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact



Search:
联系我们 contact @ memedata.com