Live data from Hacker News

23andMe confirms hackers stole ancestry data on 6.9M users

techcrunch.com

11–20 of 321 posts

Re: 23andMe confirms hackers stole ancestry data on 6.9M users

#12
post #8

Something does not add up. "23andMe said the data breach was caused by customers reusing passwords" Yet 14,000 accounts were breached in one go? Where did these passwords come from? Maybe there was another related breach (something like lastpass can explain this)? Also, using the "DNA Relatives" features the hackers were able to access personal information relating to 6.9 million individuals. That means each one of t…

For a breach to be caused by password reuse, it must be the case that a set of usernames and passwords got leaked somewhere else. If the usernames and passwords were leaked from 23andMe, that wouldn't be a breach related to password reuse, it would just be someone who found and cracked 23andMe's list of credentials.

It isn't even slightly surprising that a list of credentials leaked from some other website (or a composite list built from leaks from several sites) might have 14,000 users in common with 23andMe.

Re: 23andMe confirms hackers stole ancestry data on 6.9M users

#13
post #11

If anyone who used the service, do you know if you can use it anonymously? I wanted to try it but I was afraid of exactly this. How feasible it is to use a payment and an address that doesn't directly connect you to your samples?

I signed up with fake name, delivered to a friends address, and a Privacy.com single use credit card. No one is forcing you to use real credentials anywhere online.

Re: 23andMe confirms hackers stole ancestry data on 6.9M users

#14
post #11

If anyone who used the service, do you know if you can use it anonymously? I wanted to try it but I was afraid of exactly this. How feasible it is to use a payment and an address that doesn't directly connect you to your samples?

Given the nature of the service, you should probably treat it as inherently pseudonymous. You're handing over irrevocable genetic data which will link you to relatives. Whatever their data protection assurances are, you have to imagine the worst case scenario - massive data leakage. And if this happens then you will in all likelihood be identifiable.

Re: 23andMe confirms hackers stole ancestry data on 6.9M users

#15
post #11

If anyone who used the service, do you know if you can use it anonymously? I wanted to try it but I was afraid of exactly this. How feasible it is to use a payment and an address that doesn't directly connect you to your samples?

I had the same question once and dug around the internet a bit. It seems like they don't verify your information.

I'd recommend to use a fake name and not something like "Ano Nymous" as their rules don't allow that.

Re: 23andMe confirms hackers stole ancestry data on 6.9M users

#16
post #9

In my country where the police has a LOT of power I'm more worried about inadvertently getting my relatives arrested for old closet crimes. Am I being too dramatic?

If the police has that much power, they'd probably just find another pretense to arrest your relatives, if the need to put pressure on you arises.

Re: 23andMe confirms hackers stole ancestry data on 6.9M users

#18

This disaster is the perfect counter-argument to those always saying "why do you care so much about privacy. It doesn't affect you when I share things. You can just choose not to do it", except no, I can't choose when we're relatives and you chose to share our genome. It is so obvious that your relatives sharing their genomic data with 23andMe reveals a lot of information about you. We can only hope people will reali…

I'm in favor of privacy, and I'm willing to go more out of my way to not share than the vast majority of people, but I'm also in favor of individual choice, and I can't think of a privacy model that would disallow other people from sharing their information just because you have some matching information.

Re: 23andMe confirms hackers stole ancestry data on 6.9M users

#19
post #13
post #11

If anyone who used the service, do you know if you can use it anonymously? I wanted to try it but I was afraid of exactly this. How feasible it is to use a payment and an address that doesn't directly connect you to your samples?

I signed up with fake name, delivered to a friends address, and a Privacy.com single use credit card. No one is forcing you to use real credentials anywhere online.

there is no credential more comprehensively solid than your genome

Re: 23andMe confirms hackers stole ancestry data on 6.9M users

#20
post #18

This disaster is the perfect counter-argument to those always saying "why do you care so much about privacy. It doesn't affect you when I share things. You can just choose not to do it", except no, I can't choose when we're relatives and you chose to share our genome. It is so obvious that your relatives sharing their genomic data with 23andMe reveals a lot of information about you. We can only hope people will reali…

I'm in favor of privacy, and I'm willing to go more out of my way to not share than the vast majority of people, but I'm also in favor of individual choice, and I can't think of a privacy model that would disallow other people from sharing their information just because you have some matching information.

FYI, the police is able to find criminals now by finding DNA sequences similarities with your relatives. Not saying this is good or bad, I am just saying you don't know the extent of the impact to your personal freedom when your relative's DNA is shared.
Post reply on HN