Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

23andMe changed its terms of service to prevent hacked customers from suing

engadget.com

Post reply on HN
Print view View original

231–240 of 402 posts

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#231

Post by WalterBright »

"reports revealing that attackers accessed personal information of nearly 7 million people — half of the company’s user base — in an October hack."

Breaking into a system should never provide access to 7 million people. The database should be divided up into multiple "cells" each with its own separate access restrictions.

It's the same idea that spy networks use to prevent one compromised spy from bringing down the whole system. Or you can think of it like watertight compartments in a battleship.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#232

Post by mtremsal »

dekhn wrote: post #189
mtremsal wrote: post #187

Earlier quoted context omitted.

For one thing, this leaks a portion of the genome of your relatives, which is a clear breach of their privacy. Whether you personally deem it sensitive or not, genetic data is meant to remain confidential.

I don't believe making my genome available, which contains similarity to my relatives, is a breach of their privacy. I think part of my point is that DNA, by its nature, simply cannot remain confidential, and that thinking we can keep it that way is just going to lead to inevitable disappointment.

First, some people extend your argument from DNA to everything and say "I believe that privacy in the modern world is unrealistic"; that doesn't make the argument applicable to the rest of us.

Second, whether DNA can or cannot remain confidential is yet to be seen, but feasibility is certainly orthogonal to whether it ought to be, which is the point at hand.

Third, whether you believe it's a breach of privacy to leak part of your relatives' DNA is besides the point. It's their decision to make, since it's their personal data and deemed confidential under most privacy frameworks, and therefore a breach.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#233

Post by VHRanger »

oldgradstudent wrote: post #58
willcipriano wrote: post #47

Earlier quoted context omitted.

I wonder if they can use things like opt out data to find a way screen for genetic markers of "troublemakers" or similar. DNA driven targeted advertising that finds only the most docile consumers.

They can't tell you your eye color from their DNA data with any degree of confidence, and you seriously expect them to be able to find a marker of something as vague as "troublemakers" ?!

ADHD has genetic markers for example

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#234

Post by rand1239 »

d2049 wrote: post #21

I would have presumed that security-minded people, which includes those who work in tech, would not so easily give away their genome, and that most of 23andMe's customers are a slice of the general population. But then I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas and I'm befuddled. Why would anyone willingly do that?

> Why would anyone willingly do that?

Maybe they accept the possibility that they die one day?

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#236

Post by losteric »

underwater wrote: post #220
dylan604 wrote: post #201

Earlier quoted context omitted.

This looks like a perfect class action case. There's really no physical harm or financial harm to the users, but a class action might be the only way for it to hurt. But IANAL, and probably have it all wrong in my head???

Why is it that in the US individuals have to band together and privately launch a class action to stop these types of parasitic behaviours. The government is supposed to represent the interests of citizens.

It's not true that individuals need to band together. A single individual can kick off a class action lawsuit, private litigators can even kick start a lawsuit themselves (though ultimately the lawsuit will bring in impacted individuals).

The idea of private litigators is to complement the innate limitations of federal/state lawyers, by offering profit as an incentive.

Ideally yeah Americans would have stronger laws around TOS, customer privacy, data handling and security, and robustly funded state lawyers... but we don't.

Practically speaking, such gaps are not unique to technology. Every industry has this same problem, and your awareness of those problems is reflective of the general public's political engagement with this thread's topic. So having gaps that private litigators address is really quite normal and part of the incremental progress of legislation and state enforcement.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#237

Post by 6177c40f »

slingnow wrote: post #145
6177c40f wrote: post #96

Earlier quoted context omitted.

> Can you give an example? See my other comment, but in short I essentially mean the true realization of "precision medicine" and gaining a greater understanding of how different genotypes result in disease, information which can be used guide treatment and to develop better treatments. > That assumes there's someone out to get you specifically. Not entirely true- the ability to reconstruct genotypes from environment…

>> That's like saying there's no point in having 2FA or strong passwords, because the FSB, the FBI and Mossad can get in anyway. > Unlike your password, your DNA is unencrypted and gets spread everywhere. This doesn't address the point. In both cases, someone sufficiently motivated could get what they want from you. So by your argument, there's no point in maintaining privacy for either piece of information (DNA / pa…

> So by your argument, there's no point in maintaining privacy for either piece of information (DNA / passwords).

The problem with privacy is that it's fragile. When your info is leaked, you should assume it's out there for good.

I also think that while right now when you do the cost/benefit analysis of having your DNA sequenced, you think the cost outweights the benefit. Clearly my personal calculus is different than yours, and that's ok. But I would caution you that in the future that calculation may be different for you.

So I think people will either lose privacy, or voluntarily give up some privacy for some benefit. In either case, we will need something other than privacy to protect ourselves. I think that well-enforced legislation, legislation that limits the way genetic info can be used and gives the individual more control over their own info, is really the only thing that can help.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#239

Post by Ensorceled »

snapcaster wrote: post #225
Ensorceled wrote: post #66

Earlier quoted context omitted.

I continue to be surprised at the sheer number of people on HN who are more enraged at the victims for their "stupidity" than at the perpetrators (23andMe for ToS shenanigans and/or the hackers for the hack).

How are you getting that i'm "more enraged" at the victims? I'm not absolving the company of anything, I'm criticizing people who give something like their DNA to a random company naive and foolish edit: I would have the exact same stance (and did and continue to) even if there was no hack

Because your original comment was the only comment you made on the thread.

And you made NO mention of the real villains.

And you accused these people of screwing over their kids and all their descendants.

And you only "not absolving" the real villains even now.

Post reply on HN