Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

23andMe changed its terms of service to prevent hacked customers from suing

engadget.com

Post reply on HN
Print view View original

261–270 of 402 posts

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#261

Post by zlg_codes »

Ensorceled wrote: post #239
snapcaster wrote: post #225

Earlier quoted context omitted.

How are you getting that i'm "more enraged" at the victims? I'm not absolving the company of anything, I'm criticizing people who give something like their DNA to a random company naive and foolish edit: I would have the exact same stance (and did and continue to) even if there was no hack

Because your original comment was the only comment you made on the thread. And you made NO mention of the real villains. And you accused these people of screwing over their kids and all their descendants. And you only "not absolving" the real villains even now.

[flagged]

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#262

Post by dekhn »

zlg_codes wrote: post #258
dekhn wrote: post #163

Earlier quoted context omitted.

I'm familiar with security (I keep a copy of Applied Cryptography on my shelf for "fun reading") and tech, here's a copy of my whole genome: https://my.pgp-hms.org/profile/hu80855C Note it's a full human genome, far more data than a 23&Me report. You can download the data yourself and try to find risk factors (at the time, the genetic counsellors were surprised to find that I had no credible genetic risk factors). Pl…

Why do you think people are entitled to have genome data on you? The morality is flipped. Privacy is recognized as a core, natural right. Others have to prove their onus for wanting your biological data. Trusting others is a moral and character weakness, because you have no guarantees as to how that data will be used. Or more specifically, what new ways to analyze and take advantage of that data will become. I think…

I think if your prior includes "trusting others is a moral and character weakness" then I don't think it's useful for us to discuss this topic further.

As for actuaries, in the US, the GINA law prevents health insurance companies from using this data. I think legal protection is much more important than attempting to hide my DNA.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#263

Post by zlg_codes »

helsinkiandrew wrote: post #49

Forcing customers to use arbitration hasn't always been in the companies interest - if only a fraction of the 7M effected customers started the arbitration process it could cost a lot more than a class action suit. Didn't Uber drivers get a large payment from them in this way? https://www.reuters.com/legal/litigation/uber-loses-appeal-b...

Arbitration almost always favors the company, why else would they push for arbitration instead of respecting your rights?

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#264

Post by dylan604 »

BrandoElFollito wrote: post #255
alistairSH wrote: post #229

Earlier quoted context omitted.

That's exactly why - we have a largely dysfunctional federal government (and most state governments aren't much better). The biggest downside is the lawyers take a massive chunk of any award and the actual victims are often left with very little. Or, even worse, the victims get worthless coupons (like with many credit/PII breaches - the award will be 1-year of credit monitoring from the company that allowed the breac…

This credit score system in the US always made me curious. Say some point I had a proposition to move to the US and I asked the company offering the job how they will ensure that I immediately get the best possible score. They said it was not possible because it was a personal score. I told them that I will certainly not start to build a credit score at 40 yo so they will have to find someone else.

[flagged]

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#265

Post by zlg_codes »

dekhn wrote: post #262
zlg_codes wrote: post #258

Earlier quoted context omitted.

Why do you think people are entitled to have genome data on you? The morality is flipped. Privacy is recognized as a core, natural right. Others have to prove their onus for wanting your biological data. Trusting others is a moral and character weakness, because you have no guarantees as to how that data will be used. Or more specifically, what new ways to analyze and take advantage of that data will become. I think…

I think if your prior includes "trusting others is a moral and character weakness" then I don't think it's useful for us to discuss this topic further. As for actuaries, in the US, the GINA law prevents health insurance companies from using this data. I think legal protection is much more important than attempting to hide my DNA.

> I think if your prior includes "trusting others is a moral and character weakness" then I don't think it's useful for us to discuss this topic further.

I agree, if you can't justify trust with reason then it's hard to trust your argument that relies on trust. Trust can be broken, and your stance doesn't address that concern.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#266

Post by dekhn »

BobaFloutist wrote: post #249
dekhn wrote: post #183

Earlier quoted context omitted.

I just checked, and using my True Name ( https://en.wikipedia.org/wiki/True_Names ) I can easily find my DOB, prior addresses and phone numbers, and using that information, it's likely I could make a reasonable guess for the SSN.

it's likely I could make a reasonable guess for the SSN. It is ? I mean then why are we bothering to protect anything, this shit is all super available for any given person.

SSNs are fairly predictable- if you know region of birth and DOB you can get awfully close, for a wide range of the population.

https://www.pnas.org/doi/10.1073/pnas.0904891106

Konerding's 12th law, amended: "There is no bit of pseudonymized data which cannot be de-anonymized by a sufficiently motivated MIT grad student" (not entirely joking; see https://archive.nytimes.com/bits.blogs.nytimes.com/2015/01/2...)

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#267

Post by dekhn »

zlg_codes wrote: post #260
dekhn wrote: post #204

Earlier quoted context omitted.

Yes, but technically sophisticated entities can also use methods that require less effort. https://xkcd.com/538/

That's your defense? You asked for actual risks and when shown real, plausible ones recede into XKCD quotes. Clearly just a spoiler.

What real, actual risks which I didn't already know about have been shown in this thread?

The point is that while you can use DNA to identify people in most cases, sufficiently motivated adversaries have more effective, cheaper, lower-technology approaches that they will use first.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#268

Post by jascination »

covercash wrote: post #61
ceejayoz wrote: post #24

Earlier quoted context omitted.

Yeah, but the actual terms say arbitrationoptout@23andme.com. I wouldn't put it past them to say "ah but you didn't email the right address".

I emailed this one and cc’d the legal@ address just to be sure.

Ah, bad news, you cc'd legal@, which technically isn't directly emailing legal@. We have denied your claim and you will be shot from a rocket directly into the sun next Wednesday.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#269

Post by deathanatos »

theGnuMe wrote: post #251
deathanatos wrote: post #244

Earlier quoted context omitted.

> Huge HIPPA violation as well. It's HIPAA . IANAL: And unless 23andMe meets the HIPAA definition of a "covered entity", which I'm not sure they do, they're not going to be covered by HIPAA.

Right but the hackers are not covered entities.

That's not how HIPAA works. 23andme would be, or would not be, the covered entity, and the entity bound by HIPAA.

Re: 23andMe changed its terms of service to prevent hacked customers from suing

#270

Post by akira2501 »

d2049 wrote: post #21

I would have presumed that security-minded people, which includes those who work in tech, would not so easily give away their genome, and that most of 23andMe's customers are a slice of the general population. But then I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas and I'm befuddled. Why would anyone willingly do that?

> I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas

Is this actually happening, or is that just what the stories say?

Post reply on HN