Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

23andMe updates their TOS to force binding arbitration

stackdiary.com

Post reply on HN
Print view View original

41–50 of 252 posts

Re: 23andMe updates their TOS to force binding arbitration

#41

Post by consumer451 »

dudul wrote: post #12
consumer451 wrote: post #2

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

What does "innocently" mean in this context?

Meaning that she was over 70, and just wanted to learn some ambiguously defined information about her family history. There were some unknowns as far as where her great-grandparents came from. Maybe "naively" would be a better term.

We are all law abiding citizens, what do we have to hide, right?

Well, she did not read the T&C as far as how this information would be shared, and did not consider the implications of how she was making a choice for the people who she named on the family form, and did not consider the inevitable infosec implications which we are now all enjoying.

Re: 23andMe updates their TOS to force binding arbitration

#42

Post by AlexandrB »

spondyl wrote: post #23

There is perhaps one upside. As it turns out, when binding arbitrarion is forced, those very same companies can't handle the caseloads that come with thousands of cases being filed individually so it can be a bit of a footgun https://www.nytimes.com/2020/04/06/business/arbitration-over...

Seems the law critters at 23andMe have thought of that. From the Ars Technica coverage[1]:

> The updated terms also explain a new process for mass arbitration. This requires that "if 25 or more demands for arbitration are filed relating to the same or similar subject matter and sharing common issues of law or fact, and counsel for the parties submitting the demands are the same or coordinated," this "will constitute a 'Mass Arbitration.'" Any mass arbitration dispute will be settled by the National Arbitration and Mediation, "a nationally recognized arbitration provider."

[1] https://arstechnica.com/tech-policy/2023/12/23andme-changes-...

Re: 23andMe updates their TOS to force binding arbitration

#43

Post by jimbob45 »

consumer451 wrote: post #33
anon35 wrote: post #26

Earlier quoted context omitted.

This 2021 New Yorker article: How Your Family Tree Could Catch a Killer ( https://www.newyorker.com/magazine/2021/11/22/how-your-famil... ) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have . To quote the article: "Genetic genealogy, it turned out,…

This feels like a "think of the children" type of appeal. I personally don't have any murderous history to hide. But there are unintended consequences with all of these losses of privacy. As a peer comment has rightly pointed out, nation state adversaries now have these same profiles. Maybe they can find a common DNA profile for an efficient bio-weapon. Oops. I escaped an authoritarian regime as a child, thanks to th…

Maybe they can find a common DNA profile for an efficient bio-weapon. Oops.

I think we already reached the end of the bioweapon tech tree with Sarin gas.

Re: 23andMe updates their TOS to force binding arbitration

#44

Post by jacquesm »

anon35 wrote: post #26
consumer451 wrote: post #2

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

This 2021 New Yorker article: How Your Family Tree Could Catch a Killer ( https://www.newyorker.com/magazine/2021/11/22/how-your-famil... ) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have . To quote the article: "Genetic genealogy, it turned out,…

That took them until 2021? I wrote this in 2012:

https://jacquesmattheij.com/your-genetic-information-is-not-...

Re: 23andMe updates their TOS to force binding arbitration

#45

Post by jacquesm »

jimbob45 wrote: post #43
consumer451 wrote: post #33

Earlier quoted context omitted.

This feels like a "think of the children" type of appeal. I personally don't have any murderous history to hide. But there are unintended consequences with all of these losses of privacy. As a peer comment has rightly pointed out, nation state adversaries now have these same profiles. Maybe they can find a common DNA profile for an efficient bio-weapon. Oops. I escaped an authoritarian regime as a child, thanks to th…

Maybe they can find a common DNA profile for an efficient bio-weapon. Oops. I think we already reached the end of the bioweapon tech tree with Sarin gas.

No, you are misreading the GP. What they mean is a bioweapon specifically tailored to match a particular DNA profile. Think Germany, 1939, or South Africa, 1985, but with this capability to see what the possibilities are and how utterly unstoppable that would be. And probably there are contemporary examples as well, but I don't feel like starting a flame-fest.

Re: 23andMe updates their TOS to force binding arbitration

#46

Post by consumer451 »

gorgoiler wrote: post #27
consumer451 wrote: post #16

Earlier quoted context omitted.

I feel like I can blame the humans involved with 23andMe specifically, as they are the specific humans who allowed unknown 3rd parties to have enough of my DNA to profile my family and myself. However, I entirely agree with your last statement. I would like to call upon anyone who appreciates privacy to get behind a neural bill of rights. While it sounds a bit "tin foil hat" at the moment, non-invasive brain–computer…

By “unknown third parties” do you mean the hackers? The breach was bad but not that bad — it didn’t include your genetic material. > The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location. https://techcrunch.com/2023/12/04/23andme-confirms-hackers-s...

I meant 23andMe partners, and yes, also the hack, and future hacks.

This DB is a goldmine and I take an extremely pessimistic view on infosec.

Information wants to be "free" after all. Look at the KSA agents who were implanted at Twitter as an example. I would have to assume that nation state actors would also implant employees at 23andMe.

The publicized hack is the one we, and 23andMe, know about. It's just too juicy a target to keep safely guarded in perpetuity.

Simply by compiling this information, you are more or less guaranteeing it falling into the wrong hands eventually. This is an example of information which never should have been compiled.

Re: 23andMe updates their TOS to force binding arbitration

#47

Post by Rodeoclash »

consumer451 wrote: post #33
anon35 wrote: post #26

Earlier quoted context omitted.

This 2021 New Yorker article: How Your Family Tree Could Catch a Killer ( https://www.newyorker.com/magazine/2021/11/22/how-your-famil... ) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have . To quote the article: "Genetic genealogy, it turned out,…

This feels like a "think of the children" type of appeal. I personally don't have any murderous history to hide. But there are unintended consequences with all of these losses of privacy. As a peer comment has rightly pointed out, nation state adversaries now have these same profiles. Maybe they can find a common DNA profile for an efficient bio-weapon. Oops. I escaped an authoritarian regime as a child, thanks to th…

> I personally don't have any murderous history to hide

I've been meaning to ask, could you please remove the curtains to your bedroom so I can see in? I know you're not doing anything wrong so you've got nothing to hide.

Re: 23andMe updates their TOS to force binding arbitration

#48

Post by space_fountain »

rpmisms wrote: post #30
space_fountain wrote: post #22

Earlier quoted context omitted.

I like this idea, but I think it's not flexible enough. Instead my over complicated dream is to allow companies to propose new TOS in a similar way to new top level domains. They can put in a lot of money and add TOS language to the approved list, but then anyone can use that language. Ideally the pricing would be such that only 10 to 50 unique TOS would exist at any point in time

So instead of the richest companies setting the standard for what a TOS contains.... The richest companies would formally set the standard for what a TOS contains.

I think the problem I was most interested in solving is maybe only somewhat related to this. I was frustrated that no one actually ever looks at TOS and so there is very little real informed choice happening. With a small fixed number it would be easier for audits and understanding to happen

Re: 23andMe updates their TOS to force binding arbitration

#49

Post by refactor_master »

bushbaba wrote: post #35
deckeraa wrote: post #7

The more TOS I read through, the more it seems we need a "common law" solution. (I use the term "common law" loosely here) Something like a couple of pre-defined categories for software services (e.g. info provider, social network, real-world interface) with pre-set rules (e.g. the client cannot attempt to break the social network; the owner of the social network cannot re-sell data to a third party). We have somethi…

The easy answer should be TOS that are not non lawyer readable or not under N paragraphs are not binding. When you buy a house you don’t give 1 signature. You literally sign every friggen page including multiple places on the same page, TOS shouldn’t be different

We all know how cookie consents turned out though.

Re: 23andMe updates their TOS to force binding arbitration

#50

Post by CuriousCosmic »

throwoutway wrote: post #32
anon35 wrote: post #26

Earlier quoted context omitted.

This 2021 New Yorker article: How Your Family Tree Could Catch a Killer ( https://www.newyorker.com/magazine/2021/11/22/how-your-famil... ) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have . To quote the article: "Genetic genealogy, it turned out,…

And now a nation state hacker can use the same database to identify U.S. citizen descendants (to what generation?). Good luck with "illegals" style espionage

Or you know just a normal hacker (see this incident when a DB identifying 1 million people with Ashkenazi jewish ancestry from 23andMe data was leaked: https://www.bleepingcomputer.com/news/security/genetics-firm...)
Post reply on HN