8 ms·

23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah. It sucks since I hav

23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah. It sucks since I have zero trust that they would actually delete my data if I asked them too, and even if they do is that data still living somewhere fed into some model or research or whatever. I hate to say that there is a part of me that kinda doesn't want to know if my data is a part of this, this just feels different than a credit card or some shopping data leaking. Even worse since I have not gone to 23andme in a while, I feel like this was likely also before I cared about proper password security so it would not surprise me.

wnevets 3y ago
> 23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah. I've had someone give one as a gift, so glad I didn't do it.
atarian 3y ago
Meh, it's just some stuff they extracted from your spit. I wouldn't get bent out of shape over it. Who knows, we might all get a decent payout from a settlement. You certainly won't regret when that happens.
bdamm 3y ago
It doesn't really matter. The genetic matching models are so primitive that there's really not much of value in the data anyway. Facebook and Google have a far more accurate picture of what can be used to manipulate you. 23andme is little more than a curiosity. My data is probably in this breach too, and I am not going to waste one second of my life on regret over it. Stay tuned to find out if you get something from the class action lawsuit. Like the experion hack, you may at least get an interesting coffee table artifact when they mail you a pathetically small check.
- sgarman 3y ago
  What about this? https://www.cbc.ca/news/world/dna-from-genealogy-site-used-to-catch-suspected-golden-state-killer-1.4637726 https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t... Seems like there is at least some value.
  - ghaff 3y ago
    There's arguably societal benefit to the broader availability of DNA data but very little of that passes down to me personally and there are risks. I have very few close relatives but it's not hard to imagine the widespread use of this data by law enforcement would pull in some people with more extended families into investigations they'd rather not be involved in.
  - somethoughts 3y ago
    Doh! Didn't get the fuss over DNA data before but that scenario definitely makes it clear.
  - mfld 3y ago
    Sure , there are several big issues in compromised DNA profiles. See also: https://www.ecseq.com/blog/2019/privacy-implications-of-genetic-information-sharing https://www.ecseq.com/blog/2019/privacy-implications-of-gene... But let's wait until it's clear whether raw data was actually leaked.
    - great_psy 3y ago
      Isn’t the raw data pretty much guaranteed to be leaked ? I remember a few years ago there was a button to download raw data. So if you can log in you can just download.
      - murphyslab 3y ago
        23andMe shows up to 1500 DNA Relatives for each user (outside of subscription features). What we know thus far is that the malicious persons who compiled these datasets are scraping user profiles of DNA Relative matches who are related to the accounts which they were able to directly compromise (likely as a result of password reuse). The posters claim to have accessed around ~7M profiles, which means the lower limit for directly compromised accounts is ~4700, although likely much higher (maybe a factor of 10?), given the overlap in match lists, and provided that their boasts are true. So that's potentially ~5000-50000 profiles. For those directly compromised accounts raw data could be downloaded. For profiles scraped, it would not be feasible to obtain raw data. However it is possible that partial genetic sequences might be assembled for matches. This was at the core of security researchers' investigations into GEDmatch a few years ago [0]. 23andMe does not face the same vulnerability, however with enough compromised accounts it is likely possible to infer a modest proportion of the DNA sequences of profiles which are known to match. [0] https://www.washington.edu/news/2019/10/29/genetic-genealogy-site-vulnerable-compromised-data-impersonations/ https://www.washington.edu/news/2019/10/29/genetic-genealogy...
- keep_reading 3y ago
  This is also my opinion: they stole a really poor social graph, that's all
  - anigbrowl 3y ago
    Knowing who's related to who is a very useful social graph if your goals are unethical.
    - pfannkuchen 3y ago
      Or if your goals aren’t unethnical!
- _jal 3y ago
  > 23andme is little more than a curiosity. If you call criminal convictions "little more", sure. Many people consider that a good thing, but I'm not talking about moral valence or vibes - the point is they are an industry supplier of PII that sends people to jail.
  - deadbeeves 3y ago
    What a strange thing to say. If you committed a crime and the genetic information you gave to some company leaks, and someone is able to use that information to prove you're guilty, what sends you to jail is the fact that you committed that crime. The existence of this company and the leak enabled this particular way of proving you guilty, but you were still guilty, so you might have been successfully proven guilty by other means. But most importantly, you're guilty. You're going to jail because of your actions, and for no other reason. It's not like there's someone out there using this information to frame other people of crimes they didn't do.
    - deleted 3y ago
      [deleted]
    - serf 3y ago
      >It's not like there's someone out there using this information to frame other people of crimes they didn't do. pretty bold claim -- as with any additional justice element the innocent will be trampled to some degree. Here's the thing : it doesn't just open up criminals for prosecution, it also opens up the 23andme population to an even larger arrangement of possibilities for self-incrimination and 'incorrect or misdirected pursuits of justice'. It's nice that a well known murderer was found out, but the reality of the situation is that we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services. It looks bad on the law enforcement agencies and it looks bad for the corporation.
      - deadbeeves 3y ago
        >pretty bold claim I don't think so. How would that even work? It's not much different from framing someone of a crime just by knowing their blood type. >we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services Nah. Let's suppose that someone made a typo and Mr. Buttle is accused of committing the crime Mr. Tuttle, who deposited his genetic material, committed. While the Buttle-genome link is a useful piece of evidence, it's on the judge to request a saliva sample from Mr. Buttle to ensure a trustworthy source of information. If he doesn't, well, it sucks for Mr. Buttle that he got a lazy judge, but it's not on the company. The person who wrote down the name could not have known that information would at some later point be misused to lockup an innocent man.
- jedberg 3y ago
  Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics.
  - sekai 3y ago
    > Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics. There are easier ways to find Jews...
  - lazyasciiart 3y ago
    They are? Source?
    - jedberg 3y ago
      https://www.wired.com/story/23andme-credential-stuffing-data-stolen/ https://www.wired.com/story/23andme-credential-stuffing-data... https://www.nbcnews.com/news/amp/rcna119324 https://www.nbcnews.com/news/amp/rcna119324 https://www.washingtonpost.com/technology/2023/10/06/23andme-hacked-data/ https://www.washingtonpost.com/technology/2023/10/06/23andme... https://www.jta.org/2023/10/13/health/23andme-sued-after-ashkenazi-jews-user-data-is-stolen-and-sold-in-targeted-attack https://www.jta.org/2023/10/13/health/23andme-sued-after-ash...
      - 616c 3y ago
        As cute as the implication I just read several of the articles and see no specific evidence about the terrorist groups, just the leak. I'll finish the last one but that's a weak association if I've ever seen one.
  - ssnistfajen 3y ago
    Endogamy was also historically common in the Jewish diaspora before the Contemporary Period, so on average they will probably see a lot more distantly related people via 23andMe which creates an exponential increase in the amount of data scraped per user account.
- gosub100 3y ago
  I'm a data hoarder and considered ordering my complete genetic sequence (not from 23, there are others that send you back an HDD with somewhere around several-gigs to 1tb+ of your genome). But I resisted because I would have no idea what to grep for. Without a biotech background it would simply be a waste of my time.
  - px43 3y ago
    Every time you see an article about how some gene makes people like to eat potatos, or grow toenails really fast or something, you're about a minute of searching away from finding exactly what you need to grep for to see if you're a match.
- ramraj07 3y ago
  The one issue is, unlike social data, you’ve not just given up your data, but you’ve condemned your entire future lineage to this leak. All their genetic information can be partially imputed from this info. Maybe this doesn’t matter today but who knows what it’ll be valued at 50 years from now? Don’t upload your saliva to the internet folks.
artninja1988 3y ago
>that data still living somewhere fed into some model or research or whatever Do you mean like for drug discovery and other medical research? Why would that be a bad thing?
- nerdjon 3y ago
  On paper there is nothing bad with that. But it still removes my ability to delete my data, especially when 23andMe has proven that they are not properly safeguarding this data. Also me donating this data to a research organization vs being lured in by 23andMe's marketing are drastically different things.
  - moritonal 3y ago
    Oh god, that's made me realise. Does a GDPR right to removal extend to LLM's that have been trained on your data? What probability of retrieval counts as still storing your data?
    - waffleiron 3y ago
      GDPR recital 26 covers your question. Excerpt for the second part: > To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. So they don’t call for an exact probability, but if you can prove you did appropriate threat modelling and put controls in place to counter those threats you should be fine. You are literally doing more than most companies if you manage that.
INTPenis 3y ago
I was really curious too and did one of the major services, that's likely been hacked too by now. But I registered under a false name, gave the test kit to my dad, and had him test one of my aunts too. So it wasn't as exact but it was good enough to sate my curiosity. Everything gets hacked sooner or later. A famous hacker once said that you should assume that everything you say or write will one day be public information. Edit: And before anyone says "how could you do that to your father", if you knew him you'd understand. He's practically off grid and he's going to die soon, the aunt is already dead.
pierat 3y ago
It's also one of my biggest regrets, and I never did it. My mom did. She never asked me, or anything. But half my material is right there, in an irrevocable database, now leaked online for the world. And I have no genetic rights or any claim, even though half is explicitly mine.
- lifeisstillgood 3y ago
  Hang on can I understand your position? As I read it your (biological) mum took a swab of her own mouth and sent it to 23 and me. And you argue she should have asked your permission before doing so because she would be giving them half of your DNA? Honestly I am not sure where I stand on that issue. Or rather it's probably to do with society wide regulation not individual rights ...
  - talldatethrow 3y ago
    It's an interesting issue. If a stranger had asked OPs mom for OPs phone number out of the blue, there are many moms that wouldn't share a PHONE NUMBER without asking the phone number holders permission. But fewer would ask their relatives if it's ok to stick a decent portion of their DNA into a database.
    - fshbbdssbbgdd 3y ago
      Wait till they find out that 99% of our genes already got leaked to the public by the Chimpanzees.
      - pbhjpbhj 3y ago
        Or that you can hit a tree up to get 50% of them.
      - ziddoap 3y ago
        This is really dismissive. It should be obvious that, to the OP, the important part is the 1% that is unique, not the 99% which isn't.
gardenhedge 3y ago
Wait, you didn't ask them to delete it? If you did the hacker probably wouldn't have your data.
bonton89 3y ago
My understanding is you kind of don't even need to screw up on this one, just be related to some one who did and you're more or less in there anyway.
keep_reading 3y ago
They have an option to destroy your data and the original sample you sent in
- lawlessone 3y ago
  They could never get my DNA when i tried it. They sent out 2nd test kit that didn't work either. Would they have kept the samples? Not that i really care, you're not going to find a password or my first pets name in my DNA.
  - pbhjpbhj 3y ago
    Have you seen Blade Runner?
seydor 3y ago
how has 23andme affected you in reality? (not hypothetically)
- dekhn 3y ago
  Even though I'm not a direct customer, it affected me: I now know I have tens or more half siblings throughout the US. It's mildly unsettling but I guess I'm happy that people were able to find my dad, who is also their dad.
- ajdude 3y ago
  I discovered that I have the apoe4/4 gene, which not only explained why keto -despite helping me lose weight- threw my cholesterol to dangerous levels, but also explain some other important things about my family and genetics (some things that weren't even in the results, but they let you download the raw data of your genome so I did some bioinformatics). It helped me with changing my lifestyle and having a clear picture of what the focus on.
- electrondood 3y ago
  Sperm donor. At some point in the future, I'm going to have an entire classroom of people figure out who I am based on suggestions of my relatives in their family tree. I deleted my data years ago, doesn't matter.

wnevets 3y ago

> 23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah. I've had someone give one as a gift, so glad I didn't do it.

atarian 3y ago

Meh, it's just some stuff they extracted from your spit. I wouldn't get bent out of shape over it. Who knows, we might all get a decent payout from a settlement. You certainly won't regret when that happens.

bdamm 3y ago

It doesn't really matter. The genetic matching models are so primitive that there's really not much of value in the data anyway. Facebook and Google have a far more accurate picture of what can be used to manipulate you. 23andme is little more than a curiosity. My data is probably in this breach too, and I am not going to waste one second of my life on regret over it. Stay tuned to find out if you get something from the class action lawsuit. Like the experion hack, you may at least get an interesting coffee table artifact when they mail you a pathetically small check.

sgarman 3y ago
What about this? https://www.cbc.ca/news/world/dna-from-genealogy-site-used-to-catch-suspected-golden-state-killer-1.4637726 https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t... Seems like there is at least some value.
- ghaff 3y ago
  There's arguably societal benefit to the broader availability of DNA data but very little of that passes down to me personally and there are risks. I have very few close relatives but it's not hard to imagine the widespread use of this data by law enforcement would pull in some people with more extended families into investigations they'd rather not be involved in.
- somethoughts 3y ago
  Doh! Didn't get the fuss over DNA data before but that scenario definitely makes it clear.
- mfld 3y ago
  Sure , there are several big issues in compromised DNA profiles. See also: https://www.ecseq.com/blog/2019/privacy-implications-of-genetic-information-sharing https://www.ecseq.com/blog/2019/privacy-implications-of-gene... But let's wait until it's clear whether raw data was actually leaked.
  - great_psy 3y ago
    Isn’t the raw data pretty much guaranteed to be leaked ? I remember a few years ago there was a button to download raw data. So if you can log in you can just download.
    - murphyslab 3y ago
      23andMe shows up to 1500 DNA Relatives for each user (outside of subscription features). What we know thus far is that the malicious persons who compiled these datasets are scraping user profiles of DNA Relative matches who are related to the accounts which they were able to directly compromise (likely as a result of password reuse). The posters claim to have accessed around ~7M profiles, which means the lower limit for directly compromised accounts is ~4700, although likely much higher (maybe a factor of 10?), given the overlap in match lists, and provided that their boasts are true. So that's potentially ~5000-50000 profiles. For those directly compromised accounts raw data could be downloaded. For profiles scraped, it would not be feasible to obtain raw data. However it is possible that partial genetic sequences might be assembled for matches. This was at the core of security researchers' investigations into GEDmatch a few years ago [0]. 23andMe does not face the same vulnerability, however with enough compromised accounts it is likely possible to infer a modest proportion of the DNA sequences of profiles which are known to match. [0] https://www.washington.edu/news/2019/10/29/genetic-genealogy-site-vulnerable-compromised-data-impersonations/ https://www.washington.edu/news/2019/10/29/genetic-genealogy...
keep_reading 3y ago
This is also my opinion: they stole a really poor social graph, that's all
- anigbrowl 3y ago
  Knowing who's related to who is a very useful social graph if your goals are unethical.
  - pfannkuchen 3y ago
    Or if your goals aren’t unethnical!
_jal 3y ago
> 23andme is little more than a curiosity. If you call criminal convictions "little more", sure. Many people consider that a good thing, but I'm not talking about moral valence or vibes - the point is they are an industry supplier of PII that sends people to jail.
- deadbeeves 3y ago
  What a strange thing to say. If you committed a crime and the genetic information you gave to some company leaks, and someone is able to use that information to prove you're guilty, what sends you to jail is the fact that you committed that crime. The existence of this company and the leak enabled this particular way of proving you guilty, but you were still guilty, so you might have been successfully proven guilty by other means. But most importantly, you're guilty. You're going to jail because of your actions, and for no other reason. It's not like there's someone out there using this information to frame other people of crimes they didn't do.
  - deleted 3y ago
    [deleted]
  - serf 3y ago
    >It's not like there's someone out there using this information to frame other people of crimes they didn't do. pretty bold claim -- as with any additional justice element the innocent will be trampled to some degree. Here's the thing : it doesn't just open up criminals for prosecution, it also opens up the 23andme population to an even larger arrangement of possibilities for self-incrimination and 'incorrect or misdirected pursuits of justice'. It's nice that a well known murderer was found out, but the reality of the situation is that we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services. It looks bad on the law enforcement agencies and it looks bad for the corporation.
    - deadbeeves 3y ago
      >pretty bold claim I don't think so. How would that even work? It's not much different from framing someone of a crime just by knowing their blood type. >we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services Nah. Let's suppose that someone made a typo and Mr. Buttle is accused of committing the crime Mr. Tuttle, who deposited his genetic material, committed. While the Buttle-genome link is a useful piece of evidence, it's on the judge to request a saliva sample from Mr. Buttle to ensure a trustworthy source of information. If he doesn't, well, it sucks for Mr. Buttle that he got a lazy judge, but it's not on the company. The person who wrote down the name could not have known that information would at some later point be misused to lockup an innocent man.
jedberg 3y ago
Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics.
- sekai 3y ago
  > Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics. There are easier ways to find Jews...
- lazyasciiart 3y ago
  They are? Source?
  - jedberg 3y ago
    https://www.wired.com/story/23andme-credential-stuffing-data-stolen/ https://www.wired.com/story/23andme-credential-stuffing-data... https://www.nbcnews.com/news/amp/rcna119324 https://www.nbcnews.com/news/amp/rcna119324 https://www.washingtonpost.com/technology/2023/10/06/23andme-hacked-data/ https://www.washingtonpost.com/technology/2023/10/06/23andme... https://www.jta.org/2023/10/13/health/23andme-sued-after-ashkenazi-jews-user-data-is-stolen-and-sold-in-targeted-attack https://www.jta.org/2023/10/13/health/23andme-sued-after-ash...
    - 616c 3y ago
      As cute as the implication I just read several of the articles and see no specific evidence about the terrorist groups, just the leak. I'll finish the last one but that's a weak association if I've ever seen one.
- ssnistfajen 3y ago
  Endogamy was also historically common in the Jewish diaspora before the Contemporary Period, so on average they will probably see a lot more distantly related people via 23andMe which creates an exponential increase in the amount of data scraped per user account.
gosub100 3y ago
I'm a data hoarder and considered ordering my complete genetic sequence (not from 23, there are others that send you back an HDD with somewhere around several-gigs to 1tb+ of your genome). But I resisted because I would have no idea what to grep for. Without a biotech background it would simply be a waste of my time.
- px43 3y ago
  Every time you see an article about how some gene makes people like to eat potatos, or grow toenails really fast or something, you're about a minute of searching away from finding exactly what you need to grep for to see if you're a match.
ramraj07 3y ago
The one issue is, unlike social data, you’ve not just given up your data, but you’ve condemned your entire future lineage to this leak. All their genetic information can be partially imputed from this info. Maybe this doesn’t matter today but who knows what it’ll be valued at 50 years from now? Don’t upload your saliva to the internet folks.

artninja1988 3y ago

>that data still living somewhere fed into some model or research or whatever Do you mean like for drug discovery and other medical research? Why would that be a bad thing?

nerdjon 3y ago
On paper there is nothing bad with that. But it still removes my ability to delete my data, especially when 23andMe has proven that they are not properly safeguarding this data. Also me donating this data to a research organization vs being lured in by 23andMe's marketing are drastically different things.
- moritonal 3y ago
  Oh god, that's made me realise. Does a GDPR right to removal extend to LLM's that have been trained on your data? What probability of retrieval counts as still storing your data?
  - waffleiron 3y ago
    GDPR recital 26 covers your question. Excerpt for the second part: > To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. So they don’t call for an exact probability, but if you can prove you did appropriate threat modelling and put controls in place to counter those threats you should be fine. You are literally doing more than most companies if you manage that.

INTPenis 3y ago

I was really curious too and did one of the major services, that's likely been hacked too by now. But I registered under a false name, gave the test kit to my dad, and had him test one of my aunts too. So it wasn't as exact but it was good enough to sate my curiosity. Everything gets hacked sooner or later. A famous hacker once said that you should assume that everything you say or write will one day be public information. Edit: And before anyone says "how could you do that to your father", if you knew him you'd understand. He's practically off grid and he's going to die soon, the aunt is already dead.

pierat 3y ago

It's also one of my biggest regrets, and I never did it. My mom did. She never asked me, or anything. But half my material is right there, in an irrevocable database, now leaked online for the world. And I have no genetic rights or any claim, even though half is explicitly mine.

lifeisstillgood 3y ago
Hang on can I understand your position? As I read it your (biological) mum took a swab of her own mouth and sent it to 23 and me. And you argue she should have asked your permission before doing so because she would be giving them half of your DNA? Honestly I am not sure where I stand on that issue. Or rather it's probably to do with society wide regulation not individual rights ...
- talldatethrow 3y ago
  It's an interesting issue. If a stranger had asked OPs mom for OPs phone number out of the blue, there are many moms that wouldn't share a PHONE NUMBER without asking the phone number holders permission. But fewer would ask their relatives if it's ok to stick a decent portion of their DNA into a database.
  - fshbbdssbbgdd 3y ago
    Wait till they find out that 99% of our genes already got leaked to the public by the Chimpanzees.
    - pbhjpbhj 3y ago
      Or that you can hit a tree up to get 50% of them.
    - ziddoap 3y ago
      This is really dismissive. It should be obvious that, to the OP, the important part is the 1% that is unique, not the 99% which isn't.

gardenhedge 3y ago

Wait, you didn't ask them to delete it? If you did the hacker probably wouldn't have your data.

bonton89 3y ago

My understanding is you kind of don't even need to screw up on this one, just be related to some one who did and you're more or less in there anyway.

keep_reading 3y ago

They have an option to destroy your data and the original sample you sent in

lawlessone 3y ago
They could never get my DNA when i tried it. They sent out 2nd test kit that didn't work either. Would they have kept the samples? Not that i really care, you're not going to find a password or my first pets name in my DNA.
- pbhjpbhj 3y ago
  Have you seen Blade Runner?

seydor 3y ago

how has 23andme affected you in reality? (not hypothetically)

dekhn 3y ago
Even though I'm not a direct customer, it affected me: I now know I have tens or more half siblings throughout the US. It's mildly unsettling but I guess I'm happy that people were able to find my dad, who is also their dad.
ajdude 3y ago
I discovered that I have the apoe4/4 gene, which not only explained why keto -despite helping me lose weight- threw my cholesterol to dangerous levels, but also explain some other important things about my family and genetics (some things that weren't even in the results, but they let you download the raw data of your genome so I did some bioinformatics). It helped me with changing my lifestyle and having a clear picture of what the focus on.
electrondood 3y ago
Sperm donor. At some point in the future, I'm going to have an entire classroom of people figure out who I am based on suggestions of my relatives in their family tree. I deleted my data years ago, doesn't matter.