10 ms·

Wow. What a shit company. It isn't the user's responsibility to secure the data that you store, it is 100% on you. If the user is reusing a pwd that might be th

Wow. What a shit company. It isn't the user's responsibility to secure the data that you store, it is 100% on you. If the user is reusing a pwd that might be the reason a single account got hacked but to beat a dead horse, you can mitigate that easily as a company. Karma seems to always work things out.

BrandoElFollito 3y ago
How would you mitigate a password reuse?
nextos 3y ago
I also regret giving them my data. At work, we bought one of their first kits. We were doing genetics research and my boss got some for Christmas and gifted them to everyone in the group. Technically, 23andme is also pretty bad, which is hard to understand given that they employ very competent people and they are well funded. Seems like a space ripe for disruption. Their biggest competitor, DecodeME, never really aimed at B2C and just used customers to harvest data, then sold to a pharma. 23andme genetic risk scores are mediocre at best. Promethease makes better predictions. For example, in my case I have a high risk MHC allele, which is both trivial to predict and well understood since the 1980s. Never popped up on their reports, yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself.
- lawlessone 3y ago
  > yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself. If you had not mentioned this i would have thought they weren't testing people at all.
- ezfe 3y ago
  Have you deleted your data? They provide a clear button to do so...
  - nextos 3y ago
    I eventually did, and also opted out from trials and sharing with pharmas prior to that.
  - npongratz 3y ago
    Do you trust that your data, that they fully control on their system, is actually deleted? Including their backups that reside elsewhere? I just assume they set your record's "delete" field to "true" when you press that button. No way for us plebs to be certain about what they do.
    - gwright 3y ago
      I'd be surprised to hear about anybody deleting records on backup systems (i.e., backups that exist for disaster recovery purposes). It would be pretty difficult to do that in a commercially viable way (but I'm open to hearing about some creative ideas).
      - bombcar 3y ago
        There are methods of doing it, but it is complex. Basically you either have hot backups you can delete from (this is bad for obvious reasons), or your backups expire in a given time (this is most common), or you have each record encrypted with an encryption key that is saved in other ways so you only have to destroy those to make the data irretrievable. Of course, that system has to be backed up, etc, etc.
      - plagiarist 3y ago
        If user data in backups is encrypted with a key kept in warm/hot storage, you can delete the key and effectively delete data in cold storage because it is unrecoverable. This obviously must be per-user keys and set up in advance so I doubt they have it available, but that's one potential method.
        starttoaster 3y ago
        Where do the keys get backed up to? If nowhere: If the key system fails, do you just accept the loss of _all_ of your customer data? If somewhere: by what mechanism do you delete the key in a backup?
- murphyslab 3y ago
  This seems to be more a consequence of being FDA regulated. Promethease is just providing a lookup service, cross-referencing a genotype file with SNPedia, which offers no direct prediction claims IIRC. https://www.snpedia.com/ https://www.snpedia.com/
- tremere 3y ago
  From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company. Back then, few people had the mindset of, "if they own my data, they own me." But we're starting to see it take hold.
  - fsckboy 3y ago
    From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company. I am interested in genetics, but I didn't trust google, and I trusted a google spouse company even less (it's like John Lennon's Google, and Yoko Ono's 23andMe, when I didn't trust Lennon to begin with) and my data hasn't been spilled. Half of you are thinking of all sorts of epithets to call me, but fact is, I was right about 23andMe. From a decision-making standpoint, slam dunk for me and anybody who listened to me. It was not an unusual position to take. "What. Could. Go. Wrong?" (I'm fully aware they probably already have my data from numerous blood tests I've taken from normal medical checkups, etc. but what could I have done about that?)
    - wayfinder 3y ago
      I don’t know. I trust Google the most. They’re basically an aimless company with the strongest technically secure infrastructure I’ve seen with the strongest privacy policies implemented (just read about their infra). I think people give in to what people say versus say what they do. Just because Google runs an ad company doesn’t mean shit. What they’ve done with your data (their “actions”) for the past 25 years means way more (they absolutely do nothing with your data — in fact, they seem to completely waste it). The link between 23andme and Google is tangential at best. Anne Wojcicki and Sergey Brin were married and that’s it, but they are completely two different people. I have no idea how you’d ever consider 23andme a reputable company. Reputation comes from 20+ years of history — your actions, not what you say. 23andme is not even 20 years old yet — how can you trust something that young?
  - devjab 3y ago
    I forgot which company I used, but part of their deal was that you had the ability to delete your DNA data. Which I guess would’ve come in handy for a lot of people with 23andme. If you had chosen to do so of course.
- autoexec 3y ago
  > Seems like a space ripe for disruption. I think there's plenty of room for a new competitor to make money, but you can bet that any similar service is going to be just as bad for people's piracy and security. Nobody is going to collect and store that kind of data without either selling it or being forced to turn it over.
pbhjpbhj 3y ago
So companies shouldn't allow users to use poor passwords? Because it seemed harsh to me, maybe I don't care about them security of some data and so use a weak password; that's on me, surely?
- johncessna 3y ago
  As someone who reads hackernews and works on security systems, yes, absolutely. Run their passwords through haveibeenpwned and disallow anything that shows up. Based on the feedback I hear from my non-tech friends and family, not allowing them to use their single password used for everything would be a good way to exclude those folks from using whatever service you're trying to sell them.
  - pbhjpbhj 3y ago
    I was being argumentative there, I think the email-based auth is probably right for a site like this. Force complex passwords and people will often just do a reset every time anyway.
- Retr0id 3y ago
  Companies have legal (and moral) obligations to protect user data. Those obligations don't go away for users that don't personally care.
  - pbhjpbhj 3y ago
    Perhaps not legally, but morally? I'll have a good chin-scratch on that one. Thanks for your comment.
- bparsons 3y ago
  2FA is the standard these days for accessing PID. I can't think of data more sensitive or personal than your DNA.
onthecanposting 3y ago
Personally I think this crime forum just democratized whatever unethical activity 23andme was probably doing anyway.
- 7moritz7 3y ago
  Not probably, they've certainly sold dna data https://www.forbes.com/sites/nicolemartin1/2018/12/05/how-dna-companies-like-ancestry-and-23andme-are-using-your-genetic-data/ https://www.forbes.com/sites/nicolemartin1/2018/12/05/how-dn...
  - dekhn 3y ago
    I mean, the people whose data was sold did consent, and doing this was always 23&Me's mission. With the exception that the results have been less than stellar, I've generally thought having large-scale genomics data from consenting patients to work on human health problems is a generally good idea.
deleted 3y ago
[deleted]
manxman 3y ago
Look at the leadership’s connection with google and this becomes easier to understand. Then again we walk about touching things, leaving convenient DNA samples for anyone to collect throughout the day. It’s only because sequencing is relatively high cost at present that we have the illusion of privacy. Once we go in equivalent terms from mainframes to single board computers in the DNA world, then anyone can pretty much have at your personal genome. Would love to see how the criminal forensic science guys adapt their narrative to this impending reality.

BrandoElFollito 3y ago

How would you mitigate a password reuse?

nextos 3y ago

I also regret giving them my data. At work, we bought one of their first kits. We were doing genetics research and my boss got some for Christmas and gifted them to everyone in the group. Technically, 23andme is also pretty bad, which is hard to understand given that they employ very competent people and they are well funded. Seems like a space ripe for disruption. Their biggest competitor, DecodeME, never really aimed at B2C and just used customers to harvest data, then sold to a pharma. 23andme genetic risk scores are mediocre at best. Promethease makes better predictions. For example, in my case I have a high risk MHC allele, which is both trivial to predict and well understood since the 1980s. Never popped up on their reports, yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself.

lawlessone 3y ago
> yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself. If you had not mentioned this i would have thought they weren't testing people at all.
ezfe 3y ago
Have you deleted your data? They provide a clear button to do so...
- nextos 3y ago
  I eventually did, and also opted out from trials and sharing with pharmas prior to that.
- npongratz 3y ago
  Do you trust that your data, that they fully control on their system, is actually deleted? Including their backups that reside elsewhere? I just assume they set your record's "delete" field to "true" when you press that button. No way for us plebs to be certain about what they do.
  - gwright 3y ago
    I'd be surprised to hear about anybody deleting records on backup systems (i.e., backups that exist for disaster recovery purposes). It would be pretty difficult to do that in a commercially viable way (but I'm open to hearing about some creative ideas).
    - bombcar 3y ago
      There are methods of doing it, but it is complex. Basically you either have hot backups you can delete from (this is bad for obvious reasons), or your backups expire in a given time (this is most common), or you have each record encrypted with an encryption key that is saved in other ways so you only have to destroy those to make the data irretrievable. Of course, that system has to be backed up, etc, etc.
    - plagiarist 3y ago
      If user data in backups is encrypted with a key kept in warm/hot storage, you can delete the key and effectively delete data in cold storage because it is unrecoverable. This obviously must be per-user keys and set up in advance so I doubt they have it available, but that's one potential method.
      - starttoaster 3y ago
        Where do the keys get backed up to? If nowhere: If the key system fails, do you just accept the loss of _all_ of your customer data? If somewhere: by what mechanism do you delete the key in a backup?
murphyslab 3y ago
This seems to be more a consequence of being FDA regulated. Promethease is just providing a lookup service, cross-referencing a genotype file with SNPedia, which offers no direct prediction claims IIRC. https://www.snpedia.com/ https://www.snpedia.com/
tremere 3y ago
From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company. Back then, few people had the mindset of, "if they own my data, they own me." But we're starting to see it take hold.
- fsckboy 3y ago
  From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company. I am interested in genetics, but I didn't trust google, and I trusted a google spouse company even less (it's like John Lennon's Google, and Yoko Ono's 23andMe, when I didn't trust Lennon to begin with) and my data hasn't been spilled. Half of you are thinking of all sorts of epithets to call me, but fact is, I was right about 23andMe. From a decision-making standpoint, slam dunk for me and anybody who listened to me. It was not an unusual position to take. "What. Could. Go. Wrong?" (I'm fully aware they probably already have my data from numerous blood tests I've taken from normal medical checkups, etc. but what could I have done about that?)
  - wayfinder 3y ago
    I don’t know. I trust Google the most. They’re basically an aimless company with the strongest technically secure infrastructure I’ve seen with the strongest privacy policies implemented (just read about their infra). I think people give in to what people say versus say what they do. Just because Google runs an ad company doesn’t mean shit. What they’ve done with your data (their “actions”) for the past 25 years means way more (they absolutely do nothing with your data — in fact, they seem to completely waste it). The link between 23andme and Google is tangential at best. Anne Wojcicki and Sergey Brin were married and that’s it, but they are completely two different people. I have no idea how you’d ever consider 23andme a reputable company. Reputation comes from 20+ years of history — your actions, not what you say. 23andme is not even 20 years old yet — how can you trust something that young?
- devjab 3y ago
  I forgot which company I used, but part of their deal was that you had the ability to delete your DNA data. Which I guess would’ve come in handy for a lot of people with 23andme. If you had chosen to do so of course.
autoexec 3y ago
> Seems like a space ripe for disruption. I think there's plenty of room for a new competitor to make money, but you can bet that any similar service is going to be just as bad for people's piracy and security. Nobody is going to collect and store that kind of data without either selling it or being forced to turn it over.

pbhjpbhj 3y ago

So companies shouldn't allow users to use poor passwords? Because it seemed harsh to me, maybe I don't care about them security of some data and so use a weak password; that's on me, surely?

johncessna 3y ago
As someone who reads hackernews and works on security systems, yes, absolutely. Run their passwords through haveibeenpwned and disallow anything that shows up. Based on the feedback I hear from my non-tech friends and family, not allowing them to use their single password used for everything would be a good way to exclude those folks from using whatever service you're trying to sell them.
- pbhjpbhj 3y ago
  I was being argumentative there, I think the email-based auth is probably right for a site like this. Force complex passwords and people will often just do a reset every time anyway.
Retr0id 3y ago
Companies have legal (and moral) obligations to protect user data. Those obligations don't go away for users that don't personally care.
- pbhjpbhj 3y ago
  Perhaps not legally, but morally? I'll have a good chin-scratch on that one. Thanks for your comment.
bparsons 3y ago
2FA is the standard these days for accessing PID. I can't think of data more sensitive or personal than your DNA.

onthecanposting 3y ago

Personally I think this crime forum just democratized whatever unethical activity 23andme was probably doing anyway.

7moritz7 3y ago
Not probably, they've certainly sold dna data https://www.forbes.com/sites/nicolemartin1/2018/12/05/how-dna-companies-like-ancestry-and-23andme-are-using-your-genetic-data/ https://www.forbes.com/sites/nicolemartin1/2018/12/05/how-dn...
- dekhn 3y ago
  I mean, the people whose data was sold did consent, and doing this was always 23&Me's mission. With the exception that the results have been less than stellar, I've generally thought having large-scale genomics data from consenting patients to work on human health problems is a generally good idea.

deleted 3y ago

[deleted]

manxman 3y ago

Look at the leadership’s connection with google and this becomes easier to understand. Then again we walk about touching things, leaving convenient DNA samples for anyone to collect throughout the day. It’s only because sequencing is relatively high cost at present that we have the illusion of privacy. Once we go in equivalent terms from mainframes to single board computers in the DNA world, then anyone can pretty much have at your personal genome. Would love to see how the criminal forensic science guys adapt their narrative to this impending reality.