7 ms·

It doesn't really matter. The genetic matching models are so primitive that there's really not much of value in the data anyway. Facebook and Google have a far

by bdamm 3y ago

It doesn't really matter. The genetic matching models are so primitive that there's really not much of value in the data anyway. Facebook and Google have a far more accurate picture of what can be used to manipulate you. 23andme is little more than a curiosity. My data is probably in this breach too, and I am not going to waste one second of my life on regret over it. Stay tuned to find out if you get something from the class action lawsuit. Like the experion hack, you may at least get an interesting coffee table artifact when they mail you a pathetically small check.

sgarman 3y ago
What about this? https://www.cbc.ca/news/world/dna-from-genealogy-site-used-to-catch-suspected-golden-state-killer-1.4637726 https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t... Seems like there is at least some value.
- ghaff 3y ago
  There's arguably societal benefit to the broader availability of DNA data but very little of that passes down to me personally and there are risks. I have very few close relatives but it's not hard to imagine the widespread use of this data by law enforcement would pull in some people with more extended families into investigations they'd rather not be involved in.
- somethoughts 3y ago
  Doh! Didn't get the fuss over DNA data before but that scenario definitely makes it clear.
- mfld 3y ago
  Sure , there are several big issues in compromised DNA profiles. See also: https://www.ecseq.com/blog/2019/privacy-implications-of-genetic-information-sharing https://www.ecseq.com/blog/2019/privacy-implications-of-gene... But let's wait until it's clear whether raw data was actually leaked.
  - great_psy 3y ago
    Isn’t the raw data pretty much guaranteed to be leaked ? I remember a few years ago there was a button to download raw data. So if you can log in you can just download.
    - murphyslab 3y ago
      23andMe shows up to 1500 DNA Relatives for each user (outside of subscription features). What we know thus far is that the malicious persons who compiled these datasets are scraping user profiles of DNA Relative matches who are related to the accounts which they were able to directly compromise (likely as a result of password reuse). The posters claim to have accessed around ~7M profiles, which means the lower limit for directly compromised accounts is ~4700, although likely much higher (maybe a factor of 10?), given the overlap in match lists, and provided that their boasts are true. So that's potentially ~5000-50000 profiles. For those directly compromised accounts raw data could be downloaded. For profiles scraped, it would not be feasible to obtain raw data. However it is possible that partial genetic sequences might be assembled for matches. This was at the core of security researchers' investigations into GEDmatch a few years ago [0]. 23andMe does not face the same vulnerability, however with enough compromised accounts it is likely possible to infer a modest proportion of the DNA sequences of profiles which are known to match. [0] https://www.washington.edu/news/2019/10/29/genetic-genealogy-site-vulnerable-compromised-data-impersonations/ https://www.washington.edu/news/2019/10/29/genetic-genealogy...
keep_reading 3y ago
This is also my opinion: they stole a really poor social graph, that's all
- anigbrowl 3y ago
  Knowing who's related to who is a very useful social graph if your goals are unethical.
  - pfannkuchen 3y ago
    Or if your goals aren’t unethnical!
_jal 3y ago
> 23andme is little more than a curiosity. If you call criminal convictions "little more", sure. Many people consider that a good thing, but I'm not talking about moral valence or vibes - the point is they are an industry supplier of PII that sends people to jail.
- deadbeeves 3y ago
  What a strange thing to say. If you committed a crime and the genetic information you gave to some company leaks, and someone is able to use that information to prove you're guilty, what sends you to jail is the fact that you committed that crime. The existence of this company and the leak enabled this particular way of proving you guilty, but you were still guilty, so you might have been successfully proven guilty by other means. But most importantly, you're guilty. You're going to jail because of your actions, and for no other reason. It's not like there's someone out there using this information to frame other people of crimes they didn't do.
  - deleted 3y ago
    [deleted]
  - serf 3y ago
    >It's not like there's someone out there using this information to frame other people of crimes they didn't do. pretty bold claim -- as with any additional justice element the innocent will be trampled to some degree. Here's the thing : it doesn't just open up criminals for prosecution, it also opens up the 23andme population to an even larger arrangement of possibilities for self-incrimination and 'incorrect or misdirected pursuits of justice'. It's nice that a well known murderer was found out, but the reality of the situation is that we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services. It looks bad on the law enforcement agencies and it looks bad for the corporation.
    - deadbeeves 3y ago
      >pretty bold claim I don't think so. How would that even work? It's not much different from framing someone of a crime just by knowing their blood type. >we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services Nah. Let's suppose that someone made a typo and Mr. Buttle is accused of committing the crime Mr. Tuttle, who deposited his genetic material, committed. While the Buttle-genome link is a useful piece of evidence, it's on the judge to request a saliva sample from Mr. Buttle to ensure a trustworthy source of information. If he doesn't, well, it sucks for Mr. Buttle that he got a lazy judge, but it's not on the company. The person who wrote down the name could not have known that information would at some later point be misused to lockup an innocent man.
jedberg 3y ago
Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics.
- sekai 3y ago
  > Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics. There are easier ways to find Jews...
- lazyasciiart 3y ago
  They are? Source?
  - jedberg 3y ago
    https://www.wired.com/story/23andme-credential-stuffing-data-stolen/ https://www.wired.com/story/23andme-credential-stuffing-data... https://www.nbcnews.com/news/amp/rcna119324 https://www.nbcnews.com/news/amp/rcna119324 https://www.washingtonpost.com/technology/2023/10/06/23andme-hacked-data/ https://www.washingtonpost.com/technology/2023/10/06/23andme... https://www.jta.org/2023/10/13/health/23andme-sued-after-ashkenazi-jews-user-data-is-stolen-and-sold-in-targeted-attack https://www.jta.org/2023/10/13/health/23andme-sued-after-ash...
    - 616c 3y ago
      As cute as the implication I just read several of the articles and see no specific evidence about the terrorist groups, just the leak. I'll finish the last one but that's a weak association if I've ever seen one.
- ssnistfajen 3y ago
  Endogamy was also historically common in the Jewish diaspora before the Contemporary Period, so on average they will probably see a lot more distantly related people via 23andMe which creates an exponential increase in the amount of data scraped per user account.
gosub100 3y ago
I'm a data hoarder and considered ordering my complete genetic sequence (not from 23, there are others that send you back an HDD with somewhere around several-gigs to 1tb+ of your genome). But I resisted because I would have no idea what to grep for. Without a biotech background it would simply be a waste of my time.
- px43 3y ago
  Every time you see an article about how some gene makes people like to eat potatos, or grow toenails really fast or something, you're about a minute of searching away from finding exactly what you need to grep for to see if you're a match.
ramraj07 3y ago
The one issue is, unlike social data, you’ve not just given up your data, but you’ve condemned your entire future lineage to this leak. All their genetic information can be partially imputed from this info. Maybe this doesn’t matter today but who knows what it’ll be valued at 50 years from now? Don’t upload your saliva to the internet folks.

by bdamm 3y ago

sgarman 3y ago

What about this? https://www.cbc.ca/news/world/dna-from-genealogy-site-used-to-catch-suspected-golden-state-killer-1.4637726 https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t... Seems like there is at least some value.

ghaff 3y ago
There's arguably societal benefit to the broader availability of DNA data but very little of that passes down to me personally and there are risks. I have very few close relatives but it's not hard to imagine the widespread use of this data by law enforcement would pull in some people with more extended families into investigations they'd rather not be involved in.
somethoughts 3y ago
Doh! Didn't get the fuss over DNA data before but that scenario definitely makes it clear.
mfld 3y ago
Sure , there are several big issues in compromised DNA profiles. See also: https://www.ecseq.com/blog/2019/privacy-implications-of-genetic-information-sharing https://www.ecseq.com/blog/2019/privacy-implications-of-gene... But let's wait until it's clear whether raw data was actually leaked.
- great_psy 3y ago
  Isn’t the raw data pretty much guaranteed to be leaked ? I remember a few years ago there was a button to download raw data. So if you can log in you can just download.
  - murphyslab 3y ago
    23andMe shows up to 1500 DNA Relatives for each user (outside of subscription features). What we know thus far is that the malicious persons who compiled these datasets are scraping user profiles of DNA Relative matches who are related to the accounts which they were able to directly compromise (likely as a result of password reuse). The posters claim to have accessed around ~7M profiles, which means the lower limit for directly compromised accounts is ~4700, although likely much higher (maybe a factor of 10?), given the overlap in match lists, and provided that their boasts are true. So that's potentially ~5000-50000 profiles. For those directly compromised accounts raw data could be downloaded. For profiles scraped, it would not be feasible to obtain raw data. However it is possible that partial genetic sequences might be assembled for matches. This was at the core of security researchers' investigations into GEDmatch a few years ago [0]. 23andMe does not face the same vulnerability, however with enough compromised accounts it is likely possible to infer a modest proportion of the DNA sequences of profiles which are known to match. [0] https://www.washington.edu/news/2019/10/29/genetic-genealogy-site-vulnerable-compromised-data-impersonations/ https://www.washington.edu/news/2019/10/29/genetic-genealogy...

keep_reading 3y ago

This is also my opinion: they stole a really poor social graph, that's all

anigbrowl 3y ago
Knowing who's related to who is a very useful social graph if your goals are unethical.
- pfannkuchen 3y ago
  Or if your goals aren’t unethnical!

_jal 3y ago

> 23andme is little more than a curiosity. If you call criminal convictions "little more", sure. Many people consider that a good thing, but I'm not talking about moral valence or vibes - the point is they are an industry supplier of PII that sends people to jail.

deadbeeves 3y ago
What a strange thing to say. If you committed a crime and the genetic information you gave to some company leaks, and someone is able to use that information to prove you're guilty, what sends you to jail is the fact that you committed that crime. The existence of this company and the leak enabled this particular way of proving you guilty, but you were still guilty, so you might have been successfully proven guilty by other means. But most importantly, you're guilty. You're going to jail because of your actions, and for no other reason. It's not like there's someone out there using this information to frame other people of crimes they didn't do.
- deleted 3y ago
  [deleted]
- serf 3y ago
  >It's not like there's someone out there using this information to frame other people of crimes they didn't do. pretty bold claim -- as with any additional justice element the innocent will be trampled to some degree. Here's the thing : it doesn't just open up criminals for prosecution, it also opens up the 23andme population to an even larger arrangement of possibilities for self-incrimination and 'incorrect or misdirected pursuits of justice'. It's nice that a well known murderer was found out, but the reality of the situation is that we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services. It looks bad on the law enforcement agencies and it looks bad for the corporation.
  - deadbeeves 3y ago
    >pretty bold claim I don't think so. How would that even work? It's not much different from framing someone of a crime just by knowing their blood type. >we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services Nah. Let's suppose that someone made a typo and Mr. Buttle is accused of committing the crime Mr. Tuttle, who deposited his genetic material, committed. While the Buttle-genome link is a useful piece of evidence, it's on the judge to request a saliva sample from Mr. Buttle to ensure a trustworthy source of information. If he doesn't, well, it sucks for Mr. Buttle that he got a lazy judge, but it's not on the company. The person who wrote down the name could not have known that information would at some later point be misused to lockup an innocent man.

jedberg 3y ago

Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics.

sekai 3y ago
> Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics. There are easier ways to find Jews...
lazyasciiart 3y ago
They are? Source?
- jedberg 3y ago
  https://www.wired.com/story/23andme-credential-stuffing-data-stolen/ https://www.wired.com/story/23andme-credential-stuffing-data... https://www.nbcnews.com/news/amp/rcna119324 https://www.nbcnews.com/news/amp/rcna119324 https://www.washingtonpost.com/technology/2023/10/06/23andme-hacked-data/ https://www.washingtonpost.com/technology/2023/10/06/23andme... https://www.jta.org/2023/10/13/health/23andme-sued-after-ashkenazi-jews-user-data-is-stolen-and-sold-in-targeted-attack https://www.jta.org/2023/10/13/health/23andme-sued-after-ash...
  - 616c 3y ago
    As cute as the implication I just read several of the articles and see no specific evidence about the terrorist groups, just the leak. I'll finish the last one but that's a weak association if I've ever seen one.
ssnistfajen 3y ago
Endogamy was also historically common in the Jewish diaspora before the Contemporary Period, so on average they will probably see a lot more distantly related people via 23andMe which creates an exponential increase in the amount of data scraped per user account.

gosub100 3y ago

I'm a data hoarder and considered ordering my complete genetic sequence (not from 23, there are others that send you back an HDD with somewhere around several-gigs to 1tb+ of your genome). But I resisted because I would have no idea what to grep for. Without a biotech background it would simply be a waste of my time.

px43 3y ago
Every time you see an article about how some gene makes people like to eat potatos, or grow toenails really fast or something, you're about a minute of searching away from finding exactly what you need to grep for to see if you're a match.

ramraj07 3y ago

The one issue is, unlike social data, you’ve not just given up your data, but you’ve condemned your entire future lineage to this leak. All their genetic information can be partially imputed from this info. Maybe this doesn’t matter today but who knows what it’ll be valued at 50 years from now? Don’t upload your saliva to the internet folks.