4 ms·

"taking action" is personal: just don't give personal information, like your DNA (!) to anyone. You can't control what your relatives do, unfortunately.

faeriechangling 3y ago
You can take personal accountability for driving collective change, which is what is required here. 23andMe's business practices should not be legal, they are recklessly endangering the lives of people who have never used their service or agreed to their terms, and the only thing I can see that can stop them is legislation.
- dekhn 3y ago
  What specifically are you going to make illegal?
- teej 3y ago
  Their business practice of getting hacked?
  - LelouBil 3y ago
    You share a lot of DNA with your parents, and your children. If one of them used 23AndMe, now a par of your DNA is with them.
    - AlbertCory 3y ago
      I said, "You can't control what your relatives do, unfortunately."
  - faeriechangling 3y ago
    Business practices of not caring about securing the populations genetic information with even basic measures such as enforced two factor authentication and compromising the lives of many innocent non-customers through a basic low-skill attack like credential stuffing. I would straight up say they need to be regulated as a healthcare provider and be subject to the security provisions of HIPAA. That would be a start.
    - dekhn 3y ago
      The law (HIPAA not HIPPA) would need to be changed because they aren't a healthcare provider. I'm not sure if they are a BA (business associate) in any contexts, either.
chaosite 3y ago
The article clearly calls for legislative action, which isn't personal.
dimmke 3y ago
I never used 23 and me but I did use Lemonaid Health a few times several years ago and found out that apparently I too was affected by this hack in the form of an email telling me to reset my password - with no other information. Apparently 23 and Me bought Lemonaid at some point. And I only ever used Lemonaid to get prescriptions for medications that really shouldn't even need prescriptions but the United States healthcare system is insane. It's just a comedy of late stage capitalism. And isn't the one privacy law the US does have HIPAA? So shouldn't this run afoul of that somehow?
- faeriechangling 3y ago
  23andMe is not considered a regulated Health Services Provider and thus is not regulated under HIPAA. I can certainly see that changing now because it is utterly absurd that they are not subject to such regulations.
  - 0_____0 3y ago
    *HIPAA (Health Insurance Portability and Accountability Act) To be fair I had to look up what the acronym stands for.
nerdjon 3y ago
The problem is when "just don't give personal information" is taken out of your control. For example, I have largely cut Facebook and Google out of my life (Facebook lingers for keeping up with a few people but its access is severely limited). However that does nothing to stop my data that may happen to be on my friends phones (like my cell phone or chats for example) from being gobbled up by both of these companies if they allow it. There is basically no way for me to stop Google from buying my credit card information. Just saying use a different card really isn't a realistic option. These laws are necessary because there are many instances of a complete lack of consent on my part for these companies getting my data.
hanniabu 3y ago
I would love this, but unfortunately if you want to travel nowadays you need to give up biometrics to board a flight
supertrope 3y ago
Technically that means not participating in genetic research studies. At least there's the GINA law.
Centigonal 3y ago
Great idea - I'm going to take personal action to stop my data from getting into the hands of corporations. Now all I need to do is... - Stop using credit cards and taking loans, or go through every payment processor's arcane process to stop them from sharing my transaction data with advertisers - Learn what a "tracking pixel" and "device fingerprinting" is and install browsers/extensions to block these technologies, breaking several websites in the process - Stop receiving images in my emails - Decompile and screen all my mobile apps to make sure they don't use something like Foursquare's Movement SDK, which allows app developers to create location-aware apps at the cost of sending their users' location data to Foursquare, who then sells it. Foursquare is just one of a half-dozen companies who do this and probably the most transparent, so I've got my work cut out for me. - Gather a list of all major customer segment providers (companies like Neustar and Claritas) and figure out where and how they get their individual-level data (this is often a fiercely guarded trade secret) so that I can avoid making it into their data collection funnels. - Find a mobile carrier who won't sell my cell phone data. - Find a pharmacy who won't sell my aggregated prescription data to IQVia or one of its competitors - Stop voting (voter rolls are often public or buyable and include your address) - Never donate directly to a political campaign - Only buy a house via an LLC with a registered agent - Only deal with merchants who won't sell my transaction history Yeah, this seems easier and more tenable than privacy legislation. Definitely.
- MaxBarraclough 3y ago
  You missed one - don't buy a modern car. ‘Privacy Nightmare on Wheels’: Every Car Brand Reviewed By Mozilla — Including Ford, Volkswagen and Toyota — Flunks Privacy Test - https://news.ycombinator.com/item?id=37443644 https://news.ycombinator.com/item?id=37443644
- MerelyMortal 3y ago
  It sounds like you're saying: You can't do everything at once, so don't even start!
  - AlbertCory 3y ago
    Exactly. The point was only "you don't have to join 23andMe so don't." Not "that's all you have to avoid" or "you can have total control."
fnordpiglet 3y ago
I’ve never understood the specific privacy concern I should have about my genetic code. The things I consider private in my life never surface in my biology, they surface in my behaviors, experiences, thoughts, associations, and other aspects of my lived life. While I don’t want insurance company to adjudicate coverage and claims from it, I don’t know what hackers or customers of illegally obtained health ordnance dna data are reasonably going to do with it that impacts me in the least. I’d love to be convinced otherwise, but at some level I almost am at the level of anonymized genetic codes should be generally available with health histories for researchers and not locked away behind privacy screens more rigorous than everything I actually wish could be kept private.
- AlbertCory 3y ago
  Just don't commit any crimes. Or be suspected of one.
  - adolph 3y ago
    Or be statistically correlated to material found at one
    - fnordpiglet 3y ago
      Has this happened?
  - fnordpiglet 3y ago
    Seems like good advice, but I’m not sure the police are buying illegally obtained DNA sequences from hacker groups. (But I’m sure there are nations that do)
    - AlbertCory 3y ago
      https://en.wikipedia.org/wiki/Zodiac_Killer https://en.wikipedia.org/wiki/Zodiac_Killer Cops don't need to go illegal.
    - 3y ago
sli 3y ago
The ability of relatives, friends, and acquaintances to completely invalidate my own actions is the entire reason this advice falls flat. Unless the advice is to simply never interact with those people to the point of my friends and family not even having my phone number. Personal action is nonviable when the entire rest of the system is built is sidestep it.
janalsncm 3y ago
> You can't control what your relatives do, unfortunately. That’s exactly what laws are for. Making “best practices” enforceable. Imagine if not killing people was just considered a “best practice” rather than something you would face severe consequences for. In this case the best practices need to be enforced against 23andme and their ilk.

faeriechangling 3y ago

You can take personal accountability for driving collective change, which is what is required here. 23andMe's business practices should not be legal, they are recklessly endangering the lives of people who have never used their service or agreed to their terms, and the only thing I can see that can stop them is legislation.

dekhn 3y ago
What specifically are you going to make illegal?
teej 3y ago
Their business practice of getting hacked?
- LelouBil 3y ago
  You share a lot of DNA with your parents, and your children. If one of them used 23AndMe, now a par of your DNA is with them.
  - AlbertCory 3y ago
    I said, "You can't control what your relatives do, unfortunately."
- faeriechangling 3y ago
  Business practices of not caring about securing the populations genetic information with even basic measures such as enforced two factor authentication and compromising the lives of many innocent non-customers through a basic low-skill attack like credential stuffing. I would straight up say they need to be regulated as a healthcare provider and be subject to the security provisions of HIPAA. That would be a start.
  - dekhn 3y ago
    The law (HIPAA not HIPPA) would need to be changed because they aren't a healthcare provider. I'm not sure if they are a BA (business associate) in any contexts, either.

chaosite 3y ago

The article clearly calls for legislative action, which isn't personal.

dimmke 3y ago

I never used 23 and me but I did use Lemonaid Health a few times several years ago and found out that apparently I too was affected by this hack in the form of an email telling me to reset my password - with no other information. Apparently 23 and Me bought Lemonaid at some point. And I only ever used Lemonaid to get prescriptions for medications that really shouldn't even need prescriptions but the United States healthcare system is insane. It's just a comedy of late stage capitalism. And isn't the one privacy law the US does have HIPAA? So shouldn't this run afoul of that somehow?

faeriechangling 3y ago
23andMe is not considered a regulated Health Services Provider and thus is not regulated under HIPAA. I can certainly see that changing now because it is utterly absurd that they are not subject to such regulations.
- 0_____0 3y ago
  *HIPAA (Health Insurance Portability and Accountability Act) To be fair I had to look up what the acronym stands for.

nerdjon 3y ago

The problem is when "just don't give personal information" is taken out of your control. For example, I have largely cut Facebook and Google out of my life (Facebook lingers for keeping up with a few people but its access is severely limited). However that does nothing to stop my data that may happen to be on my friends phones (like my cell phone or chats for example) from being gobbled up by both of these companies if they allow it. There is basically no way for me to stop Google from buying my credit card information. Just saying use a different card really isn't a realistic option. These laws are necessary because there are many instances of a complete lack of consent on my part for these companies getting my data.

hanniabu 3y ago

I would love this, but unfortunately if you want to travel nowadays you need to give up biometrics to board a flight

supertrope 3y ago

Technically that means not participating in genetic research studies. At least there's the GINA law.

Centigonal 3y ago

Great idea - I'm going to take personal action to stop my data from getting into the hands of corporations. Now all I need to do is... - Stop using credit cards and taking loans, or go through every payment processor's arcane process to stop them from sharing my transaction data with advertisers - Learn what a "tracking pixel" and "device fingerprinting" is and install browsers/extensions to block these technologies, breaking several websites in the process - Stop receiving images in my emails - Decompile and screen all my mobile apps to make sure they don't use something like Foursquare's Movement SDK, which allows app developers to create location-aware apps at the cost of sending their users' location data to Foursquare, who then sells it. Foursquare is just one of a half-dozen companies who do this and probably the most transparent, so I've got my work cut out for me. - Gather a list of all major customer segment providers (companies like Neustar and Claritas) and figure out where and how they get their individual-level data (this is often a fiercely guarded trade secret) so that I can avoid making it into their data collection funnels. - Find a mobile carrier who won't sell my cell phone data. - Find a pharmacy who won't sell my aggregated prescription data to IQVia or one of its competitors - Stop voting (voter rolls are often public or buyable and include your address) - Never donate directly to a political campaign - Only buy a house via an LLC with a registered agent - Only deal with merchants who won't sell my transaction history Yeah, this seems easier and more tenable than privacy legislation. Definitely.

MaxBarraclough 3y ago
You missed one - don't buy a modern car. ‘Privacy Nightmare on Wheels’: Every Car Brand Reviewed By Mozilla — Including Ford, Volkswagen and Toyota — Flunks Privacy Test - https://news.ycombinator.com/item?id=37443644 https://news.ycombinator.com/item?id=37443644
MerelyMortal 3y ago
It sounds like you're saying: You can't do everything at once, so don't even start!
- AlbertCory 3y ago
  Exactly. The point was only "you don't have to join 23andMe so don't." Not "that's all you have to avoid" or "you can have total control."

fnordpiglet 3y ago

I’ve never understood the specific privacy concern I should have about my genetic code. The things I consider private in my life never surface in my biology, they surface in my behaviors, experiences, thoughts, associations, and other aspects of my lived life. While I don’t want insurance company to adjudicate coverage and claims from it, I don’t know what hackers or customers of illegally obtained health ordnance dna data are reasonably going to do with it that impacts me in the least. I’d love to be convinced otherwise, but at some level I almost am at the level of anonymized genetic codes should be generally available with health histories for researchers and not locked away behind privacy screens more rigorous than everything I actually wish could be kept private.

AlbertCory 3y ago
Just don't commit any crimes. Or be suspected of one.
- adolph 3y ago
  Or be statistically correlated to material found at one
  - fnordpiglet 3y ago
    Has this happened?
- fnordpiglet 3y ago
  Seems like good advice, but I’m not sure the police are buying illegally obtained DNA sequences from hacker groups. (But I’m sure there are nations that do)
  - AlbertCory 3y ago
    https://en.wikipedia.org/wiki/Zodiac_Killer https://en.wikipedia.org/wiki/Zodiac_Killer Cops don't need to go illegal.
  - 3y ago

sli 3y ago

The ability of relatives, friends, and acquaintances to completely invalidate my own actions is the entire reason this advice falls flat. Unless the advice is to simply never interact with those people to the point of my friends and family not even having my phone number. Personal action is nonviable when the entire rest of the system is built is sidestep it.

janalsncm 3y ago

> You can't control what your relatives do, unfortunately. That’s exactly what laws are for. Making “best practices” enforceable. Imagine if not killing people was just considered a “best practice” rather than something you would face severe consequences for. In this case the best practices need to be enforced against 23andme and their ilk.