10 ms·
I would have presumed that security-minded people, which includes those who work in tech, would not so easily give away their genome, and that most of 23andMe's
by d2049 3y ago
I would have presumed that security-minded people, which includes those who work in tech, would not so easily give away their genome, and that most of 23andMe's customers are a slice of the general population. But then I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas and I'm befuddled. Why would anyone willingly do that?
- xvector 3y agoI am a security engineer. When I signed up for 23andme, I assumed with certainty that it would be hacked and all data leaked at some point. I balanced that with the value of knowing potentially important health/genetic bio markers. In the end, I valued knowing these bio markers above the privacy of my genome. The former is actionable and I can use it to optimize my health and longevity; the latter is of vague value and not terribly exploitable outside of edge-case threat models.
- smarkov 3y agoExactly my thoughts. I'd be more upset if a combination of my name and email/phone number got leaked than if my DNA was made available public.
- tuwtuwtuwtuw 3y agoWhy would you be upset if your name+phone combo was leaked? Mine is all over internet so wonder why you feel it would be bad.
- smarkov 3y agoI simply don't want to deal with spam or scams. If I'm exposing my contact details it would be a separate set that is dedicated to dealing with communication coming from the public.
- themaninthedark 3y agoWhy? You can change your phone number and your name. Good luck with doing so with your DNA.
- hot_gril 3y agoPhone numbers are an increasingly important identifier. Sucks to lose one.
- tuwtuwtuwtuw 3y agoWhat do you mean by "identifier"? For me, phone numbers have had reduced importance over the last couple of years. Most of my communication with other people are over various messaging apps.
- hot_gril 3y agoIdentifier as in, used for authentication and possibly even tied to your real name. Even messaging apps don't tend to have screen-names like AIM, they have phone numbers, including the so-called "privacy-focused" Signal. Tons of in-person services (govt, banks, etc) will also want one, and it may be used as yet another piece proving your real identity.
- tuwtuwtuwtuw 3y agoAlright. Where I live, phone numbers are public info and not secret so here they are not used when authenticating yourself against a bank or similar. Using a phone _number_ to authenticate yourself against the government seems completely bizarre to me. I understand that leakage of phone numbers become a problem if you use them for those kinds of things. But honestly, using them for authentication seems crazy from a security point of view.
- smarkov 3y agoAnd that is exactly why they can be changed - because they're valuable details that can be used to track someone down. Your DNA is easily obtainable and is not used in any meaningful way that would affect your life if it was exposed.
- deleted 3y ago[deleted]
- c7b 3y agoIn retrospect, how do you so far value the utility of the data you got? Did you take any actions based on them, do you think you will be doing so in the future?
- xvector 3y agoLuckily I had no severe biomarkers. Some minor ones, but nothing I didn't know already. I loved learning about my ancient ancestry, though (ie migratory patterns 300k years ago.) On balance, was the utility worth the cost (of a breach)? Probably not, because I found no major actionable issues. But if I did find severe biomarkers, it would have been worth it. So I do still think I made the right choice.
- logifail 3y ago> I can use it to optimize my health and longevity Q: Is it a HN thing to be (obsessively?) interested in health and longevity? Dying is a natural process. Sorry.
- rfrey 3y agoIt's a human thing. Not all humans, but many. > Dying is a natural process. Sorry. Avoiding dying, as best one can, is also a natural behaviour.
- logifail 3y ago> Avoiding dying, as best one can, is also a natural behaviour Source? Natural selection is about passing on our genes which looks like: reproduce, raise your offspring ... <roll credits>
- averageRoyalty 3y agoWe fight all sorts of natural processes. Most common forms of death from a couple of centuries ago are solved. Our average lifespan has increased dramatically. We fly around in planes, travel to space, grow fruit out of season and build giant cities. As a species, we're excellent at working around or ignoring what's "natural".
- xvector 3y agoI don't really care whether it's natural or not. Maybe if you ever have a NDE you will understand.
- hot_gril 3y agoAnd I'm probably gonna die before any of these theoretical DNA privacy risks becomes real.
- basch 3y agoOr the reality is, if someone wants your dna they will follow you around and grab a coffee cup.
- mrweasel 3y agoYes, yours specifically, but what if I want like 200.000 people so I can find one that has a DNA profile similar to mine, who could serve as a escape-goat or victim? Maybe I want to steal a kidney, or a child that could reasonably pass as my own?
- searine 3y ago>but what if I want like 200.000 people so I can find one that has a DNA profile similar to mine There are already literally entire databases of millions of peoples DNA freely available for scientific research.
- mrweasel 3y agoNot with names and contact information I assume?
- searine 3y agoIf you were smart enough to hack 23andMe to get genetic data to find a specific person, you'd be smart enough to reconstruct identities from publicly available data. You'd just have to cross-reference public anonymous databases with public non-anonymous ones. Both of which exist, and are free. So far, the only real use-case for doing this is people trying to identify criminals from just DNA.
- slingnow 3y agoYou realize this data is often available for purchase or eventually publicly leaked, right? You don't have to be "smart enough" to do the hacking to benefit from it.
- 3y ago
- FireBeyond 3y ago> But then I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas Well, in the case of WorldCoin, I think there's still some pretty significant questions of why they made Africa a prominent launch market (well, there are some reasons), but in some places they repeatedly increased incentives until they were offering people there up to a month's income to give their scans. That might not be a lot of money to a big startup, but is telling that they had to offer that much to get some people to "opt" in.
- mrweasel 3y agoThe same people believed crypto-currency, infinite growth, social media and many other things. At least 23andMe provided actual value, to some at least. What I find strange is that 23andMe did not automatically delete data after 30 days, or at the very least took it offline, only to be available on request. Notify people that their results are available and inform them that the data will be available for 30 days after the first download. This is potentially really sensitive data and based on 23andMe's response, they seem to be aware of that fact. So why would they keep the data around? That seem fairly irresponsible and potentially dangerous to the company.
- geoelectric 3y agoTheir service is selling you a dashboard over your genetic data that’s continually updated for new gene correlation studies and ancestry matches. It’s not really the one and done “Promethease” style analysis service you’re thinking of.
- vik0 3y agoWhat actual value did 23andMe and similar services offer in the first place? Quenching someone's curiosity about where their ancestors are from? Do we even know how accurate it is at doing that?
- jstarfish 3y agoAncestry data, but also health markers. I.e. you're probably going to get macular degeneration, Tay-Sachs and cervical cancer. Once I enabled the social graph thing I was immediately hounded by distant relatives who I assume want to chop me up for parts. > Do we even know how accurate it is at doing that? The police have closed a few cold murder cases based on adjacency (once Parabon got their hands on samples), so it must be pretty accurate. Anecdotally, my profile told a radically different story about our ancestry than my family's vague lore led me to believe. 23andMe's data made way more sense.
- dekhn 3y agoIf you go back in time, 23andMe was founded to collect genetic data with the goal of using that data to improve the health condition of humanity. Over time it became clear that 23andMe's data set had limited predictive ability for health for a number of technical reasons (previously, dahinds, one of their statistical geneticists, has defended the quality of their predictions on HN, you can search for his comments. I suspect he can no longer comment on HN because of 23&Me's security debacle). However, around that same time, 23&Me's dataset turned out to be excellent for ancestry analysis. It's generally considered fairly accurate (not just 23&Me- the entire process of ancestry through snp genotyping workings really well). I never did 23&Me but my dad did- and he learned he has children all around the US (half brothers and sisters of mine) from some samples he provided some 45+ years ago. Both my dad and those people gained value from making that connection. It's interesting because my dad had already done most of the paper research (including going to SLC to visit the Mormon archives) to identify our obvious ancestors, and these relatives would never have shown up.
- Dma54rhs 3y agoPoor and desperate people don't have the luxury thinking of these first world privacy issues. There a reasin Altman and launched it where they did.
- barbazoo 3y agoThat explains the WorldCoin but not 23andme, people voluntarily paid for that so they couldn't have been that poor.
- switchbak 3y agoYou didn't need to supply accurate information, this isn't a bank here with any validation of your identity.
- bogwog 3y agoYou can at least change your name. You can't change your DNA, so when companies start selling that data it will be easy to detect when you give out fake information. The only missing piece is a way to scan your DNA as part of a login form.
- hot_gril 3y agoWhat good is my DNA without a real identity attached to it?
- bogwog 3y agoIdk, it probably has some value. But my point was that it's going to be difficult to prevent your real identity from becoming attached to your DNA forever. The moment your real (DNA, identity) pair leaks from a credible source, your privacy is permanently and retroactively ruined. So if 23andMe leaked a fake name with your DNA, it's out there in the hands of advertisers/scammers/governments/etc. From now on, anyone who gets access to your DNA will be able to build up data on you, and all it will take is a single leak/sale from a credible source to make it accurate. (...but in truth, I have no idea what "DNA data" looks like, or if it's even possible to use it for targeting...)
- hot_gril 3y agoIf someone else is leaking a credible ID/DNA combo, it doesn't matter whether or not I did 23andMe.
- switchbak 3y agoYeah I don't understand how someone's anonymous DNA being on that site makes the situation worse. If someone finds my DNA without my identity, they're no further ahead. If they do have my DNA and my identity, well the 23andme part gives no additional information. Maybe some day this will be a big concern, but by then we'll have much bigger things to worry about.
- deleted 3y ago[deleted]
- PH95VuimJjqBqy 3y agoIt will be a cold day in hell before I ever submit to dna analysis of this nature. That doesn't stop my family from doing so, but I sure as hell will never.
- weebull 3y agoSo they've basically done it for you. Primary sensitive information is about is predisposition to hereditary disease. That's the same for you and your siblings.
- PH95VuimJjqBqy 3y agoI understand that but I can't control them so I must draw the line where I'm able.
- 93po 3y agoThe long term premise of WorldCoin is to not store retina scans in any way, and scanning stations in the US already do not do so.
- itronitron 3y ago'long term premise'
- 93po 3y agoThey need training data. Is it awful that they're collecting it with extremely explicit consent and even providing generous compensation for it? Are beta versions of products not allowed to be different than final versions? Most tech companies would just take your data without asking and provide you nothing in return.
- hot_gril 3y agoWhat's the implication here, that tech people should know better? I just don't care a ton about my privacy. At least that makes me not a hypocrite for working at a company that profits from user data (like many tech ones do).
- latentcall 3y agoI was 24 in 2015 and not in tech or as security minded as I am now when I received the test as a Christmas present. Obviously now I wouldn’t have dared do it, but it’s too late. Lacked the foresight at the time.
- dekhn 3y agoI'm familiar with security (I keep a copy of Applied Cryptography on my shelf for "fun reading") and tech, here's a copy of my whole genome: https://my.pgp-hms.org/profile/hu80855C https://my.pgp-hms.org/profile/hu80855C Note it's a full human genome, far more data than a 23&Me report. You can download the data yourself and try to find risk factors (at the time, the genetic counsellors were surprised to find that I had no credible genetic risk factors). Please let me know in technical terms, combined with rational argument, why what I did was unwise. Presume I already know all the common arguments, evaluated them using my background knowledge (which includes a PhD in biology, extensive experience in human genome analysis, and years of launching products in tech). I've been asking people to come up with coherent arguments for genome secrecy (given the technical knowledge we have of privacy, both in tech and medicine) and nobody has managed to come up with anything that I hadn't heard before, typically variations on "well, gattaca, and maybe something else we can't predict, or insurance, or something something".
- yborg 3y ago>well, gattaca, and maybe something else we can't predict, or insurance, or something something Sure, if you don't believe in any of the potential negative scenarios, anything goes. You could also post your full name, SSN, DOB, address, etc. here if you are secure in the knowledge that no harm could ever come of it.
- dekhn 3y agoI think we already know for sure that posting a combination of full name, SSN, DOB, and address is a reliable way to provide scammers with the necessary information to commit fraud.
- BobaFloutist 3y agoI think what they're saying is that name (probably not), SSN (almost definitely), DOB (maybe?) and address (probably) have known, confirmed risks. There are current ways that bad actors can abuse that information. Genome is still pretty theoretical, except getting caught for committing crimes.
- rand1239 3y ago> Why would anyone willingly do that? Maybe they accept the possibility that they die one day?
- p_j_w 3y ago>But then I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas and I'm befuddled. I'm befuddled that anyone thinks Sam Altman is the least bit trustworthy after WorldCoin.
- kelthan 3y agoThere is a difference between genomic data and biometric data: biometric data has a known potential exploit vectors. So, with a picture of your retina, a sophisticated adversary could potentially reproduce your retina to allow access to some secure facility. Genomic data doesn't have the same risk factors--at least at the moment. I think that the point many are trying to make here is that there may be risk vectors available at some point in the future that aren't known now. A couple of theoretical examples: * You had to give a blood sample rather than other biometric data like a retina scan. * Spoofing DNA evidence. That would be very/prohibitively expensive/difficult at the moment, but I suppose could become as easy as 3d printing at some point in the future.
- akira2501 3y ago> I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas Is this actually happening, or is that just what the stories say?
- varispeed 3y agoI know someone who is very security-minded, but also he was born to parents misplaced due to a war and they didn't know where they come from (their adoptive parents would only know a region, but not for sure). At the time it was an easy option to learn something about his heritage to him. His curiosity was satisfied.
- deleted 3y ago[deleted]