4 ms·

They shared their info with a compromised account. If you didn’t share your DNA matches with the other person, you would have nothing to worry about.

luxuryballs 3y ago
that’s why I only share my profiles with people who have a strong password
- dpkonofa 3y ago
  Do you share your banking info with complete strangers? If not, why would you share your DNA with them and be surprised that they could do something stupid, foolish, or reckless?
  - crazygringo 3y ago
    > Do you share your banking info with complete strangers? I think this is why we were all so surprised when Venmo took off in popularity, with everybody's transactions made public by default...
    - dpkonofa 3y ago
      I still don't understand how so many people can have that info public. Blows my mind...
      - deleted 3y ago
        [deleted]
JohnMakin 3y ago
I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
- dpkonofa 3y ago
  Because the breach wasn’t on 23andMe. It was on another site. The only way you’d be affected by this is if you used the same password on multiple sites (where one of those sites actually had a breach) or if you shared your DNA profile (since it is opt-in) with someone that reused passwords. In the latter case, only the info you shared with that person would be accessible to someone using a compromised account. In other words, if you shared your info with someone you didn’t know and didn’t trust, your info can be used by bad actors.
- tomjakubowski 3y ago
  Really? Seems analogous to sharing, I dunno, a private Google sheet with somebody. If my friend's Google account is compromised, because they reused a password lost on another site, I wouldn't blame Google for the attacker being able to read the sheet. I shared it with my friend knowing that might happen.
- 0xffff2 3y ago
  Of course it means exactly that. If you opt in to a feature that shares your data with other users, you're explicitly opting in to the risk that those users will steal/leak/share your data with a third party, either intentionally or through their own negligence. If 23andMe had made any claim that they took steps to force users to secure their accounts properly or that they implemented measures to prevent data exfiltration then perhaps you could argue that you should have been able to rely on those claims, but as far as I can tell 23andMe made no such claims.
- kbenson 3y ago
  Not the GP but that's clearly the case IMO. If I share my tax records with my accountant and their office is broken into because they left the office key sonewhere, do I blame the office building or the accountant? We can argue about whether the office building should have had better security and noticed weird people around, but ultimately it's the accountant's negligence that allowed my info to be compromised, and if I suspected they weren't the best with their security, I should have factored that into who I decided to share my info with.
- JohnMakin 3y ago

luxuryballs 3y ago

that’s why I only share my profiles with people who have a strong password

dpkonofa 3y ago
Do you share your banking info with complete strangers? If not, why would you share your DNA with them and be surprised that they could do something stupid, foolish, or reckless?
- crazygringo 3y ago
  > Do you share your banking info with complete strangers? I think this is why we were all so surprised when Venmo took off in popularity, with everybody's transactions made public by default...
  - dpkonofa 3y ago
    I still don't understand how so many people can have that info public. Blows my mind...
    - deleted 3y ago
      [deleted]

JohnMakin 3y ago

I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?

dpkonofa 3y ago
Because the breach wasn’t on 23andMe. It was on another site. The only way you’d be affected by this is if you used the same password on multiple sites (where one of those sites actually had a breach) or if you shared your DNA profile (since it is opt-in) with someone that reused passwords. In the latter case, only the info you shared with that person would be accessible to someone using a compromised account. In other words, if you shared your info with someone you didn’t know and didn’t trust, your info can be used by bad actors.
tomjakubowski 3y ago
Really? Seems analogous to sharing, I dunno, a private Google sheet with somebody. If my friend's Google account is compromised, because they reused a password lost on another site, I wouldn't blame Google for the attacker being able to read the sheet. I shared it with my friend knowing that might happen.
0xffff2 3y ago
Of course it means exactly that. If you opt in to a feature that shares your data with other users, you're explicitly opting in to the risk that those users will steal/leak/share your data with a third party, either intentionally or through their own negligence. If 23andMe had made any claim that they took steps to force users to secure their accounts properly or that they implemented measures to prevent data exfiltration then perhaps you could argue that you should have been able to rely on those claims, but as far as I can tell 23andMe made no such claims.
kbenson 3y ago
Not the GP but that's clearly the case IMO. If I share my tax records with my accountant and their office is broken into because they left the office key sonewhere, do I blame the office building or the accountant? We can argue about whether the office building should have had better security and noticed weird people around, but ultimately it's the accountant's negligence that allowed my info to be compromised, and if I suspected they weren't the best with their security, I should have factored that into who I decided to share my info with.
JohnMakin 3y ago