8 ms·

I am extremely skeptical that many people are making an informed cost/benefit here. I would wager most users don’t even know about the license terms. It’s the

I am extremely skeptical that many people are making an informed cost/benefit here. I would wager most users don’t even know about the license terms. It’s the same as infosec in general. Most people don’t know about the risks, and anyway are bad at quantifying tail risk.

creato 2y ago
You don't need to know the license terms to know what is happening. Just observe that you get ads based on browsing and searching behavior. Most people can see that it's happening and don't care. Or at least not enough to give up the value they get in exchange.
hn_throwaway_99 2y ago
I agree most folks aren't aware of the risks. But I'm guessing for the vast majority of people that are aware of the risks, the thought process is basically along the lines of: 1. I'm simply not that important. There are millions of other people who have given this data to 23 and me and the like, and I'm just some rando peon - nobody is going to be specifically searching for my DNA. 2. The "worst case scenarios", e.g. getting health insurance denied because you have some gene, still seem implausible to me. Granted, there is a ton of stuff I thought would be implausible 5-10 years ago that is now happening, but something like this feels like it would be pushed back against from all sides of the political spectrum, even in our highly polarized world. 3. I haven't murdered anyone, so I'm not worried about getting caught up in a DNA dragnet. Sure, there can be false positives, but to get on in life you pretty much have to ignore events with low statistical probability (or otherwise nobody would even get in a car on the road, and that has a much higher statistical probability of doing you harm).
- generationP 2y ago
  What if someone in your family has done a crime, and the result of your DNA being online is (1) you are the first suspect and (2) the criminal might well learn/suspect that they have been compromised through you?
  - mustyoshi 2y ago
    Isn't it better for society as a whole if criminals are apprehended? Even moreso if they're one that would be a physical threat like you're suggesting?
    - haxxorfreak 2y ago
      Yes, assuming the label of who is a “criminal” is fair. There is always the risk of a society or government changing that definition after they have the data and it’s too late to go back.
    - nukem222 2y ago
      Depends on the crime. They aren't exactly fungible acts. Furthermore the state isn't exactly obligated to manage society, even if this has occurred in various forms throughout history. Many of our laws weren't exactly written with "society's" best interest at heart. Ultimately, the state will look after itself above all else. I'm just saying I'd like the state to have to work hard to put people away. The law can just as easily be wielded to harm people. I don't see much sign the american public agrees with me, and politicians certainly don't agree. Even mr "it's a witch hunt" trump is only anti-LEO when it comes to his own crimes. But I'd rather have some low background level of crime than the sinking feeling that we're imprisoning a lot of innocent people, as unpopular a sentiment it might be to some in this country. Besides, if the government doesn't take care of society, higher crime is inevitable.
    - Spooky23 2y ago
      Mustyosi, your DNA was found on a coffee cup at a Denny’s frequented by terrorists destroying Tesla property. Where were you on Tuesday at 2?
      - adolph 2y ago
        “Zoom and enhance” forensics aren’t real right? Isn’t it mostly NSA listens in and then they have to parallel construct something to hide the illegal pervasive surveillance?
- mschuster91 2y ago
  > The "worst case scenarios", e.g. getting health insurance denied because you have some gene, still seem implausible to me. We're halfway there, data mining by insurances already is the norm in car insurance. We should have fought back hard back in the day this was proposed. > I haven't murdered anyone, so I'm not worried about getting caught up in a DNA dragnet. Sure, there can be false positives, but to get on in life you pretty much have to ignore events with low statistical probability Even if you haven't murdered anyone or intend to to so - your genetic data is useful in the pig dragnet. Your genetic data may be what provides the pigs with a link to your nephew who moonlights as a graffiti sprayer... and yes, the German pigs are doing DNA checks on graffiti sprayers, they have been doing so for over two decades [1]. [1] https://www.welt.de/print-welt/article398332/Graffiti-Erstmals-musste-Sprayer-zum-Gen-Test.html https://www.welt.de/print-welt/article398332/Graffiti-Erstma...
  - hn_throwaway_99 2y ago
    Just a suggestion: if your goal is to convince the average Joe why DNA privacy is a concern, and you solely refer to the police multiple times as "pigs", you're not going to persuade many people.
    - consteval 2y ago
      [flagged]
      - deleted 2y ago
        [deleted]
      - hn_throwaway_99 2y ago
        > Here in the US, everyone hates cops. If you honestly believe that, you live in an echo chamber on this topic. This Gallup poll from 2024 reported a majority of Americans have either "a great deal" or "quite a lot" of confidence in the police: https://news.gallup.com/poll/647303/confidence-institutions-mostly-flat-police.aspx https://news.gallup.com/poll/647303/confidence-institutions-...
acdha 2y ago
Ever make bug because you wrote code thinking about how you wanted it to work and forgot to consider how it could go wrong off of that happy path? I think things like this are basically the same problem: when someone is focused on the good outcome it’s just not the right context for most people to carefully evaluate possible negative events, especially low-probability ones. They’re thinking it’d be cool to get an ancestry report, maybe lifesaving to get notice of genetic problem, perhaps the excitement of a unknown relative, and unless there’s a neutral party involved the positives are probably going to win.
dkh 2y ago
I am adopted. I spent most of my life having absolutely no idea whatsoever where I was from, or what biological risk factors I might have. 23andme was valuable to me on many levels, and even with the state the company currently finds itself in, it is not a decision I regret. My wife also did 23andme some years ago, through which she discovered she had Factor V Leiden—a fact which became extremely important very soon after her discovering it, leading directly to changes in her treatment and how closely they monitored her for blood clots (she had a PFO and some other stuff going on that was already compounding her risk of clotting and stroke), and very possibly may have saved her life. I’m supposed to go in and delete every trace of it out of fear of what the down-on-their-luck company might, or simply could, do? While I know that my experience might be rare, I would regardless suggest that you reserve your skepticism, because you aren’t really in a position to assess who did or did not derive a justifiable amount of value from it or how informed of a human being they are
- hn_throwaway_99 2y ago
  Your experience may be unique but I don't think it's exactly rare. I'm just another random anecdote, but I also found I had Factor V Leiden through 23 and me. Also, I'm gay, and for a long time was the only gay person I knew in my extended family. Through 23 and me I discovered a 2nd cousin who also is gay, and I met him in real life and it was an incredibly meaningful and important experience in my life.
  - dkh 2y ago
    One of my good friends discovered her biological half-brother on 23andMe who she had never been told about. They met up, and got along remarkably well, and have actually remained pretty close since! These things do happen. Glad you got something out of it, too. Yeah, these experiences may or may not be rare. I was positing that they might be rare mostly to try to meet the person I was responded to halfway and because I don't actually have evidence one way or the other
    - hn_throwaway_99 2y ago
      While perhaps not as immediately "positive" an experience, there was a bunch of press last year about how consumer DNA tests were uncovering that incest was much more common than previously believed: https://www.theatlantic.com/health/archive/2024/03/dna-tests-incest/677791/ https://www.theatlantic.com/health/archive/2024/03/dna-tests...
casey2 2y ago
Does "infomed cost/benefit" mean "agree with my opinion"? How much information does someone need to show they understand? Do you know the lcense terms to every service you use? certainly not, so applying this standard only when it's your field of expertise is extremely biased. Most people haven't died or had their bank account drained due to bad opsec, so I'm guessing they are accurately assessing the risk as "could be worse". There are so many things that could kill you day to day that people rightly don't care about your pet issue.
deleted 2y ago
[deleted]
AYBABTME 2y ago
I think most people do the cost benefit analysis in a much more empirical manner than your theoretical framework. Most everybody has a justifiable reinforced belief that trading data for value is worth it, since the vast majority of people don't feel like they've been on the losing side when they participated in these transactions before. One can argue that these people may not have understood that a transaction was occurring. I would argue that this is beside the point. Their intuition is hard to discredit in the face of their lived experience. Aside from the marketing spam, most people are probably right in thinking that they've been better off with Google/<alternative> than without. We can pontificate that people should know more about what they agreed to, and so on, if only they knew better, etc. But this rings hollow and very hypothetical to the vast majority of us. It's worrisome in thought exercises, but not validated in real life.
karparov 2y ago
In my experience, even if people knew, they just don't care. Most people I talk to about this, tech and non-tech folk have an attitude with a.mix of "you can't escape this anyway, so might as well embrace it" and "misuse scenarios you are describing are pretty far-fetched".
- lurk2 2y ago
  I read a comment on Hacker News which suggested asking these people to provide you with their unlocked phone. The theory went that most people wouldn’t do it because they realize that they do actually have things they would prefer to be kept private or secure. The first time I tried this, the person I was trying it with unlocked her phone and handed it to me. I didn’t even know how to respond.
  - card_zero 2y ago
    I guess open a social media app and post a PM accidentally in public, like: Hi Laszlo, I'm making the trip on Friday, we can meet at 10 and you can put the stuff in my purse, it should be fine. Don't forget the jewels, that's the only reason I'm doing this.
  - bonoboTP 2y ago
    People worry about "real people" knowing their private stuff, eg a family member, acquaintance, colleague, neighbor etc peeking into their DMs, because these people can impact one's actual life, social life, reputation, job, marriage, etc. They don't care if some faceless corporation has their data in some database with a billion other peoples similar data, as long as that data can't get into the hands of real flesh-and-bone humans that they see with their two eyes in real life as opposed to theoretically maybe existing and doing something nebulous ly nefarious in some scifi future dystopia.
    - lurk2 2y ago
      I’m sure I’m preaching to the choir here, but the data belonging to a faceless corporation (or even a government agency) can be dangerous even if the corporation does not have any nefarious intentions; this is because both the data and the corporation can eventually be compromised by malicious actors.
deleted 2y ago
[deleted]
random3 2y ago
I’d say it was a mix of both for me, combined with being younger and having an “uneven” privacy perception. This said, besides being annoyed, I can’t really tell what the impact is because I can’t even quantify the amount of information (e.g. “resolution”) to the possible uses of that information. Perhaps this could be solved with a class action law suit, that would make it illegal for private entities to own the data post fact, combined with how it was marketed, etc. I’ve seen interest rates for credits reverted this way and credits reduced, for similar reasons. But again, it’s a trade off here too :)

creato 2y ago

You don't need to know the license terms to know what is happening. Just observe that you get ads based on browsing and searching behavior. Most people can see that it's happening and don't care. Or at least not enough to give up the value they get in exchange.

hn_throwaway_99 2y ago

I agree most folks aren't aware of the risks. But I'm guessing for the vast majority of people that are aware of the risks, the thought process is basically along the lines of: 1. I'm simply not that important. There are millions of other people who have given this data to 23 and me and the like, and I'm just some rando peon - nobody is going to be specifically searching for my DNA. 2. The "worst case scenarios", e.g. getting health insurance denied because you have some gene, still seem implausible to me. Granted, there is a ton of stuff I thought would be implausible 5-10 years ago that is now happening, but something like this feels like it would be pushed back against from all sides of the political spectrum, even in our highly polarized world. 3. I haven't murdered anyone, so I'm not worried about getting caught up in a DNA dragnet. Sure, there can be false positives, but to get on in life you pretty much have to ignore events with low statistical probability (or otherwise nobody would even get in a car on the road, and that has a much higher statistical probability of doing you harm).

generationP 2y ago
What if someone in your family has done a crime, and the result of your DNA being online is (1) you are the first suspect and (2) the criminal might well learn/suspect that they have been compromised through you?
- mustyoshi 2y ago
  Isn't it better for society as a whole if criminals are apprehended? Even moreso if they're one that would be a physical threat like you're suggesting?
  - haxxorfreak 2y ago
    Yes, assuming the label of who is a “criminal” is fair. There is always the risk of a society or government changing that definition after they have the data and it’s too late to go back.
  - nukem222 2y ago
    Depends on the crime. They aren't exactly fungible acts. Furthermore the state isn't exactly obligated to manage society, even if this has occurred in various forms throughout history. Many of our laws weren't exactly written with "society's" best interest at heart. Ultimately, the state will look after itself above all else. I'm just saying I'd like the state to have to work hard to put people away. The law can just as easily be wielded to harm people. I don't see much sign the american public agrees with me, and politicians certainly don't agree. Even mr "it's a witch hunt" trump is only anti-LEO when it comes to his own crimes. But I'd rather have some low background level of crime than the sinking feeling that we're imprisoning a lot of innocent people, as unpopular a sentiment it might be to some in this country. Besides, if the government doesn't take care of society, higher crime is inevitable.
  - Spooky23 2y ago
    Mustyosi, your DNA was found on a coffee cup at a Denny’s frequented by terrorists destroying Tesla property. Where were you on Tuesday at 2?
    - adolph 2y ago
      “Zoom and enhance” forensics aren’t real right? Isn’t it mostly NSA listens in and then they have to parallel construct something to hide the illegal pervasive surveillance?
mschuster91 2y ago
> The "worst case scenarios", e.g. getting health insurance denied because you have some gene, still seem implausible to me. We're halfway there, data mining by insurances already is the norm in car insurance. We should have fought back hard back in the day this was proposed. > I haven't murdered anyone, so I'm not worried about getting caught up in a DNA dragnet. Sure, there can be false positives, but to get on in life you pretty much have to ignore events with low statistical probability Even if you haven't murdered anyone or intend to to so - your genetic data is useful in the pig dragnet. Your genetic data may be what provides the pigs with a link to your nephew who moonlights as a graffiti sprayer... and yes, the German pigs are doing DNA checks on graffiti sprayers, they have been doing so for over two decades [1]. [1] https://www.welt.de/print-welt/article398332/Graffiti-Erstmals-musste-Sprayer-zum-Gen-Test.html https://www.welt.de/print-welt/article398332/Graffiti-Erstma...
- hn_throwaway_99 2y ago
  Just a suggestion: if your goal is to convince the average Joe why DNA privacy is a concern, and you solely refer to the police multiple times as "pigs", you're not going to persuade many people.
  - consteval 2y ago
    [flagged]
    - deleted 2y ago
      [deleted]
    - hn_throwaway_99 2y ago
      > Here in the US, everyone hates cops. If you honestly believe that, you live in an echo chamber on this topic. This Gallup poll from 2024 reported a majority of Americans have either "a great deal" or "quite a lot" of confidence in the police: https://news.gallup.com/poll/647303/confidence-institutions-mostly-flat-police.aspx https://news.gallup.com/poll/647303/confidence-institutions-...

acdha 2y ago

Ever make bug because you wrote code thinking about how you wanted it to work and forgot to consider how it could go wrong off of that happy path? I think things like this are basically the same problem: when someone is focused on the good outcome it’s just not the right context for most people to carefully evaluate possible negative events, especially low-probability ones. They’re thinking it’d be cool to get an ancestry report, maybe lifesaving to get notice of genetic problem, perhaps the excitement of a unknown relative, and unless there’s a neutral party involved the positives are probably going to win.

dkh 2y ago

I am adopted. I spent most of my life having absolutely no idea whatsoever where I was from, or what biological risk factors I might have. 23andme was valuable to me on many levels, and even with the state the company currently finds itself in, it is not a decision I regret. My wife also did 23andme some years ago, through which she discovered she had Factor V Leiden—a fact which became extremely important very soon after her discovering it, leading directly to changes in her treatment and how closely they monitored her for blood clots (she had a PFO and some other stuff going on that was already compounding her risk of clotting and stroke), and very possibly may have saved her life. I’m supposed to go in and delete every trace of it out of fear of what the down-on-their-luck company might, or simply could, do? While I know that my experience might be rare, I would regardless suggest that you reserve your skepticism, because you aren’t really in a position to assess who did or did not derive a justifiable amount of value from it or how informed of a human being they are

hn_throwaway_99 2y ago
Your experience may be unique but I don't think it's exactly rare. I'm just another random anecdote, but I also found I had Factor V Leiden through 23 and me. Also, I'm gay, and for a long time was the only gay person I knew in my extended family. Through 23 and me I discovered a 2nd cousin who also is gay, and I met him in real life and it was an incredibly meaningful and important experience in my life.
- dkh 2y ago
  One of my good friends discovered her biological half-brother on 23andMe who she had never been told about. They met up, and got along remarkably well, and have actually remained pretty close since! These things do happen. Glad you got something out of it, too. Yeah, these experiences may or may not be rare. I was positing that they might be rare mostly to try to meet the person I was responded to halfway and because I don't actually have evidence one way or the other
  - hn_throwaway_99 2y ago
    While perhaps not as immediately "positive" an experience, there was a bunch of press last year about how consumer DNA tests were uncovering that incest was much more common than previously believed: https://www.theatlantic.com/health/archive/2024/03/dna-tests-incest/677791/ https://www.theatlantic.com/health/archive/2024/03/dna-tests...

casey2 2y ago

Does "infomed cost/benefit" mean "agree with my opinion"? How much information does someone need to show they understand? Do you know the lcense terms to every service you use? certainly not, so applying this standard only when it's your field of expertise is extremely biased. Most people haven't died or had their bank account drained due to bad opsec, so I'm guessing they are accurately assessing the risk as "could be worse". There are so many things that could kill you day to day that people rightly don't care about your pet issue.

deleted 2y ago

[deleted]

AYBABTME 2y ago

I think most people do the cost benefit analysis in a much more empirical manner than your theoretical framework. Most everybody has a justifiable reinforced belief that trading data for value is worth it, since the vast majority of people don't feel like they've been on the losing side when they participated in these transactions before. One can argue that these people may not have understood that a transaction was occurring. I would argue that this is beside the point. Their intuition is hard to discredit in the face of their lived experience. Aside from the marketing spam, most people are probably right in thinking that they've been better off with Google/<alternative> than without. We can pontificate that people should know more about what they agreed to, and so on, if only they knew better, etc. But this rings hollow and very hypothetical to the vast majority of us. It's worrisome in thought exercises, but not validated in real life.

karparov 2y ago

In my experience, even if people knew, they just don't care. Most people I talk to about this, tech and non-tech folk have an attitude with a.mix of "you can't escape this anyway, so might as well embrace it" and "misuse scenarios you are describing are pretty far-fetched".

lurk2 2y ago
I read a comment on Hacker News which suggested asking these people to provide you with their unlocked phone. The theory went that most people wouldn’t do it because they realize that they do actually have things they would prefer to be kept private or secure. The first time I tried this, the person I was trying it with unlocked her phone and handed it to me. I didn’t even know how to respond.
- card_zero 2y ago
  I guess open a social media app and post a PM accidentally in public, like: Hi Laszlo, I'm making the trip on Friday, we can meet at 10 and you can put the stuff in my purse, it should be fine. Don't forget the jewels, that's the only reason I'm doing this.
- bonoboTP 2y ago
  People worry about "real people" knowing their private stuff, eg a family member, acquaintance, colleague, neighbor etc peeking into their DMs, because these people can impact one's actual life, social life, reputation, job, marriage, etc. They don't care if some faceless corporation has their data in some database with a billion other peoples similar data, as long as that data can't get into the hands of real flesh-and-bone humans that they see with their two eyes in real life as opposed to theoretically maybe existing and doing something nebulous ly nefarious in some scifi future dystopia.
  - lurk2 2y ago
    I’m sure I’m preaching to the choir here, but the data belonging to a faceless corporation (or even a government agency) can be dangerous even if the corporation does not have any nefarious intentions; this is because both the data and the corporation can eventually be compromised by malicious actors.

deleted 2y ago

[deleted]

random3 2y ago

I’d say it was a mix of both for me, combined with being younger and having an “uneven” privacy perception. This said, besides being annoyed, I can’t really tell what the impact is because I can’t even quantify the amount of information (e.g. “resolution”) to the possible uses of that information. Perhaps this could be solved with a class action law suit, that would make it illegal for private entities to own the data post fact, combined with how it was marketed, etc. I’ve seen interest rates for credits reverted this way and credits reduced, for similar reasons. But again, it’s a trade off here too :)