Hacker News Reader

Comment by pavel_lishin | Hacker News Reader

This is one of the reasons I've never sent a DNA swab to Ancestry.com, or 23andme. If I could do so anonymously, I'd do it in a heartbeat - but the potential losses+ outweigh the gains%.

+ admittedly, I'm not even sure what the worst case scenarios are, but that just makes them even scarier.

% ooooh, I might learn that I have a predisposition to alcoholism and rectal cancer? That's nothing that my Russian father couldn't have told me.

View on HN

> If I could do so anonymously, I'd do it in a heartbeat

You can. See "How to use 23andMe without violating your genetic privacy", https://www.abine.com/blog/2013/23andme-without-violating-yo....

Unlike the author of that article, don't publish screenshots of your exact results online. With the percentage risk and the ethnic background, it's likely trivial for 23andme to identify exactly which fake profile Sarah A. Downey used for her test.

  Once  I checked  out, I  went to  my real,  personal inbox  to
  complete the 23andMe registration by clicking the confirmation
  email, which was forwarded to me from the alias email address.

LOL. Thanks for posting this bit of comedy.

How was that problematic? I don't see the issue, especially given that the author was on a VPN and using Firefox in Private Browsing mode while running DoNotTrackMe.

Most email is sent unencrypted, so the NSA likely has a record of that email and can cross-reference it with the 23 account if needed.

Even the header would probably be enough in this case, just to identify the particular masked email with the real email behind it.

> Even the header would probably be enough in this case, just to identify the particular masked email with the real email behind it.

Are you implying that an HTTP header sent in the request to 23andme upon clicking the confirmation link would contain the forwarded email address of the user?

Unless the user were on a web page that included their email account name in the URL (and thus visible in the REFERER header), I don't see how that would happen. And I don't think I've ever seen an email system that puts the account name in the URL.

No, the email header sent by abine when they forward the email from 23andme. That contains their real email address in plaintext, and might also contain the masked address; if not, a timing attack given the time of 23's emails and the time of the forwarded email might work.

If the actual email is unencrypted, then the NSA gets everything for free.

Of course, now you have to trust that Abine won't pas your information on to NSA.

I would be more concerned with information being passed to providers of life, disability, or long-term care insurance. The Genetic Information Nondiscrimination Act (GINA) prohibits the use of genetic information in health insurance and employment, but not those areas.

That seems unlikely, though. The article's approach is probably enough to prevent one's genetic information from being passed on to such insurance providers.

This doesn't sound very anonymous... for one - he's giving them his DNA. Unless he has an identical twin that's fairly unique. Secondly, an adversary can guess he's an abine employee or knows one. That narrows the search space considerably.

Whenever you donate DNA to a large DNA aggregating project, you can be fairly trivially re-identified via a few ways. Even if you control all the other information, if a relative contributes DNA, your match will be close enough to narrow it down to a few relatives (including you). The FBI has famously used this technique to find serial killers and identify seriously messed up paternity.

If it were me, I'd get the NIH Confidentiality Certificate. At least you have legal protections then.

> If I could do so anonymously, I'd do it in a heartbeat

Even if you did they still could identify you if e.g. one of your relatives also submitted a sample.

> I'd do it in a heartbeat

If the benefits aren't really significant why are you interested in doing so anonymously?

Mostly curiosity. For instance, I'd like to know what percentage Neanderthal DNA I have.

Plus, if I am at a significant risk of certain diseases, I'd like to know. I just don't want anyone else to know.

Reply on news.ycombinator.com