Hacker News Reader

Comment by treyp | Hacker News Reader

if you expect to be truly anonymous with 23andme, you're going to need to anonymize the address the kit is sent to, the payment information, and the connections to other people you have as well.

View on HN

The following is my boiler plate for anything that requires anonymous subscription - 23andme, domain registration, hosting, etc:

1) Mailbox in SF's China Town (a number don't ask for ID even though they're supposed to legally request it). Many also don't speak much English so if anyone comes to investigate good luck to them.

2) Visa/Amex gift card purchased at Walgreens/Safeway in cash - ideally in a different city you happen to be visiting with no connection in. Las Vegas and New York are great choices.

3) Email address created and accessed via TOR within the incognito mode of the browser. Buy the 23andMe subscription/domain/hosting in the same way but making sure you are using a different TOR session.

While I approve of you guarding your privacy, you may want to be careful about doing this with domain names - many registrars require that the WHOIS information is up to date, and can theoretically take them back if it isn't. I'd imagine the same holds for domainsbyproxy and the like.

So what? All you need is the initial email to work, nobody is going to notice fake whois that quickly. No person is going to show up at the address you list to verify that it's actually your address.

I've used fake whois records for a while and have never had any problems. I did make my main domain "real" a few years ago to avoid any problems, however.

"To date, there is no way to order the service completely anonymously. That said, if you have a trusted friend or relative who would be willing to order a kit for you, his or her address and credit card would be tied to the account, rather than your own, and there would be no way to connect it to you."

even if you've ordered under your own name, doesn't this suggest you could just maintain plausible deniability? surely a DNA test can connect it to you- but that would nullify the "john doe" tactic as well, no?

23andMe make clear that they do not assume that the genetic material belongs to you just because you are the account holder -- you can submit several samples under different names for family members, for instance.

It seems the simplest step to prevent 23AndMe being forced to give up your genetic data at some future dystopic point has already been taken: they already have no way of knowing if it's actually your data. You can take anyone's DNA and call it yours, or give anyone else's name to your own DNA.

Reply on news.ycombinator.com