Comment by bee_rider | Hacker News Reader

Comment by bee_rider | Hacker News Reader

Parent Full thread

I get the need to tie in to a recent big news story for exposure reasons, but I think it would be good to be more explicit about the different problems.

We have businesses that are explicitly built on violating privacy.

We have businesses provide services that require them to collect some private info. I’d put 23andme in this bucket.

We have businesses that have lax security, and actually get their systems broken into.

We have businesses that have fine security, but don’t force users to have good, unique passwords and 2FA. 23andme is in this bucket, right?

The first, we should be happy to run them out of business, like we should actively write laws that try to destroy them.

The third, we should fine them to the point where skimping on security is never a rational decision (and if that runs companies out of business, fine).

The second seems not too bad, every medical-field-related service is going to have some private info necessarily (for example), as long as they don’t exploit it that seems fine.

The fourth seems not so bad, there are all sorts of services that are not so important. I don’t have 2FA on, like, random forums and video games, who cares?

Combining two and four is pretty bad though.

>every medical-field-related service is going to have some private info necessarily (for example), as long as they don’t exploit it that seems fine.

HIPAA is rather stringent, but we don't have anything like that for most other domains where a company might legitimately need confidential information. Instead we have the third party doctrine.

Yeah the medical field was probably a bad example, because of course HIPAA already exists. But lots of services exist that collect data that somebody might consider private as a necessary side effect of doing their thing.

But there's no particular reason or privacy regulation needs to be as narrow in scope as HIPAA.

The good/unique passwords stuff is crazy. Almost all of these happen because of a system backdoor or spoofing an admin. I can’t recall any big breaks we’re adding more $! To a password would have changed the outcome.

I’m pretty sure that “bad passwords” hurt in the 23AndMe case. IIRC the story is they have a service that finds your “dna relatives,” and some people had bad passwords, which meant that attackers could get into their accounts, and also discover information about anyone who’d been matched to them via this “dna relatives” service.

Maybe this sort of “dna relative” service shouldn’t exist, because anyone who opts into it is implicitly putting faith in the password safety of everybody they’ve been matched with. But, I dunno, at least I don’t see this as explicitly evil on 23AndMe’s part.

Reply on news.ycombinator.com