23andMe hackers accessed a whole lot of personal data
techradar.com
techradar.com
The only benefit I can imagine* is knowing if I have individual genetic markers for something I should tell my son about.
DEF CON 25 - John Sotos - Genetic Diseases to Guide Digital Hacks of the Human Genome (2017): https://www.youtube.com/watch?v=HKQDSgBHPfY
https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criti...
> The explanation is vague, so we don’t know exactly how many files were accessed
They didn't access "files" on 23andMe's servers; they scraped information that 23andMe was making available through its UI to even the most distant of DNA "relatives." In a way I think that makes 23andMe even more culpable than it would have been if someone were able to break into their servers.
> The company later confirmed the data’s authenticity, saying a hacker most likely used credential stuffing (trying an infinite amount of username/password combinations) to access its systems.
That's not what credential stuffing is.
This is the part that gets me. I have young nieces and could conceivably have children someday. Making my DNA public could end up being an invasion of their privacy.
For context, third cousin is your great grand aunt/uncle's great grandchild[1]. E.g. your parent's parent's parent's sibling's child's child's, child. I am doubtful most people know their second cousin let alone their third (I'm sure there are those that do though). But this is showing the reach of that information leakage, because it can come from someone you have never met in your entire life and do not even have indirect communication with (given the likelihood of your great grandparent being dead and requiring your grandparent to be in contract with their cousins or your parent to be in contact with their second cousin).
As more DNA is collected this extent might widen as statistical power increases but this is purely conjecture. I'll also note that the precision needed for reduction of suspects like this case is not the same as certain hereditary conditions but not for all. The main point is about how many people your actions affect and vise versa, that we do not live in a world where the consequences are exclusive to your actions (and importantly, where it is becoming less dominated by your actions).
[0] https://www.science.org/content/article/we-will-find-you-dna...
[1] https://i.pinimg.com/736x/8a/cc/23/8acc23f05c79faabe0740d656...
It's super lame that the company doesn't enforce 2FA.
you just cant trust them.
unfortunately i think my mother has pulled my name into ancestry... not much i can do about that except not re-enforce the link
Seriously. What’s the threat model here? A human clone? Someone hacking a police database to replacing some criminal’s dna record with your record? None of these are plausible.
Even the reporting about compiling a list of people of Jewish ancestry is fear mongering. An antisemitic troll post? Absolutely. An actual novel threat? Well, probably not much more than a regexp and phonebook.
Seriously. Give me a real scenario that has been demonstrated that uses this information in a way that someone with… oh $10 million in resources could do. I’ll wait.
No hacker is running nucleobase query.
“The BMA has warned that the possibility of developing weapons genetically targeted at different ethnic groups could be just five years away.”
Published Jan 30, 1999
That type of total secrecy only exists in bad movies and conspiracy theories.
Alternatively, imagine a genetic "klout" type company that harvests such data and is used like a personality credit score. Your employer, university, landlord can check whether you have the right "personality traits" without directly falling afoul of anti discrimination laws.
Notice that the important thing in both of these scenarios isn't whether genetics is truly useful here, it's that people believe it is regardless of actual efficacy. Phrenology and foot measurements were used for similar things decades ago.
Future threat: individualized, immutable presence identification and tracking from eDNA. We can already do this in marine environments and at a species level elsewhere, but it's a very new capability.