Comment by NikolaNovak | Hacker News Reader

Comment by NikolaNovak | Hacker News Reader

I have a genuine question:

If somebody accesses a Facebook account; and uses it to view intentionally-shared information on 500 people connected to that person; is that Facebook's fault for having that feature?

It appears Hacker News consensus is "Yes", but... that feature IS Facebook; and to many many people, that feature IS "23andme".

Don't get me wrong - I don't have 23andme account; we are at an early age of DNA analysis and I'm supremely uncomfortable randomly giving my DNA and wide permissions to strangers for perpetuity. I've tried to give same perspective to friends and family, with limited success.

I also don't particularly care about geneaology either, yet goodness gracious a lot of people really really do and they get giddy and excited when they find some 'match' on DNA sites :).

But it does rather seem that external actors used credentials obtained elsewhere, to access a core "social-network-like" feature of 23andme, that users eagerly opted in (again, I wouldn't have, but I'm a weirdo:).

I don't understand what 23andme's real fault is, other than existing, and allowing users to willingly, consensually, in an informed manner do what they specifically chose to do. We all told our friends & family "hey don't share your DNA results and intimate details of your life with strangers and random new startups", but they repeatedly choose to do so anyway :(.

My reading suggests that this is the correct interpretation. And I think it actually crystallizes in the question of whether such services should be allowed to exist. To me it’s hard to argue that we should prevent people from creating and consensually engaging in these large-scale social platforms from an individual liberty perspective. However in aggregate they have so much power to disrupt people’s lives. How do you balance these issues?

If 23andMe is in the wrong here it seems to be because this entire approach of large scale social networks is wrong, and we must solve it at a regulatory level.

If you can be massively scraped while holding very sensitive data, you have a problem.

> If somebody accesses a Facebook account; and uses it to view intentionally-shared information on 500 people connected to that person; is that Facebook's fault for having that feature?

I am amazed at the depth of confusion data causes. And the amount of blame deflection that goes on.

Here is a medicine for clarity - imagine data is money, because it is. It’s your money, and someone is holding it for you, someone like a bank.

So the scenario is - a hacker fakes identity of 14,000 people and empties out the bank accounts. Bank does nothing to stop suspicious activity of a single customer pretending to be 14,000 and has poor authentication. whose fault is that?

>>imagine data is money, because it is. It’s your money, and someone is holding it for you, someone like a bank.

But it is not.

I'm not saying it SHOULD NOT be. But it is not, and such sentences perpetuate confusion rather than reduce it. Data is not "money" in general, and definitely not in this case in particular.

Banks have extreme regulatory framework within which they conduct their operations. There are checks (hah!) and balances and accountability and industry standard processes. This regulatory framework, and the formal backing and assurance by the government, is what gives me confidence to put my money there. Note some people's risk threshold is different and they go for cash or bitcoin instead - fair enough.

(Even so, there are situations even in banking where explicitly you are responsible for your data/money. E.g. a lot of wire services, if you grant somebody permission or you wire the wrong entity your money, that's on you.)

23andme does not fall under the same regulatory framework that banks do. It just, doesn't.

I might want and like it to be. Let's campaign for that change together! But it is not. People have given their data to a random new startup with limited regulatory and privacy framework, they have explicitly given that startup permissions to that data, and they have explicitly chosen to share that data with strangers on the quasi-social-network. Bluntly - I love my dad, but I definitely blame him for sending his data to this company despite my urge not to. This was the most predictable outcome in the world along long time scale.

If we are saying that it's 23andme's fault for existing and providing that service, and such services should be regulated, sure, I'll agree :).

But I also believe most news on this are also in the "depth of confusion" when it comes to the 7 million number and the chain of dependency/fault.

You are correct. Human nature seems to be to find a scapegoat. Holding 14,000 anonymous people culpable history doesn't feel as good as complaining about a single, visible entity - even an innocent one.

I finally got through to the women in my family by bringing up what the consequences of their choices to use this service could mean for their children (either currently existing or in the future). Maybe could try that route, seems to trigger concern more than when you're talking about themselves for some reason

Could you please explain what the consequences might be for the children?

Not the OP, and my advice is not specifically for a gender, but FWIW, I give similar advice: We don't know today how DNA data will be used in the future. 10 years from now, 20 years from now, this may be supremely normal, or we could be in massive dystopia of it used nefariously.

Sharing DNA with random startup private entities is not just a potential consequence for you, but also for anybody related to you, in the future, such as in particular your children.

And this is not theoretical for me - I explicitly do not want to be in this, I asked my immediate family to please consider the potential impact, and yet my dad enrolled and put my name in there. I now get to live with that decision.

(don't get me wrong, my dad and I are super close - but on this one thing, he, as most people, saw this as a lightweight decision with no consequence and some fun trivia, and did not share my perspective of it as a heavyweight, impactful decision with potentially long-lasting consequences)

Exactly what I meant, thanks

Reply on news.ycombinator.com