Hacker News Reader

You can take personal accountability for driving collective change, which is what is required here. 23andMe's business practices should not be legal, they are recklessly endangering the lives of people who have never used their service or agreed to their terms, and the only thing I can see that can stop them is legislation.

View on HN

What specifically are you going to make illegal?

Their business practice of getting hacked?

You share a lot of DNA with your parents, and your children. If one of them used 23AndMe, now a par of your DNA is with them.

I said, "You can't control what your relatives do, unfortunately."

Business practices of not caring about securing the populations genetic information with even basic measures such as enforced two factor authentication and compromising the lives of many innocent non-customers through a basic low-skill attack like credential stuffing.

I would straight up say they need to be regulated as a healthcare provider and be subject to the security provisions of HIPAA. That would be a start.

The law (HIPAA not HIPPA) would need to be changed because they aren't a healthcare provider. I'm not sure if they are a BA (business associate) in any contexts, either.

Reply on news.ycombinator.com