Hacker News Reader

Comment by ballenf | Hacker News Reader

> Such information would only be available if plaintiffs affirmatively elected to share this information with other users via the DNA Relatives feature.

I'm skeptical that 6.9 M users opted-in to an off-by-default setting. That seems absurdly high for any opt-in feature that involves nebulous user value. I don't use 23andme, but I'd love it if someone had screenshots of this supposed "opt-in" before the data breach.

Also, how far does the sharing go? How far removed from a family member does a user have to be to see their info? Going from 14k to 6.9M seems like it must have been more than just immediate family, given the small family size common today.

View on HN

It seems pretty plausible to me, because finding relatives -- especially unknown ones -- is one of the 3 main use cases of the product (the other 2 being understanding your ethnic background and health/disease markers).

They have ~14M users total, so this is 50% of them opting in. That seems entirely reasonable.

This is 50% of them opting in AND being considered relatives to the 14k who reused vulnerable passwords. For all we know, there may be 99% opt-in but only half the opt-ins are "relatives".

But how does the hacker get the DNA data? A feature to find relatives is one thing, exposing all those relative's DNA to the current user is another thing entirely. All the math would be done on the backend, not exposed to the end user, no? Or is the implication here that by getting DNA on the 14k compromised users, the attackers can draw meaningful conclusions on the DNA of those in their network?

> But how does the hacker get the DNA data? A feature to find relatives is one thing, exposing all those relative's DNA to the current user is another thing entirely.

They didn't, unless I'm misunderstanding. They just got some names and a number indicating the degree of genetic similarity or something like that, right?

It’s a bit of a half truth.

The opt in is a prompt presented during onboarding with language that mainly focuses on “connecting and “exploring” who you’re related to.

The prompt is similar in mobile but here[0] is a screenshot of what it looks like on the web.

The fine print talks a little about what you’re sharing.

Where the lie comes in is that after selecting “Get Started” it also automatically enables sharing your ancestry report and the other default privacy settings are very permissive and work on an opt-out basis.

If doesn’t, for example, then give you through the settings and asks what you want to share. It enables everything by default.

0: https://int.customercare.23andme.com/hc/article_attachments/...

> Also, how far does the sharing go? How far removed from a family member does a user have to be to see their info? Going from 14k to 6.9M seems like it must have been more than just immediate family, given the small family size common today.

Looking at mine, it shows me 4th cousins and closer. So way more than immediate family.

The user value isn't nebulous. If you are curious about your ancestry, you might also be curious to see what people you discover or see if your family tree is your real family.

Reply on news.ycombinator.com