Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's not clear to me that I should care if my data was in the breach. For my data to have been in the breach the following must have happened.

1. I opted in to sharing my information with everyone that 23andMe identified as relatives. "Relatives" in this context means genetic 4th cousins or closer. For me that turned out to be 1500 people, all of whom are as far as I know complete strangers to me (I'm adopted).

2. One or more of those 1500 people used the same password on 23andMe that they used on some other site that suffered a breach that gave up plaintext passwords.

3. That password was included in a credential stuffing attack that let someone get into their 23andMe account, where that intruder downloaded the account owner's relatives list which included my information.

When I chose to share my data with 1500 strangers I was pretty much conceding that I didn't really care who got it.





Yeah, I agree this is pretty overblown. On GEDmatch, you basically give everyone the information in your SNP reads - you can compare arbitrary people there, not just yourself to "close" relatives. The only condition is that you give others the same access as you want for yourself. It's very useful for genetic genealogy.

Technically, you could probably get access to and scrape all that data by uploading fake data, or someone else's. It will do very little useful unless you're into genealogy.


Well of course someone dismissing this would be the top comment here



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: