Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off • Hacker News Board

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#121

Post by taneq » Fri, Dec 02, 2016, 4:01 AM UTC

bastawhiz wrote: post #91

yladiz wrote: post #56

Earlier quoted context omitted.

Yeah, but why does Uber need/care about that information? If I ask to be dropped off at X and walk a couple blocks to Y, Uber shouldn't care. I can understand the argument that maybe going to certain buildings you have to be dropped off at a specific spot, but that seems like a minor gain for something that's more than just a minor intrusion.

(Uber engineer here) The data is used for (or can be used for) a number of practical and important purposes. These are some examples of what we do as well as what we could do with such data: - Fighting fraud - Improving "suggested pickup" locations - Improvements around POOL (we'd rather suggest a location that's easy to pick up from than one that's unsafe) - Figuring out what side of the street you end up on (we can…

Thanks for the insight into what you (may) actually do with the data! There are so many companies demanding intrusive amounts of personal data that it's easy to become cynical.

All of the points that you've listed here would work just as well with anonymized data. Obviously if users are being picked up or dropped off at their house (for instance) then making every journey truly anonymous would be impossible without damaging the data, but you could still strip out explicitly identifying metadata. Are you able to tell us what sort of measures are taken in this regard?

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#122

Post by bastawhiz » Fri, Dec 02, 2016, 4:02 AM UTC

visakanv wrote: post #97

bastawhiz wrote: post #91

Earlier quoted context omitted.

(Uber engineer here) The data is used for (or can be used for) a number of practical and important purposes. These are some examples of what we do as well as what we could do with such data: - Fighting fraud - Improving "suggested pickup" locations - Improvements around POOL (we'd rather suggest a location that's easy to pick up from than one that's unsafe) - Figuring out what side of the street you end up on (we can…

> Individual users' data is very closely guarded internally. It's immensely difficult to look at user data without specific access. Overwhelmingly, this data is queried in aggregate and fed into machine learning systems. The risk of abuse is exceptionally low. But so you're saying it's possible? Somebody with high enough access at Uber might be able to stalk an ex-girlfriend and follow her home? Getting into trouble…

I mean, at the end of the day, there's someone that can SSH into some server if they were really determined. There's logging and auditing that happens, though, so you'd almost certainly get caught. Could you craft some sort of perfect crime to avoid detection? It would be super hard, but there's no universe with perfectly secure software. It's a big system, and there are thousands of moving parts, and the likelihood of you actually getting very far is insanely low.

But that's the same story with that one engineer at Google that has SSH access to the server with the keys to the storage cluster for Gmail. Or the person that writes queries for the Hive cluster that manages Cortana queries at Microsoft. Or the person that writes the API layer that sits in front of the order history service at Amazon.

There's a million ways an engineer at any big company could abuse their powers. But we put safeguards in place, we watch each other, and we do our best to serve our users as best we can. I say this in a general sense, not specifically to Uber. It comes down to trust.

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#123

Post by ak2196 » Fri, Dec 02, 2016, 4:03 AM UTC

bastawhiz wrote: post #91

yladiz wrote: post #56

Earlier quoted context omitted.

Yeah, but why does Uber need/care about that information? If I ask to be dropped off at X and walk a couple blocks to Y, Uber shouldn't care. I can understand the argument that maybe going to certain buildings you have to be dropped off at a specific spot, but that seems like a minor gain for something that's more than just a minor intrusion.

(Uber engineer here) The data is used for (or can be used for) a number of practical and important purposes. These are some examples of what we do as well as what we could do with such data: - Fighting fraud - Improving "suggested pickup" locations - Improvements around POOL (we'd rather suggest a location that's easy to pick up from than one that's unsafe) - Figuring out what side of the street you end up on (we can…

>> The risk of abuse is exceptionally low.

I call bullshit. This coming from the same guys who were mapping one night stands using ride data? What were you guys studying there. Fornicating habits of young adults in large metropolitans?

http://www.whosdrivingyou.org/blog/ubers-deleted-rides-of-gl...

I almost forgot about the time you guys were tracking journalists.

Uber has a reputation and history of being a "shady" company.

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#124

Post by andrewpi » Fri, Dec 02, 2016, 4:03 AM UTC

bigiain wrote: post #73

synicalx wrote: post #55

Earlier quoted context omitted.

I accept it because I don't really care if Uber knows where I am for a couple of minutes after they drop me off. Not everyone's cup of tea, but if you don't like it there's nothing stopping you from uninstalling the app.

Any you trust them (as a company) that they'll "only track you for 5 minutes after using the app", and you trust each of their staff members will have controlled/secured/audited access to only the 5 minutes location data after a trip, and you trust them to never deploy a production bug in their tracking code, and you trust every law enforcement or business partner request for that data including gag-order-backed-NSLs…

>And that's OK - if you're good with that. Now go and ask some women you know whether they have all that trust? Or minorities. Or activists. If you were a Muslim or Mexican in the US right now - do you suppose you'd be happy leaving an Uber app with "Always" location tracking permission on your phone past Jan 20th?

The NSA already has the ability to track cellphones, regardless of what Uber does with their app.

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#125

Post by bastawhiz » Fri, Dec 02, 2016, 4:03 AM UTC

taneq wrote: post #121

bastawhiz wrote: post #91

Earlier quoted context omitted.

(Uber engineer here) The data is used for (or can be used for) a number of practical and important purposes. These are some examples of what we do as well as what we could do with such data: - Fighting fraud - Improving "suggested pickup" locations - Improvements around POOL (we'd rather suggest a location that's easy to pick up from than one that's unsafe) - Figuring out what side of the street you end up on (we can…

Thanks for the insight into what you (may) actually do with the data! There are so many companies demanding intrusive amounts of personal data that it's easy to become cynical. All of the points that you've listed here would work just as well with anonymized data. Obviously if users are being picked up or dropped off at their house (for instance) then making every journey truly anonymous would be impossible without d…

> Are you able to tell us what sort of measures are taken in this regard?

I don't work on this stuff myself, so I can't say.

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#126

Post by joesb » Fri, Dec 02, 2016, 4:06 AM UTC

deathanatos wrote: post #66

ProfessorLayton wrote: post #21

While their explanation is reasonable, I have little reason to trust a company that settled an investigation specifically about location tracking abuse . I've pretty much dropped their app and switched to their mobile site, which is bound to my browser's location settings. Additionally I'll only use them if they're significantly cheaper than lyft from now on.

> While their explanation is reasonable Their explanation is illogical: > Previously, Uber only collected data from the user if the rider had the application open. Now, if a rider calls for an Uber and closes the app, Uber says it will continue to collect location data up until five minutes after the ride ends. That means Uber can see where you end up after you leave the car. That's the change; the reasoning for this…

> That, of course, doesn't occur in the five minutes after I get out of the car.

The logic is that it is likely that you will likely use Uber to go back as well. And they can't track your actual pickup spot unless they keep the tracking always on until you are picked up, which will be way more than 5 minutes.

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#127

Post by pjlegato » Fri, Dec 02, 2016, 4:06 AM UTC

bastawhiz wrote: post #91

yladiz wrote: post #56

Earlier quoted context omitted.

Yeah, but why does Uber need/care about that information? If I ask to be dropped off at X and walk a couple blocks to Y, Uber shouldn't care. I can understand the argument that maybe going to certain buildings you have to be dropped off at a specific spot, but that seems like a minor gain for something that's more than just a minor intrusion.

(Uber engineer here) The data is used for (or can be used for) a number of practical and important purposes. These are some examples of what we do as well as what we could do with such data: - Fighting fraud - Improving "suggested pickup" locations - Improvements around POOL (we'd rather suggest a location that's easy to pick up from than one that's unsafe) - Figuring out what side of the street you end up on (we can…

> The risk of abuse is exceptionally low.

But there's no oversight whatsoever. We should just take Uber's word for that -- despite the company's public track record of repeated privacy violations in the past?

And even if Uber itself has suddenly converted into an unimpeachable guardian of personal privacy, it could always be hacked (and probably already has, just like the NSA and everyone else.) The hackers are not likely to share the same moral compunctions about privacy.

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#128

Post by bastawhiz » Fri, Dec 02, 2016, 4:06 AM UTC

stirner wrote: post #120

bastawhiz wrote: post #91

Earlier quoted context omitted.

(Uber engineer here) The data is used for (or can be used for) a number of practical and important purposes. These are some examples of what we do as well as what we could do with such data: - Fighting fraud - Improving "suggested pickup" locations - Improvements around POOL (we'd rather suggest a location that's easy to pick up from than one that's unsafe) - Figuring out what side of the street you end up on (we can…

Your haughty attitude toward privacy is really chilling. If Uber hasn't received a NSL [1] I would be astounded, and your employer doesn't have a great track record [2]. Please think hard about the world you are helping to create. [1] https://en.m.wikipedia.org/wiki/National_security_letter [2] http://www.buzzfeed.com/johanabhuiyan/uber-is-investigating-...

You missed my point. I said that if we accidentally started collecting all user locations, you wouldn't have to worry about us getting an NSL because our servers would have crashed and burned and no data would have managed to have been collected. Uber's infrastructure is completely incapable of handling that volume of data, because it was never designed to handle it. As far as software bugs go, accidentally collecting all user locations always would be a disastrous one for Uber, not for user privacy.

Have we gotten an NSL? I don't know, but I'd guess we probably have. It would be foolish to think otherwise.

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#129

Post by 0xmohit » Fri, Dec 02, 2016, 4:06 AM UTC

I wrote to Uber a week back or so regarding this and this how they responded:

  My name is Pratik from Uber support, I hope you doing well !
  Sorry to hear about about your experience.. I completely
  understand that this wasn't the experience you expect with
  Uber.
 
  We are constantly working to improve the Uber experience and
  your input is crucial to doing so.
 
  I’ll pass this along to the appropriate team.
 
  Thanks again!

----

There wasn't a response upon posting a comment to their blog regarding the same.

Re: Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

#130

Post by yladiz » Fri, Dec 02, 2016, 4:06 AM UTC

bastawhiz wrote: post #91

yladiz wrote: post #56

Earlier quoted context omitted.

Yeah, but why does Uber need/care about that information? If I ask to be dropped off at X and walk a couple blocks to Y, Uber shouldn't care. I can understand the argument that maybe going to certain buildings you have to be dropped off at a specific spot, but that seems like a minor gain for something that's more than just a minor intrusion.

(Uber engineer here) The data is used for (or can be used for) a number of practical and important purposes. These are some examples of what we do as well as what we could do with such data: - Fighting fraud - Improving "suggested pickup" locations - Improvements around POOL (we'd rather suggest a location that's easy to pick up from than one that's unsafe) - Figuring out what side of the street you end up on (we can…

So a follow up question: which is that data used for and which could it be used for currently, and what's planned?

I also noticed you said that it's queried in aggregate, but that is distinct from it living in aggregate. Does this mean that you actually do keep my individual GPS data and it could be looked up later?

I am still unconvinced that this is necessary, even with those (potential) improvements. I am relatively okay with allowing Uber access to my location outside of the app during the period between me requesting a ride and being picked up, and of course I'm okay with allowing access when I'm physically in the car. But after I get dropped off is a much harder thing to accept. Most of the things you suggested were for before I get picked up, not after. In fact, the only things you suggested were not on that bullet list but in the second to last paragraph ("we can avoid charging you if your driver was looking for you at the wrong location and gave up"; "We can better see where you were actually dropped off at, if your driver lies and leaves the app running after you've left the car").

I understand that Uber itself is trying to be a better company and is trying to move beyond its past life as a cavalier company that suggested looking up information about journalists who write negative things about the company, but it's a really hard image to shake and understandably many people are distrustful of a company whose executives were okay with this. I could very much see a member of Uber's counsel requesting GPS data on some user who filed a lawsuit and giving it to a private investigator (considering that Uber did in fact request information about and that a PI to do investigation into a person who filed a lawsuit against Kalanick).