211–220 of 250 posts
This is precisely why it makes sense to keep database data encrypted even to admins and why it makes sense for ride-sharing companies to be co-operatives or non-profits.
Profit-seeking companies engage in bad behaviours all the time.
A few days ago (on the discussion of the Uber app tracking users' movements after the end of their ride) an Uber employee commented on their data handling: [0] > Individual users' data is very closely guarded internally. It's immensely difficult to look at user data without specific access. Overwhelmingly, this data is queried in aggregate and fed into machine learning systems. The risk of abuse is exceptionally low.…
I don't know about Uber, but I've worked at a lot of places that had sensitive data. A common patterns is to fail to treat employees like attackers, and protect data in ways that are very beatable by a motivated employee. Some examples that hopefully have been fixed: -A company had a specific dataset that would be worth millions: The kind of things that a wikileaks might want to publish, and would make the papers. I…
Unfortunately, this is the state of 99% of all software, everywhere, it would appear. And I'm dubious about that extra 1%.
[Edit] and lets not forget, you can care a lot and still have this be the case
I've begun to ditch apps that I've perceived as going downhill regularly, and its been working out pretty well. Uber, Youtube, Facebook/Instagram, and Twitter have decent mobile sites. I can even silo whatever service I want into its own browser to limit tracking, and all location/permissions/etc are all sandboxed by the browser. A huge bonus is battery life + ad blocking.
Plus, you are now ready to switch your mobile to Linux (Ubuntu), too. And be completely FREED from any proprietary crap prisonware.
Earlier quoted context omitted.
No, I'm not naive, and I, proudly, stand behind everything I wrote. The person in the article was terminated before I joined, so I don't know what the systems were like back then, but every time I access production systems, I have a ton of messages telling me that our access is being completely tracked and we are prohibited from doing anything that was mentioned in the article. I haven't actually tested to see what I…
> every time I access production systems, I have a ton of messages telling me that our access is being completely tracked and we are prohibited from doing anything that was mentioned in the article. I haven't actually tested to see what I can get away with because I'm not in the habit of risking my job and career over curiosities. You do know that this is literally the bare minimum level of user protection that you c…
is this built into the application.. at the ssh layer?
Earlier quoted context omitted.
This. This bit stood out to me (emphasis mine): > Uber says employees don't receive across-the-board access to customer data and there are several controls in place to ensure that employees only access that data for work purposes. The choice of the word "control" in this context I think gives away a little bit here, it's auditor-speak. This word does not always mean to an auditor what it means to you or I. Having a w…
keeping an audit log should never satisfy an auditor. The keeping of a log is not a control, reviewing the log to detect inappropriate activity and acting upon it, thats the control.
This seems like a good place to tell Uber users that the only way of removing your credit card details from your Uber account is to either: a) plead with Uber's customer service to do so or b) add another payment method (like another credit card) This, of course, is horribly bad practice. I can only imagine that they arrived at this very peculiar arrangement after extensive A/B testing - Uber has hired plenty of FB f…
When you lose your credit card and you call your credit card company and them them that you lost it, they issue you a new card with new numbers; this way anybody that had the information on the card would not be able to make further transactions. I would consider the card lost when a company would not delete the credit card information on my request to delete the information.
Currently have two Amex cards with different numbers that show up as 1 card on their online portal & get treated as one.
Earlier quoted context omitted.
Relying on Uber for your livelihood is really dumb. It's a part-time hobby job. (I drive for Uber part-time).
Someone should tell the folks at Uber that, somehow it's left out of the billboards they put up in poor neighborhoods. Instead they tell potential drivers that they'll take home a middle-class income.
Earlier quoted context omitted.
I'm with you on this. I don't get why Apple can't mandate a "Only when in app" option. The description for why they require it says they use the location while in app or for a few minutes after the trip is over. When I was getting ready to leave for work today, I got out of the shower and grabbed my phone and saw a alert saying Uber has been using my location in the background. I hadn't opened the app since last week…
That popup is standard for any app that is approved to potentially use location in background and you don't use often. I think it's meant to discourage apps to ask location in background altogether
I think the pop-up is telling me it was using my GPS, especially since the GPS icon on the Settings page where you can retract the permissions was lit up to indicate "Recently used".
I don't want to jump to conspiracy theories but the experience scared me a bit because it was around the exact same time of day I had grabbed an Uber to go to work the last time I had used it.
Perhaps it was an errant random notification meant to scare me, perhaps it was a late delivered push notification opening Uber in the background, perhaps it was Uber seeing if I was home and wanted to commute to work again.
A few days ago (on the discussion of the Uber app tracking users' movements after the end of their ride) an Uber employee commented on their data handling: [0] > Individual users' data is very closely guarded internally. It's immensely difficult to look at user data without specific access. Overwhelmingly, this data is queried in aggregate and fed into machine learning systems. The risk of abuse is exceptionally low.…
Earlier quoted context omitted.
No, I'm not naive, and I, proudly, stand behind everything I wrote. The person in the article was terminated before I joined, so I don't know what the systems were like back then, but every time I access production systems, I have a ton of messages telling me that our access is being completely tracked and we are prohibited from doing anything that was mentioned in the article. I haven't actually tested to see what I…
Uber employee here too. Would never ever check any data of anyone not related to debugging crashes, race conditions, unexpected app behavior etc etc, its just not worth losing my job. Despite the bad press it is actually a pretty freaking great place to work. Also wanna +1 the warnings about data access and only looking at PII for legitimate purposes are all over the place.
Giving people a ton of warnings about the dire consequences of accessing data they're not supposed to is really easy. Preventing them from actually doing it is substantially harder.