Why would beyonce take an uber tho?
I had same question. Thought these people had person drivers.
Uber employees used the platform to stalk celebrities and their exes
221–230 of 250 posts
Re: Uber employees used the platform to stalk celebrities and their exes
#222Earlier quoted context omitted.
>every time I access production systems, I have a ton of messages telling me that our access is being completely tracked and we are prohibited from doing anything that was mentioned in the article. That's nice, but it shouldn't be forbidden to violate users' privacy, it should be impossible .
I mean... it should be, but every business I've ever worked at has had difficulty cleaving between "the kind of access that developers need in order to do their jobs" and "the kind of access that would be abusable." It's legitimately difficult to do, and there's no way to make your system proof against insider abuse without serious trade-offs. The purported "God-mode" that Uber had years ago, and showed off at partie…
> It's legitimately difficult to do, and there's no way to make your system proof against insider abuse without serious trade-offs.
I know homomorphic encryption is very new, but deploying it for privacy applications like these is a Good Idea.
Re: Uber employees used the platform to stalk celebrities and their exes
#223Everything I hear about this company is sickening. Bros with toys and no morals.
[deleted]
Re: Uber employees used the platform to stalk celebrities and their exes
#224I seriously don't understand why the updated Uber app asks to access my location all the time -- as opposed to only when I'm using the app. Not only is it not required but it's a huge drain on the phone's battery, potentially decreasing the battery's life. Now I'm from a third-world country and can't afford to buy a $1000 phone every year, so I have to be careful with the life of my phone. The turnaround this, I foun…
Background location tracking has been at a point where we can get pretty accurate without draining your battery for about a year now.
Re: Uber employees used the platform to stalk celebrities and their exes
#225Earlier quoted context omitted.
The NSA using the power of the state to persuade a telco to intercept some stuff for them is somewhat different from having random employees of a private company just deciding to arbitrarily browse through their corporate databases.
True. The State has a lot more power on its side, making the former scenario much more of a threat.
Except the NSA is an arm of a democratically elected government. Tell me when the public Uber elections start.
Re: Uber employees used the platform to stalk celebrities and their exes
#226The internet can really blow things out of proportion.
1980's: long distance company has employee(s) poking around messaging system and sells to newspaper. Few know. All voice over network is stored "searched" for "key" phrases. Very few know. Moreover there are no blogs or places to tell ones story.
Now one little confessional outing becomes widespread and thus assumed to be happening all the time.
I am sure (without facts) that uber is no worse than AT&T back in the day but now so so so many people can read and tell their stories.
Does anyone really think or expect communication via electricity is truly protected?
Re: Uber employees used the platform to stalk celebrities and their exes
#227Can't wait for a class-action lawsuit. This is precisely why it makes sense to keep database data encrypted even to admins and why it makes sense for ride-sharing companies to be co-operatives or non-profits. Profit-seeking companies engage in bad behaviours all the time.
> Can't wait for a class-action lawsuit.
Except Uber now has arbitration clauses in both it's driver and passenger service agreements. It remains to be seen how well it will hold up in court [1], but I wouldn't count my chickens yet.
[1] https://consumerist.com/2016/08/02/judge-shreds-uber-says-co...
Re: Uber employees used the platform to stalk celebrities and their exes
#228Earlier quoted context omitted.
If you already have a card with a real name, getting another one as an authorized user with a fake name is really easy.
If I'm not mistaken that's fraud and could get you into serious trouble.
Why is it fraud? The primary account holder still has full responsibility for paying the bills.
Re: Uber employees used the platform to stalk celebrities and their exes
#229Earlier quoted context omitted.
keeping an audit log should never satisfy an auditor. The keeping of a log is not a control, reviewing the log to detect inappropriate activity and acting upon it, thats the control.
Most auditors just want to check a box on a sheet, I've never been apart of an audit that was worth anything.
Careful with that brush, Eugene. As someone who has done (extensive) audit, I respectfully submit that the problem is not the audit process but the auditors you hire.
The usual process for such a control should be:
* Is there a requirement for a log?
* Does that log exist?
* Can the system(s) that write to the log be prevented from doing so/tampered with? (branch here to system security review)
* How are the contents of that log secured against tampering? (branch here to security review of logs)
* Who is responsible for reviewing it?
* Where is the evidence that such reviews occurred?
* What violations of policy were found during those reviews? (branch here to a review of the follow-up process)
* Can I, the auditor, find violations that were not found during the reviews? (if yes, branch here to figuring out why not)
This is not an especially complex script to follow, and winning at that last step is the kind of thing that gets you nice fat bonuses and happy bosses, because suddenly the auditee needs remediation consulting services. Especially as the cost of "taking a complete sample" (i.e. reviewing every entry in the log) goes down to nearly zero, this kind of review gets easier and easier (and is often automated by the company being audited, which just shifts the focus slightly... with no change to the last step).
Re: Uber employees used the platform to stalk celebrities and their exes
#230Earlier quoted context omitted.
I mean... it should be, but every business I've ever worked at has had difficulty cleaving between "the kind of access that developers need in order to do their jobs" and "the kind of access that would be abusable." It's legitimately difficult to do, and there's no way to make your system proof against insider abuse without serious trade-offs. The purported "God-mode" that Uber had years ago, and showed off at partie…
> It's legitimately difficult to do, and there's no way to make your system proof against insider abuse without serious trade-offs. I know homomorphic encryption is very new, but deploying it for privacy applications like these is a Good Idea.
While I admit that I have literally zero experience with homomorphic encryption, I suspect that even after whatever deployment costs there would be, the burden on your ability to do things like investigate bugs, much less repair data if needed, would be non-trivial.