Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

nytimes.com

Post reply on HN
Print view View original

331–340 of 805 posts

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#331

Post by Trombone12 »

frogpelt wrote: post #256
us0r wrote: post #182

Earlier quoted context omitted.

Maybe not a popular opinion but I find this entire thing pure genius. >I couldn't find a good source, but it doesn't seem like that's something a CC merchant would have access to. Do they really get to see that? The first 6 digits of a credit card can identify the issuing bank (BIN number - https://en.wikipedia.org/wiki/Payment_card_number ). If you ask your merchant they can readily provide you and up to date list.…

I agree. The article seems to point to Greyball as proof that Uber is being shady. Greyball is just the tool they used to keep from getting caught. The shady part is that they operate in cities were they aren't welcome (by city officials at least, customers and drivers seemed to welcome them with open arms). If Uber operating in Portland is a night burglar, Greyball is his dark clothes and mask.

I think developing infrastructure with the express goal of evading law enforcement* _is_ very shady, and then proof that they did just that is indeed proof that Uber is shady. I agree that there are other reasons beyond their dedicated law-avoidance infrastructure to consider Uber a shady company, but this leak alone is certainly enough _proof_ to label them as shady.

* even if it is simply by adapting pre existing infrastructure created for a benign purpose

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#332

Post by sgift »

mindcrime wrote: post #328
sgift wrote: post #241

Earlier quoted context omitted.

> The 'say' you have in government is much smaller than the 'say' you have in using Uber. I can choose not to use Uber any time I please. I can not choose not to be pulled over for speeding, or opt out of murder laws temporarily. Sure you can. Just leave their jurisdiction. I've heard Somalia is nice.

Just leave their jurisdiction. Their "jurisdiction" is invalid, so why should we leave?

It's invalid because you don't like it? I don't like many things, doesn't make them go away.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#333

Post by mindcrime »

briandear wrote: post #195
nemacol wrote: post #100

Earlier quoted context omitted.

You can vote, run for office, petition, volunteer, protest,etc to the local, state, and federal government to have policies that reflect your values. The only thing you can do with Uber is use it or not. Maybe you could write Uber a letter. You have a say in government - that is its stated goal and purpose. Of the people for the people.

Why would you need write Uber a letter? Don't like it, don't use it. You don't have a say in government like you do with a private company. If I don't like the government, I have to hope that millions of other people agree with me. If I don't like a company, I alone can choose not to associate with it. My relationship with or without Uber is entirely up to me. I'm forced to endure the government whether I like it or…

Also, corporations - as a rule - don't have huge armies made up of many people with guns, tanks, jet fighters, nuclear bombs, etc., which they can use to impose their will on you.

It's a lot easier to divest yourself of a bad relationship with a company, than a nation-state.

(And no, "move" isn't a reasonable response to this, so don't waste your digital breath with any Somalia references).

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#334

Post by alphabettsy »

csense wrote: post #206

Even if the law says that Uber must admit taxi inspectors, it's hard to say Uber's breaking the law if the inspectors don't "show their badge" or otherwise identify themselves as officials. Of course if they do show their badge, there's a great incentive for Uber to say "Sorry, no drivers are available in your area" even if this is not really true. So you have this curious cat-and-mouse game where the taxi inspector…

That would make sense if they didn't go out of there way to identify potential investigators and law enforcement. I don't see how they could create a system to target law enforcement and then say they didn't know they were.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#335

Post by nemacol »

mindcrime wrote: post #322
nemacol wrote: post #100

Earlier quoted context omitted.

You can vote, run for office, petition, volunteer, protest,etc to the local, state, and federal government to have policies that reflect your values. The only thing you can do with Uber is use it or not. Maybe you could write Uber a letter. You have a say in government - that is its stated goal and purpose. Of the people for the people.

You have a say in government - that is its stated goal and purpose. On paper. In practice... well, that's a whole different story. See: gerrymandering, voter fraud, ballot access restrictions, voter id laws, etc. Of the people for the people Even if that were ever actually the case, I think those days are long gone.

It is frustrating, I agree. But those days can be had again if we get people to pay attention, focus on facts, and become engaged in the process.

The reason gerrymandering, (I will not include voter fraud), access restrictions, etc etc is still a problem inspite of being identified as a problem is the collective will of the people to demand that these wrongs be correct.

Imagine what the 2016 campaign and election would look like if everyone cared enough to learn and vote. Imagine what your town or state would look like if we could get 80% voting rates... [eyes twinkle as I stare off into the distance thinking of what could be]

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#336

Post by patrickmay »

bmelton wrote: post #277
throwaway729 wrote: post #64

Earlier quoted context omitted.

In a world where multinationals have the power to evade the law in a deliberate and systematic way, AND the government uses the same techniques to spy on its own people for its own motives, it's easy for individuals to claim that neither group of entities need this kind of coercive power over others. Or at least, it should be.

I agree with your statements at large, but considering Uber was not aware of any active investigations, they're under no obligation to assist police in enacting a sting. I'm not suggesting that it is, as there are semantically many problems with it, but an argument could be made that this is more of an extension of one's fifth amendment rights to remain silent than it is evading the law. Starting a company to drive p…

> an argument could be made that this is more of an extension of one's fifth amendment rights to remain silent than it is evading the law

Not to mention freedom of association.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#337

Post by joe_the_user »

frogpelt wrote: post #256
us0r wrote: post #182

Earlier quoted context omitted.

Maybe not a popular opinion but I find this entire thing pure genius. >I couldn't find a good source, but it doesn't seem like that's something a CC merchant would have access to. Do they really get to see that? The first 6 digits of a credit card can identify the issuing bank (BIN number - https://en.wikipedia.org/wiki/Payment_card_number ). If you ask your merchant they can readily provide you and up to date list.…

I agree. The article seems to point to Greyball as proof that Uber is being shady. Greyball is just the tool they used to keep from getting caught. The shady part is that they operate in cities were they aren't welcome (by city officials at least, customers and drivers seemed to welcome them with open arms). If Uber operating in Portland is a night burglar, Greyball is his dark clothes and mask.

Evading the government ability to regulator you through deception is illegal - generally more illegal than whatever it is you're covering up.

Government have to work that way. If lying to and evading regulation wasn't illegal, no regulation at all would be possible.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#338

Post by SilasX »

jfoutz wrote: post #263
us0r wrote: post #182

Earlier quoted context omitted.

Maybe not a popular opinion but I find this entire thing pure genius. >I couldn't find a good source, but it doesn't seem like that's something a CC merchant would have access to. Do they really get to see that? The first 6 digits of a credit card can identify the issuing bank (BIN number - https://en.wikipedia.org/wiki/Payment_card_number ). If you ask your merchant they can readily provide you and up to date list.…

I agree. It's genius in a Lex Luthor kind of way. If I understood the full scope of the application, I like to think i'd decline to work on that. It's easy to imagine engineers working on small parts of the system, and never really connecting the dots that the whole point is to evade law enforcement. There's a big difference between keeping secrets for market advantage and to evade the law. In the first case, I want…

>If I understood the full scope of the application, I like to think i'd decline to work on that. It's easy to imagine engineers working on small parts of the system, and never really connecting the dots that the whole point is to evade law enforcement.

It reminds me of the VW emissions cheating case:

"Hey, have it detect whether the test cycle is running and emit a signal if true."

'Um... why would the system need to know that?'

"Uh, because we don't want the car to freak out when the wheels are turning but it's not moving."

'Oh ... seems legit.'

"And you -- have it minimize NO2 when it gets this signal. But don't talk to him."

In the Uber case, employees might have been told, "oh we want to offer a special discount to law enforcement" ... though even that seems seedy.

But (per my original comment) I don't see how they can keep the circle small. What do they tell support employees to say when someone reports not being able to get a ride despite all the fake cars around?

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#339

Post by mindcrime »

eridius wrote: post #74
lacampbell wrote: post #68

Earlier quoted context omitted.

I don't like the US government much, but I like it a lot better than the average multinational. When it comes down to it, we don't have more than our choice of devils. If I don't like Uber, I can... stop using Uber. What can I do if I don't like the service a state provides - can I opt out and stop paying? No, my only option is to flee - which the state will often try and prevent you doing anyway. The state is a huge…

Did you just make the argument that the government enforcing the laws is immoral?

Did you just make the argument that the government enforcing the laws is immoral?

When most of the laws are immoral, then I would say that it is. And an immoral law is - IMO - any time the State is doing anything other than acting, as Bastiat[1] put it, "as the collective extension to our individual right to self defense".

[1]: http://bastiat.org/en/the_law.html#SECTION_G004

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#340

Post by tzs »

liuhenry wrote: post #218
SilasX wrote: post #168

Earlier quoted context omitted.

Interesting! But don't the CC agreements require them to only use CC numbers for the absolute minimum purposes necessary to process the transaction? (They can't store the numbers themselves except the last four digits IIRC.) So (based on the site) they could presumably use that number as part of fraud prevention but not to "identify possible narcs" -- I imagine the CC companies will be livid at this usage.

CC processing agreements don't normally have any such restriction - the only information that absolutely can't be stored is the CVV/CVC number. If you handle CC information, you are subject to security standards auditing (called PCI compliance - like encryption at rest, etc.), but the BIN number and last 4 digits are not considered privileged information. I'm also not aware of any restrictions on how you want to use…

Another good use for BIN information is justifying tax decisions. A little while back the VAT rules in the EU changed for online merchants. Before, you collected VAT based on your location. After, you collected VAT based on the buyer's location.

Each country implemented a thing called VAT MOSS, and you can register with a country's tax authority to use their VAT MOSS system. You only have to do this in one country. Once a quarter you submit a VAT MOSS form that lists your sales in each EU country and how much VAT you collected. You pay that to the tax authority of the country whose VAT MOSS system you use, and they distribute the appropriate amount to each country.

They don't want it to be trivial for online buyers in high VAT counties to claim they are in some low VAT country, so merchants are not allowed to simply collect the VAT for whatever country the customer picks on the "country" drop down during check out. The merchant is required to have two pieces of non-contradictory evidence to justify their choice of which country's VAT to collect. One can be the country selected by the customer.

What we normally use where I work is the customer's selected country and the country that MaxMind's ip to country database says they are ordering from. If those two agree that's two pieces of non-contradictory evidence and we're done.

That's good enough most of the time but sometimes it fails. In that case I'll lookup the bank that issued their credit card from the BIN. Almost every time that bank turns out to be a bank from the country that the customer claimed to be from, giving two pieces of non-contradictory evidence for that country. Maybe once or twice the bank from the BIN did not match the claimed country but did match the IP country, so I went with that instead.

There have only been a handful of times when that was not good enough, and I had to dive into their past orders, support tickets, and logs of their software contacting our update servers to play detective and try to get enough evidence to justify picking a country.

Post reply on HN