FTC says Uber took a wrong turn with misleading privacy, security promises

Post by jacquesm » Tue, Aug 15, 2017, 9:10 PM UTC

joering2 wrote: post #4

tareqak wrote: post #2

From the article: For a particular six-month period, Uber only monitored access to the account information of a select group. Who? Certain high-profile users, including Uber executives. What was the upshot? In May 2014, an intruder used an access key an Uber engineer had publicly posted on a code-sharing site to access the names and driver’s license numbers of 100,000 Uber drivers, as well as some bank account inform…

Mindboggling huh? Imagine how deep the hands go or who is on Uber side that the result of FTC settlement is statement tht forbids Uber from... breaking the law. Amazing! Me and you would be heading to jail for the claims they did. Not uber. It also somehow reminds me of 911 commision. It eventually got so sidetracked that the result of the findings were that pretty much two planes hit towers and then they collapsed.…

Post by mahyarm » Tue, Aug 15, 2017, 9:44 PM UTC

chickenfries wrote: post #13

5706906c06c wrote: post #10

Earlier quoted context omitted.

I've done InfoSec for a bunch of startups, none seem to grasp the importance of security by design and how it can play an integral role in the business. It's exhausting to have to battle a neon-haired developer that wants to just write code (rightfully so,) not following a process or standards often engaging in arguments just to be right. Imagine one person going asking an entire engineering org to create security pr…

edit: ah, nevermind, just a reference that went over my head

Post by [deleted] » Tue, Aug 15, 2017, 10:01 PM UTC

hkothari wrote: post #9

The craziest part to me: "As a result of the failures described in Paragraph 18, on or about May 12, 2014, an intruder was able to access consumers’ personal information in plain text in Respondent’s Amazon S3 Datastore using an access key that one of Respondent’s engineers had publicly posted to GitHub, a code-sharing website used by software developers. The publicly posted key granted full administrative privileges…

Post by api » Tue, Aug 15, 2017, 10:54 PM UTC

jacquesm wrote: post #11

johnmarcus wrote: post #7

This isn't an uber problem - it's a startup tech problem - no one wants to take security seriously because it's a cost sink that only averts risk, does not actually make a company revenue. I have seen ssn's store insecurely, open api's with customer data, old frameworks and languages that no longer receive security patches. Nearly every startup says they take security seriously, because that's the right answer to say…

People right here on HN advocate against start-ups taking security seriously because it slows them down. Really bugs me.

Post by dsfyu404ed » Wed, Aug 16, 2017, 12:25 AM UTC

5706906c06c wrote: post #10

johnmarcus wrote: post #7

This isn't an uber problem - it's a startup tech problem - no one wants to take security seriously because it's a cost sink that only averts risk, does not actually make a company revenue. I have seen ssn's store insecurely, open api's with customer data, old frameworks and languages that no longer receive security patches. Nearly every startup says they take security seriously, because that's the right answer to say…

I've done InfoSec for a bunch of startups, none seem to grasp the importance of security by design and how it can play an integral role in the business. It's exhausting to have to battle a neon-haired developer that wants to just write code (rightfully so,) not following a process or standards often engaging in arguments just to be right. Imagine one person going asking an entire engineering org to create security pr…