Uber Paid Hackers to Delete Stolen Data on 57M People • Hacker News Board

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#121

Post by 21 » Tue, Nov 21, 2017, 11:26 PM UTC

giobox wrote: post #98

21 wrote: post #78

Earlier quoted context omitted.

2fa is just another hurdle. Good to have, but by no means a silver bullet. Just one of the many ways to bypass it in this case: hack a developer machine and look at the local checkout.

I really don't think using 2FA and the direct hacking of an individual developer's machine are all that comparable here. Who cares about access to individual dev's machines if the credentials to access code on github are obtained - 2FA at least offers some degree of protection in this scenario. The scope for attack is extremely different.

The hackers wanted access to the code to look for Amazon keys. For them it doesn't matter if they get the code from the internal GitHub or from a developer machine.

If you have an ultra-secure door, the thiefs will just enter through your regular window.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#122

Post by _m8fo » Tue, Nov 21, 2017, 11:27 PM UTC

Xylakant wrote: post #112

_m8fo wrote: post #103

Earlier quoted context omitted.

> We probably all hate forced child labor A false premise. If that were true, just like you stated, we wouldn't support it. Actions speak louder than words, and all that. EDIT: I realize I sound far more judge-y than intended in these posts. My overall point is that people should just do whatever makes 'em happy while doing the best you can (w.r.t. everything else). Trying to emphasize the morality in your actions is…

It’s not a false premise. It’s just not humanly possible to change everything you don’t support. We can’t move all back to self-dug caves and till the land with our bare hands. You need to pick your battles.

It's not about changing things you support, it's just about consistency in your actions.

Taking the child labor thing into account, never being brand new electronics again would pretty much take care of that. One could make an argument that buying used goods is still supporting child labor, but I'd argue it's a sunk cost.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#123

Post by zitterbewegung » Tue, Nov 21, 2017, 11:30 PM UTC

jtchang wrote: post #10

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k really really hurts for a company like Uber.

The bad PR might hurt more but I would error on the side of caution and say it has little effect. I have talked to drivers and passengers and they are unaware of those things .

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#124

Post by mtgx » Tue, Nov 21, 2017, 11:31 PM UTC

untog wrote: post #40

jtchang wrote: post #10

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k really really hurts for a company like Uber.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…

And the fine should always be bigger than whatever the company pocketed from the "crime" during that time.

I think it was AT&T or Verizon that got fined the "record" $3 million by the FTC for tracking users' browsing behaviors for like 2 or 3 years.

The FTC should have asked (subpoena I should say) the company for reports on how much money it made per user from that tracking for the whole period, and then charge it a multiples of that.

Did it make $1 billion? Charge it $2 or $3 billion.

And do this sort of stuff across industries with a regular occurrence, so that companies can "expect" such audits, and so they don't just think it's a one in a decade fine that maybe one company in the industry will get.

I think you'll see abusive behavior drastically reduce.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#125

Post by halflings » Tue, Nov 21, 2017, 11:32 PM UTC

They stored AWS storage credentials in clear, in a (private) Github repo...

This is so baffling coming from one of the largest tech companies in the world.

Among other things, this shows that they do not have proper access policies to user data (e.g anybody working at Uber can get access to any user's data), which in my opinion is a larger issue than this individual hacking case.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#126

Post by munk-a » Tue, Nov 21, 2017, 11:32 PM UTC

watwut wrote: post #63

Swizec wrote: post #49

Earlier quoted context omitted.

> The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willing to pay. The real question in this story is this: If you find that you have customers who are willing to pay you more for providing more service ... why not provide that service? You get more money, your staff gets paid overtime, parents get peace of mind, everyone's happy.

Because those more money may not be enough to pay for more people that would need to be hired? While existing stuff may be wiling to stay 30 minutes more occasionally, they might not like the idea of having even longer shifts all the time.

You can scale the price to find a point where it's economical to offer to stay open while maintaining good relations and if the demand is consistent and heavy then scale that price appropriately or, alternatively, simply refuse to service repeat offenders if it's becoming a serious headache.

It's a bit of a hard question because the daycare may not have a legal way to stop holding the child, unlike fedex they can't simply return it to sender, so these sorts of contingencies might not be expected on opening your center, but you'll need to scale into them.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#127

Post by trosi » Tue, Nov 21, 2017, 11:32 PM UTC

Rotten194 wrote: post #25

sehugg wrote: post #12

At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, the company paid hackers $100,000 to delete the data and keep the breach quiet.

Only $100k? They really should have tried for more... not that I support stealing PII.

They agreed to pay and nobody heard about it for a long time. I'd say they asked for the right amount

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#128

Post by ringaroundthetx » Tue, Nov 21, 2017, 11:33 PM UTC

panarky wrote: post #70

gr3yh47 wrote: post #46

Earlier quoted context omitted.

>Just pay the toll especially when the cost of doing the right thing is higher. i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor

And they say we need less regulation of corporate behavior.

Well look at this case as an individual circumstance:

The US federal government decided 30 years ago that it was going to attempt to prevent some kinds of transactions from being part of the global economic growth. Kinds of transactions that were always here, and always willing to be part of the global economic growth.

It decided to use other people's money to attempt to enforce this blockade, at great expense, for perpetuity.

It does this by creating onerous reporting requirements for companies and individuals worldwide, and onerous and expensive procedures for the individuals that fail to merely file the correct paperwork.

All the while, massive multinational banks have been letting the well funded organizations continue moving their money through them and contributing to the global economic growth, while citizens are being fined and imprisoned for paperwork problems.

And your go-to thought was a satire on anyone suggesting less regulation, implying the same or more regulation would be a BETTER use of public resources?

World economic growth has always been fueled by money whose source you don't agree with. Using everyone's money in a government to merely PRETEND like it can prevent illicit sourced money from being used seems irresponsible and unconscionable, looking at the track record.

Is it really so uncomfortable to admit that multinational "cartels" (organizations of people under a common charter) are pretty good at fueling economic growth globally? Because thats how its always been

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#129

Post by _m8fo » Tue, Nov 21, 2017, 11:33 PM UTC

SolaceQuantum wrote: post #108

_m8fo wrote: post #77

Earlier quoted context omitted.

The point is that if you know that the US kills civilians yet you stay in the US, giving them money through tax, the majority of which is used to fund the very same military that kills civilians, yet claim to do the right thing, that's hypocritical, no? In any case, you're right. There is no conflict. Just hypocrisy. EDIT: I realize I sound far more judge-y than intended in these posts. My overall point is that peopl…

So one should absolve themselves of any way they could stop it in a peaceful and legal manner?

No no. My point probably just wasn't properly conveyed. In the original post I replied to the person the person encouraged their friends to use Lyft after hearing about the terrible things over at Uber.

Presumably they want friends to switch over as to not support an organization they disagree with, but my point was that doing so is pretty much impossible to begin with. If the goal is to not support organizations that do things you disagree with it's futile.

Therefore, one should just decide arbitrarily. It really doesn't matter.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#130

Post by the_cat_kittles » Tue, Nov 21, 2017, 11:35 PM UTC

halflings wrote: post #125

They stored AWS storage credentials in clear, in a (private) Github repo... This is so baffling coming from one of the largest tech companies in the world. Among other things, this shows that they do not have proper access policies to user data (e.g anybody working at Uber can get access to any user's data), which in my opinion is a larger issue than this individual hacking case.

as the size of the company grows past a certain size, especially these "move fast and break things" idiots, i feel like the likelihood of this goes up. there are more and more people, someone is bound to do something stupid.