Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

31–40 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#31

Post by Spooky23 »

musage wrote: post #25
joshuamorton wrote: post #6

Earlier quoted context omitted.

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

What do you do when you pay with 20$ for something, but get change for 10$? Why are "argue with them", "accept the loss and move on", "karate chop" and infinite other things not among the options? > You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver. How did taxi drivers handle that for the last nearing 100 years? People before us m…

Taxi drivers didn’t have a intermediary in the sky taking its vig.

Re: Former employees say Lyft staffers spied on passengers

#32

Post by ghaff »

musage wrote: post #25
joshuamorton wrote: post #6

Earlier quoted context omitted.

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

What do you do when you pay with 20$ for something, but get change for 10$? Why are "argue with them", "accept the loss and move on", "karate chop" and infinite other things not among the options? > You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver. How did taxi drivers handle that for the last nearing 100 years? People before us m…

Because otherwise people, on forums such as this one, will argue (loudly) that the information is clearly available in $ABC's systems and refuses to act on it. And I'm not sure those people are wrong.

Re: Former employees say Lyft staffers spied on passengers

#33

Post by spiznnx »

mpolichette wrote: post #5

When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also sh…

It should be easy to audit and enforce. Just have to scare people a bit into respecting the system.

Re: Former employees say Lyft staffers spied on passengers

#34

Post by dragonwriter »

musage wrote: post #25
joshuamorton wrote: post #6

Earlier quoted context omitted.

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

What do you do when you pay with 20$ for something, but get change for 10$? Why are "argue with them", "accept the loss and move on", "karate chop" and infinite other things not among the options? > You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver. How did taxi drivers handle that for the last nearing 100 years? People before us m…

> What do you do when you pay with 20$ for something, but get change for 10$? Why are "argue with them", "accept the loss and move on", "karate chop" and infinite other things not among the options?

Well, some of them are illegal for the aggrieved party to employ, and in any case not providing better options than that list, for a party facilitating and profiting from the transaction, who is thus not an uninvolved third party, will greatly increase the risk of legal liability and PR damage.

Re: Former employees say Lyft staffers spied on passengers

#35

Post by Consultant32452 »

musage wrote: post #25
joshuamorton wrote: post #6

Earlier quoted context omitted.

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

What do you do when you pay with 20$ for something, but get change for 10$? Why are "argue with them", "accept the loss and move on", "karate chop" and infinite other things not among the options? > You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver. How did taxi drivers handle that for the last nearing 100 years? People before us m…

Well, back in the old days if we wanted to complain we'd write it down on a piece of paper, wrap that piece of paper inside another piece of paper, and then put that in an unlocked box out in our yard.

That's similarly how we'd order products, out of magazines. Only in that case on the paper we'd include things like our bank account information that we'd put in the unlocked box in our yard.

I'm not suggesting that things can't or shouldn't be better. I think it's just important to have a realistic perspective on where we are in this continuum of service vs privacy.

Re: Former employees say Lyft staffers spied on passengers

#36

Post by jtmcmc »

mattmanser wrote: post #10

Lyft tells TechCrunch that staffers in several departments that might need access to this data for their job have the ability to look up this information See, that's a complete lie and that's the attitude that needs to sop. No-one needed access. Analytics definitely didn't. Engineers never did. Customer services should have to request permission from the customer before accessing sensitive data, with a valid reason.…

What's the need for anything? Your argument seems to be predicated on a very specific definition of what need is which is somewhat at odds with most of the rest of the world.

Re: Former employees say Lyft staffers spied on passengers

#38

Post by eponeponepon »

joshuamorton wrote: post #6
cronjobma wrote: post #4

Whether it’s Uber or the NSA stories of staff spying on people for a variety of reasons... it always comes down to people who seem to have access to things that they probably shouldnt have gotten access to in the first place. Users should be protected by having their data encrypted and anonymized so no other human being (staffers, governments or hackers) can connect an ID to the data. This way they can still access t…

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

> if my driver just drops me off at a different place than where I asked...

"Hey, this isn't the right place. Take me where you said you would please."

> ...or doesn't pick me up.

"Hey gran, I'm going to be late for lunch, the darn taxi driver hasn't turned up. I'm calling another firm - guess I'll see you when I get there."

> otherwise how can they charge me if I ruin their car

They will prevent you from departing, and demand cash. If you refuse, they'll either call in law enforcement, or in some places, call in several of their colleagues. In either case, they get their money one way or another.

Look, I'm deliberately being a little flippant here, but none of the problems you outline are in any way unsolved. I'm struggling to think of any situation where any of this data needs to be recorded, never mind viewed later.

Human interaction has dealt with all these obstacles for millennia, and new ways of mediating it don't turn them into new obstacles.

Re: Former employees say Lyft staffers spied on passengers

#39

Post by mithr »

jonknee wrote: post #8

What circumstance would be needed to have a view where an employee can find riders by name and look at their whole history? If there is a complaint it should allow the customer service agent to see the ride and perhaps some history (ratings make sense, but including full locations/times seems unwise), but I can't think of a reason why this would ever need to be a process started by a Lyft agent and not the customer o…

This kind of system usually comes into place because an organization combines a number of different pieces of software to make a cohesive whole, rather than designing a single all-in-one solution with perfect foresight.

While the customer can open a support ticket in the ticketing system, that system is probably not directly connected to the service that allows support agents to view ride data. This may be because either of these systems weren't (or at least weren't initially) built in-house, or just because this kind of thing is harder to implement and wasn't a design priority back in the day.

So a support agent sees a customer issue, and then goes looking for relevant data in another system. If the issue ends up being a bug, and that bug seems to depends on customer data, engineering might need to look at it in order to reproduce and resolve it. It's great if the support person or engineer can look only at the very narrow slice of data they actually need to address the problem they're working on, but often that's not possible (for example, the system could be set up to tightly control ride history access, but once you've been granted that privilege, you can access the _entire_ ride history for that customer.)

The company ends up creating policies for data safety, and teams to enforce those policies, but there's always a balance between being able to quickly triage and address a problem (be it a customer reporting that they feel unsafe and need help quickly, a hard to find bug that only seems to happen for people with last names having certain accented characters, or a customer complaining that certain parts of their ride history have mixed-up addresses) and having to go through established channels to justify your need for access. And it's hard to perfect this process.

I'm not claiming any of this is ideal, and all in all it sounds like some of Lyft's policies were too lax or too loosely enforced. But I definitely understand _how_/_why_ it could happen.

Post reply on HN