Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

51–60 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#51

Post by walshemj »

x0x0 wrote: post #46
mpolichette wrote: post #5

When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also sh…

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. I couldn't disagree more. Eventually, you're going to hire an idiot (and/or budding rapist). When you have PII of this nature, if you're going to allow lots of people access, you need individual access controls, logging, and most importantly, auditing of the aforementioned data. And auditing may not be enough; you pr…

I remember a briefing when I worked for BT in the UK some one looked up for a mate his exes new address - who then got murdered.

There was also the case involving hit men who found the address of a targets mom and dad who where also killed by bribing some one.

BT took security v seriously and you had better hope if you did something bad that the cops or the even the secret service (MI5) got to you before the internal security team did.

Re: Former employees say Lyft staffers spied on passengers

#52

Post by 303space »

lhorie wrote: post #2

Someone I know was just commenting that from convos w/ people in other companies, it seems many startups have benefitted from not being under the limelight, and thus had the chance to quietly clean up their own messes while Uber was taking all the heat from the media.

Does anyone else find this whole thing more than a bit hypocritical?

Lyft is always telling you they are the better/ethical/woke ridesharing option - now their employees are reporting a culture of abusing customer privacy. I wish they had taken a look at their own practices before running million dollar ad campaigns full of celebrities celebrating their ‘wokeness’.

Re: Former employees say Lyft staffers spied on passengers

#53

Post by zephyrus1985 »

mattdodge wrote: post #27
ageitgey wrote: post #24

Earlier quoted context omitted.

> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers." I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?

Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.

various state by state. The above does qualify as PII in california

Re: Former employees say Lyft staffers spied on passengers

#54

Post by pookeh »

milofeynman wrote: post #47
mpolichette wrote: post #5

When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also sh…

In hospitals in the U.S. the way it works in some is nurses can view a lot of the patients charts (including VIP). And then someone is supposed to audit who viewed those VIP patients (celebrity or what not) but every hospital is different and it's a mess.

Here in Canada if you have access to the central medical records you can look up anyone but (a) if you are not a doc and are not assigned to the case or (b) you are looking up yourself or a family member, you immediately get a call and get fired on the spot.

(Source: Wife works at the hospital and has seen some people get fired shortly after unauhorized access.)

Re: Former employees say Lyft staffers spied on passengers

#55

Post by gamblor956 »

milofeynman wrote: post #47
mpolichette wrote: post #5

When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also sh…

In hospitals in the U.S. the way it works in some is nurses can view a lot of the patients charts (including VIP). And then someone is supposed to audit who viewed those VIP patients (celebrity or what not) but every hospital is different and it's a mess.

This system broke down at UCLA a few years ago. They ended up paying out quite a bit of money when it was revealed that hospital staff had viewed the medical records of celebrity patients.

Re: Former employees say Lyft staffers spied on passengers

#56

Post by nkkollaw »

I was talking about this with my girlfriend at dinner tonight.

While we were eating, I noticed a few cameras that got a view of the whole restaurant, and wondered: of course filming the restaurant might be useful in case of a robbery (?) or for insurance, etc., but what are the chances the minimum-wage employees that checks those DON'T use it to check out hot women or embarassing stuff that happens from time to time..?

With us being tracked with data and video all the time nowadays we are safer--or the companies that have the footage are safer--but of course there is a lot of room for abuse and improper usage.

Re: Former employees say Lyft staffers spied on passengers

#57

Post by jancsika »

joshuamorton wrote: post #6
cronjobma wrote: post #4

Whether it’s Uber or the NSA stories of staff spying on people for a variety of reasons... it always comes down to people who seem to have access to things that they probably shouldnt have gotten access to in the first place. Users should be protected by having their data encrypted and anonymized so no other human being (staffers, governments or hackers) can connect an ID to the data. This way they can still access t…

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

> At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up.

You're seriously arguing that cryptography has no technical means for a driver to send an unrepudiatable attestation of intent to drive from A to B at time C to an anonymous passenger? And that an ombudsman armed with driver GPS data cannot compare the attestation to the GPS data and instead needs identification data on the passenger in order to verify whether the driver went to the correct drop-off?

> You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car.

By using one of the growing number of datasets to figure out the person's identity after the fact. E.g., same thing you do if you get in a fender-bender or get cut off by a cyclist.

You can even have a multi-hour buffer for an in-vehicle cam which you consult if somebody ruins your car. But the likelihood of someone ruining the driver's car without the driver noticing is so unlikely that there is just no way it justifies collecting and keeping a company-wide database of identity data on every single passenger.

> You need to know they were my driver.

Who is arguing for driver data to be anonymous? I think nobody.

Same for GNU Taler, where the merchant data isn't private but the customer data can be.

In fact, same for E-cash from the 90s. Look up blinded tokens, they are quite fascinating from a technical perspective.

Re: Former employees say Lyft staffers spied on passengers

#58

Post by ddinh »

pookeh wrote: post #54
milofeynman wrote: post #47

Earlier quoted context omitted.

In hospitals in the U.S. the way it works in some is nurses can view a lot of the patients charts (including VIP). And then someone is supposed to audit who viewed those VIP patients (celebrity or what not) but every hospital is different and it's a mess.

Here in Canada if you have access to the central medical records you can look up anyone but (a) if you are not a doc and are not assigned to the case or (b) you are looking up yourself or a family member, you immediately get a call and get fired on the spot. (Source: Wife works at the hospital and has seen some people get fired shortly after unauhorized access.)

Just curious - why is looking up yourself an offense?

Re: Former employees say Lyft staffers spied on passengers

#59

Post by jamestimmins »

mpolichette wrote: post #5

When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also sh…

This was how it worked when I worked in admissions during college. You had access to every applicants' information, grades, essays, etc., as well as counselor feedback. But you were told that if you looked up yourself, someone you knew, or any celebrities, then you could be fired.

I don't know if there were automated checks for that kind of thing, but everyone knew there was a line you didn't cross.

Re: Former employees say Lyft staffers spied on passengers

#60

Post by duxup »

nkkollaw wrote: post #56

I was talking about this with my girlfriend at dinner tonight. While we were eating, I noticed a few cameras that got a view of the whole restaurant, and wondered: of course filming the restaurant might be useful in case of a robbery (?) or for insurance, etc., but what are the chances the minimum-wage employees that checks those DON'T use it to check out hot women or embarassing stuff that happens from time to time.…

"the minimum-wage employees that checks those"

Does anyone even look at them? I just assume most video gets recorded and then recorded over or somehow discarded.

Outside of situations like say an airport or casino I doubt anyone is actively watching most of the cameras unless something happens after the fact.

Post reply on HN