Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

111–120 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#111

Post by btown »

lobo_tuerto wrote: post #109
jstarfish wrote: post #14

Earlier quoted context omitted.

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. Indeed. The FCRA accounts for bored clerks looking up random peoples' credit history. Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason. I'm no fan of regulation but the wild west of PII is long past needing to be tamed. Companies need to be held respons…

"Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason." Then you should not have access to it? People will touch them if they can. That's why Access Control rules exist.

Too much reliance on programmatic access controls causes people to think “if it’s allowed by the controls, it’s allowed by common sense” which is rarely the case.

Re: Former employees say Lyft staffers spied on passengers

#112

Post by benmmurphy »

requiring a second person to verify/supervise access to confidential data solves a lot of this problem (at a cost though). like it doesn't prevent a strong adversary from getting access to data they shouldn't but it prevents normal people from abusing power they have stumbled upon. require two logins + audit and a lot of the abuse goes away. people are less inclined to lose their job because their colleague wants to check up on their girlfriend.

Re: Former employees say Lyft staffers spied on passengers

#113

Post by mynameisvlad »

gersh wrote: post #89
mynameisvlad wrote: post #69

Earlier quoted context omitted.

Can you actually refute the parent comment's argument? Because it seems more than reasonable to me. Analytics and Engineering definitely don't need this level of data access for any sort of day-to-day work. I work on analytics tools, and at best, anonymized and generalized data is needed, but never specific customer data. We specifically strip out any PII on data that might reach developers and need to request permis…

It is probably possible to design systems to avoid access, but they will get more complex. Engineering has to debug bugs. For example, suppose there is bug where the rate calculations aren't working for certain types of routes. The engineers will want to look up those routes to understand what is causing it. If you are designing an algorithm to detect to fraud, you are going to want to look at cases of fraud to under…

For debugging, you generally can access things like server logs, which would already have a lot of the data you might need. It'd be behind a session ID or some other type of anonymizer, but the customer can provide that and other debugging information so you can look up their entry. It might be a bit harder for mobile apps, but there's plenty of telemetry products that provide crash dumps (with many of them supporting the stripping of PII). You definitely don't need always-on access to all customer's data to do this role, or even access to their PII data for the purposes of debugging.

Rate calculations 100% do not need specific data access. All you need to do that job is to have a generalized set of data based on the routes in question. You don't need to see that Joe Smith in SF took a route from A to B and what went wrong with it, you just need to see what all routes/rates from A to B were, and then from there look for anomalies.

Fraud is a bit more tricky, but if you already know what you're looking for, then you don't need the specific customer data set, you just need to know what deviations from the norm a general fraud request had.

Usability testing should be done with completely fake data, preferably created by someone with knowledge on how to do that specific job. This one is by far the easiest one to argue against needing access to real customer data since most places already have this type of fake data created specifically for this purpose.

Overall, none of your examples really need data access. Sure, it'd be nice to have access to it for some of these points, but it'd also be nice to have a million dollars. It doesn't mean you can't do your job if you didn't have it.

Re: Former employees say Lyft staffers spied on passengers

#114

Post by [deleted] »

outworlder wrote: post #106
toomuchtodo wrote: post #7

Earlier quoted context omitted.

I’m at a financial services firm, and we have an entire internal risk department to ensure employees aren’t exceeding their authority. Surfing the wrong websites? Badging in and out at abnormal hours? Accessing internal apps in ways you shouldn’t? Access immediately flagged for human intervention and you’re locked out. Our data scientist team improves on the heuristics constantly. At some point, organizations with da…

"Accessing internal apps in ways you shouldn’t?" At a high level, how do they do that? I can only think of a bunch of rules, and that will have to be tweaked endlessly to deal with edge cases.

[deleted]

Re: Former employees say Lyft staffers spied on passengers

#115

Post by averagewall »

nkkollaw wrote: post #65
duxup wrote: post #60

Earlier quoted context omitted.

"the minimum-wage employees that checks those" Does anyone even look at them? I just assume most video gets recorded and then recorded over or somehow discarded. Outside of situations like say an airport or casino I doubt anyone is actively watching most of the cameras unless something happens after the fact.

Perhaps not actively, but I bet in case of a hot woman or something weird going on they'll know where the monitors are. I also have two separate family members that have businesses with cameras, and they both look at what's going from an app on their iPads while they watch TV in the evening (actually, having seen them do it is probably why I know videos at businesses are not handled properly).

Don't public places like shops have to have a sign saying there's CCTV? So customers know they're watched just like in the street.

Re: Former employees say Lyft staffers spied on passengers

#116

Post by rtpg »

lobo_tuerto wrote: post #109
jstarfish wrote: post #14

Earlier quoted context omitted.

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. Indeed. The FCRA accounts for bored clerks looking up random peoples' credit history. Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason. I'm no fan of regulation but the wild west of PII is long past needing to be tamed. Companies need to be held respons…

"Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason." Then you should not have access to it? People will touch them if they can. That's why Access Control rules exist.

There's a bit of pragmatism involved in the level of control.

If you add too much friction to the process of accessing information, then it can actually impede on actually handling user support. For example, having access to someone's ride history when trying to resolve a dispute seems relatively normal.

Of course in Lyfts case it seems pretty clear that there can be more programatic locks. And auditable logs are able very good idea in general.

But programatic locks are tricky. How do you transform and e-mail from a user confirming permission to history into an unlock code?

Re: Former employees say Lyft staffers spied on passengers

#117

Post by anfedorov »

ryacko wrote: post #45
mattmanser wrote: post #10

Lyft tells TechCrunch that staffers in several departments that might need access to this data for their job have the ability to look up this information See, that's a complete lie and that's the attitude that needs to sop. No-one needed access. Analytics definitely didn't. Engineers never did. Customer services should have to request permission from the customer before accessing sensitive data, with a valid reason.…

https://danluu.com/wat/ apparently this is normal: Facebook famously let all employees access everyone’s profile for a long time, and you can even find HN comments indicating that some recruiters would explicitly mention that as a perk of working for Facebook. And I can think of more than one well-regarded unicorn where everyone still has access to basically everything, even after their first or second bad security b…

> I can think of more than one well-regarded unicorn where everyone still has access to basically everything

Hard to be sure, but GitHub support signed up for a friends-only beta of one of my products before I had told anyone outside my immediate circle about it.

Re: Former employees say Lyft staffers spied on passengers

#118

Post by jstarfish »

lobo_tuerto wrote: post #109
jstarfish wrote: post #14

Earlier quoted context omitted.

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. Indeed. The FCRA accounts for bored clerks looking up random peoples' credit history. Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason. I'm no fan of regulation but the wild west of PII is long past needing to be tamed. Companies need to be held respons…

"Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason." Then you should not have access to it? People will touch them if they can. That's why Access Control rules exist.

That might be how we deal with children who can't handle responsibility, but the absence of technical controls for every nuance of life is why ethics and code of law exists for adults.

Access controls are not a substitute for maturity.

Re: Former employees say Lyft staffers spied on passengers

#119

Post by [deleted] »

jamestimmins wrote: post #59
mpolichette wrote: post #5

When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also sh…

This was how it worked when I worked in admissions during college. You had access to every applicants' information, grades, essays, etc., as well as counselor feedback. But you were told that if you looked up yourself, someone you knew, or any celebrities, then you could be fired. I don't know if there were automated checks for that kind of thing, but everyone knew there was a line you didn't cross.

[deleted]

Re: Former employees say Lyft staffers spied on passengers

#120

Post by jamestimmins »

dkarl wrote: post #96
jamestimmins wrote: post #59

Earlier quoted context omitted.

This was how it worked when I worked in admissions during college. You had access to every applicants' information, grades, essays, etc., as well as counselor feedback. But you were told that if you looked up yourself, someone you knew, or any celebrities, then you could be fired. I don't know if there were automated checks for that kind of thing, but everyone knew there was a line you didn't cross.

At Lyft people did think there were automated checks, did know there was a line that shouldn't be crossed, and yet there was rampant abuse. Don't you suspect that many of the students in your position abused their access? I think companies should be responsible for implementing effective security, whether that means preventing improper access or at least detecting it and punishing it after the fact, not just establis…

Huh, that's an interesting point. Now that you mention it you're probably right that it was more common than I was aware of.
Post reply on HN