Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

131–140 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#131

Post by andrestan »

azernik wrote: post #62
303space wrote: post #52

Earlier quoted context omitted.

Does anyone else find this whole thing more than a bit hypocritical? Lyft is always telling you they are the better/ethical/woke ridesharing option - now their employees are reporting a culture of abusing customer privacy. I wish they had taken a look at their own practices before running million dollar ad campaigns full of celebrities celebrating their ‘wokeness’.

Uber had the kicker that invasion of privacy was a top-down policy explicitly used by management. Lyft still done fucked up, but not to the level that Uber did.

Which news story about Uber makes invasion of privacy seem like a top-down policy?

Re: Former employees say Lyft staffers spied on passengers

#132

Post by kevin_nisbet »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

This is a very intriguing approach.

I'm curious about one aspect though, have you put much thought into what happens and the side effects of doing something like key rotation if you're encrypted service is potentially compromised / leaked.

The second aspect I'm curious about, is you mention services in your general layer are not able to talk to the encryption service to decrypt data, but what about encrypting data? The reason I'm curious is the tricky part with anonymization, is I don't necessarily have to decrypt PII to unmask it.

I don't really know what you're service does, but say it's tracking location, and one of the pieces of PII is phone number. If I can go to the encryption service and ask for the encrypted version of a phone number I know, I then have the encrypted phone number that I can use to search the dataset.

Re: Former employees say Lyft staffers spied on passengers

#134

Post by vageli »

gersh wrote: post #89
mynameisvlad wrote: post #69

Earlier quoted context omitted.

Can you actually refute the parent comment's argument? Because it seems more than reasonable to me. Analytics and Engineering definitely don't need this level of data access for any sort of day-to-day work. I work on analytics tools, and at best, anonymized and generalized data is needed, but never specific customer data. We specifically strip out any PII on data that might reach developers and need to request permis…

It is probably possible to design systems to avoid access, but they will get more complex. Engineering has to debug bugs. For example, suppose there is bug where the rate calculations aren't working for certain types of routes. The engineers will want to look up those routes to understand what is causing it. If you are designing an algorithm to detect to fraud, you are going to want to look at cases of fraud to under…

> For example, suppose there is bug where the rate calculations aren't working for certain types of routes. The engineers will want to look up those routes to understand what is causing it.

Then show routes without names.

> If you are designing an algorithm to detect to fraud, you are going to want to look at cases of fraud to understand how to design the algorithm. Then show names without routes.

> Further, if you want to do usability testing you are going to need to test with. You might want to check the different types of names used in the system to make sure they display properly. You may also want to sample the list of customers to user-test with live data or survey customers.

Use a library that can generate realistic but fake data. I feel there is no excuse to not compartmentalize. If data security is not important to the business...well it only takes one bad article like this to cast doubt on the whole company.

Re: Former employees say Lyft staffers spied on passengers

#135

Post by azernik »

andrestan wrote: post #131
azernik wrote: post #62

Earlier quoted context omitted.

Uber had the kicker that invasion of privacy was a top-down policy explicitly used by management. Lyft still done fucked up, but not to the level that Uber did.

Which news story about Uber makes invasion of privacy seem like a top-down policy?

Tracking a journalist: https://www.theverge.com/2014/11/19/7245447/uber-allegedly-t...

About the company specifically designing and building an internal tool to make this process easier: https://www.theverge.com/2014/11/19/7245447/uber-allegedly-t...

That whole "greyball" story, which involved personal tracking of law enforcement officers: https://www.nytimes.com/2017/03/03/technology/uber-greyball-...

Re: Former employees say Lyft staffers spied on passengers

#136

Post by spydum »

asow92 wrote: post #133

Who honestly finds this surprising?

Very very few people I hope. There is no economic incentive for companies to invest in secure design/architecture. The costs of building it right almost always lose to other product owner features and timelines.

Until we can actually get incentives aligned, companies will continue to build leaky, poorly designed apps with no layered controls. Yes, someone will jump on me and say "but my company does is right!". Great for you! Share your knowledge! You are a snowflake, and probably fortunate to have ethical leadership! The rest of us are doomed.

Re: Former employees say Lyft staffers spied on passengers

#137

Post by wyattjoh »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

Are you using something like Vault [0] for that? Always been interested in different approaches for this.

[0]: https://www.vaultproject.io/

Re: Former employees say Lyft staffers spied on passengers

#138

Post by jacquesm »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

I sincerely hope that your approach becomes common enough that I will see it implemented in practice. Right now it is rather the opposite, plain text data flying around everywhere and at rest in test databases and backups is the norm. And if you are really unlucky you will find it on the laptops of developers in the form of a two week old copy of main database. And if you are even more unlucky that developer does not have his hard drive encrypted and takes the bus every day to work. And already lost another laptop, just like that one, only nothing ever came of it so the data is most likely still safe.

Re: Former employees say Lyft staffers spied on passengers

#139

Post by jacquesm »

pookeh wrote: post #54
milofeynman wrote: post #47

Earlier quoted context omitted.

In hospitals in the U.S. the way it works in some is nurses can view a lot of the patients charts (including VIP). And then someone is supposed to audit who viewed those VIP patients (celebrity or what not) but every hospital is different and it's a mess.

Here in Canada if you have access to the central medical records you can look up anyone but (a) if you are not a doc and are not assigned to the case or (b) you are looking up yourself or a family member, you immediately get a call and get fired on the spot. (Source: Wife works at the hospital and has seen some people get fired shortly after unauhorized access.)

You would think that if they have the ability to audit at that level and with such prompt responses they would have the resources to lock down the systems properly and to implement a consent policy that works. Allowing everybody access is a bit like binding the cat to the bacon and then getting upset because the cat can not be trusted with bacon.

Better to keep the cat and the bacon separate, the temptation to peek is large and if there is one thing I know about people then it is that curiosity is a pretty common affliction.

And that is assuming that those accesses are on purpose, people can make honest mistakes as well and they will also look like unauthorized access.

Post reply on HN