Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

141–150 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#141

Post by anigbrowl »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

Technical solutions are great, but ultimately this is a human problem. Not every firm has the resources or know-how to do all that, but any firm can have a clear policy of termination and lawsuits for anyone found abusing access to customer data.

Re: Former employees say Lyft staffers spied on passengers

#143

Post by paulie_a »

rtpg wrote: post #116
lobo_tuerto wrote: post #109

Earlier quoted context omitted.

"Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason." Then you should not have access to it? People will touch them if they can. That's why Access Control rules exist.

There's a bit of pragmatism involved in the level of control. If you add too much friction to the process of accessing information, then it can actually impede on actually handling user support. For example, having access to someone's ride history when trying to resolve a dispute seems relatively normal. Of course in Lyfts case it seems pretty clear that there can be more programatic locks. And auditable logs are abl…

If only we had modern phone infrastructure that could actually transfer useful info to the appropriate person... Instead we have terrible phone support that requires me to repeat the same info 3 times.

That info should be unlocked the millisecond I am connected with a rep . It's not a moonshot

Re: Former employees say Lyft staffers spied on passengers

#144

Post by djsumdog »

sargun wrote: post #92
mattmanser wrote: post #10

Lyft tells TechCrunch that staffers in several departments that might need access to this data for their job have the ability to look up this information See, that's a complete lie and that's the attitude that needs to sop. No-one needed access. Analytics definitely didn't. Engineers never did. Customer services should have to request permission from the customer before accessing sensitive data, with a valid reason.…

Have you tried to debug the same two problems when you do not have access to the infrastructure, versus when you do have infrastructure access? It's a radically different experience. In addition, even if no one needs access, a bad actor who writes the code can always put a backdoor in place and read whatever they want.

I agree with you. I worked at a BlueCross and when debugging front-end apps, and I'd often dig through the database to check to see what is in each table and what could be throwing an error. I'd often bright up a debugging tool called TeaLeaf that let me watch the entire web session (this was back in 2009; so the full DOM tracking we complain about now has been available for quite some time).

Technically, we couldn't see any Group44 information (BlueCross employees) without special permissions. But we had to build that logic into all the debugging tools, and if I wanted to, I could query the database directly.

We were all covered by HIPPA, so we could face serious fines over leaked personal medical information. And honestly, the security and audit team were actually pretty good; often identifying Group44 issues and they'd have SSH and su log scanners to constantly check for unauthorized access on servers.

It's all about trade-offs. Lyft is still a growing company and they probably just need to implement some more automated auditing. And to be fair, these aren't medical records. It's going to become an issue if a customer service rep gives anything to the police without a warrant though.

Re: Former employees say Lyft staffers spied on passengers

#145

Post by djsumdog »

vageli wrote: post #134
gersh wrote: post #89

Earlier quoted context omitted.

It is probably possible to design systems to avoid access, but they will get more complex. Engineering has to debug bugs. For example, suppose there is bug where the rate calculations aren't working for certain types of routes. The engineers will want to look up those routes to understand what is causing it. If you are designing an algorithm to detect to fraud, you are going to want to look at cases of fraud to under…

> For example, suppose there is bug where the rate calculations aren't working for certain types of routes. The engineers will want to look up those routes to understand what is causing it. Then show routes without names. > If you are designing an algorithm to detect to fraud, you are going to want to look at cases of fraud to understand how to design the algorithm. Then show names without routes. > Further, if you w…

The trouble is, if you're at this level of engineering, you're probably going to be writing the isolation layer. So you already have access to the raw data and you're just going to either make things harder for yourself or only be designing for downstream security.

You can and should restrict customer service reps (only allow them to access routes/users/drivers who they have active tickets on), but at some point you're going to need to trust your developers since they can usually just query the database directly.

Re: Former employees say Lyft staffers spied on passengers

#146

Post by megablast »

pookeh wrote: post #54
milofeynman wrote: post #47

Earlier quoted context omitted.

In hospitals in the U.S. the way it works in some is nurses can view a lot of the patients charts (including VIP). And then someone is supposed to audit who viewed those VIP patients (celebrity or what not) but every hospital is different and it's a mess.

Here in Canada if you have access to the central medical records you can look up anyone but (a) if you are not a doc and are not assigned to the case or (b) you are looking up yourself or a family member, you immediately get a call and get fired on the spot. (Source: Wife works at the hospital and has seen some people get fired shortly after unauhorized access.)

At least that is what they tell everyone.

Re: Former employees say Lyft staffers spied on passengers

#147

Post by megablast »

jacquesm wrote: post #139
pookeh wrote: post #54

Earlier quoted context omitted.

Here in Canada if you have access to the central medical records you can look up anyone but (a) if you are not a doc and are not assigned to the case or (b) you are looking up yourself or a family member, you immediately get a call and get fired on the spot. (Source: Wife works at the hospital and has seen some people get fired shortly after unauhorized access.)

You would think that if they have the ability to audit at that level and with such prompt responses they would have the resources to lock down the systems properly and to implement a consent policy that works. Allowing everybody access is a bit like binding the cat to the bacon and then getting upset because the cat can not be trusted with bacon. Better to keep the cat and the bacon separate, the temptation to peek i…

Except putting barriers can cause even worse problems. If I can’t look up someone’s allergies because the system doesn’t think I should, fuck them right?

Re: Former employees say Lyft staffers spied on passengers

#148

Post by [deleted] »

throwawaylyfty wrote: post #80

I worked there. I was an engineer and definitely needed access to these data. Fraud and abuse is constantly evolving and touches every part of the business. Everything was audited and I never saw or heard of a single abuse of access. Privacy was talked about seriously at onboarding and other trainings. I have no doubt if somebody was caught abusing this they’d be fired.

[deleted]

Re: Former employees say Lyft staffers spied on passengers

#149

Post by djsumdog »

lovich wrote: post #99
throwawaylyfty wrote: post #80

I worked there. I was an engineer and definitely needed access to these data. Fraud and abuse is constantly evolving and touches every part of the business. Everything was audited and I never saw or heard of a single abuse of access. Privacy was talked about seriously at onboarding and other trainings. I have no doubt if somebody was caught abusing this they’d be fired.

The article is indicating that what you are saying is at least not universally true in Lyft

It's really difficult to audit all this stuff. I was at a health insurance company where someone used su to go to a different user on a box they had root on and it did get picked up by the security team, but only a few weeks after it happened.

I was offered a security job at one shop and turned it down, keeping my development role. They had 3 security people for the company (total IT size was 500) and it involved a ton of log parsing, DDoS work, and they were starting to develop an internal white listing application tool. They wanted to bring me on because the desperately needed a developer to add some automation parsing the important from the chaff. (A younger me would have probably done this back when I wanted to be a Pen-tester. I only got interviewed/offered the position because I made the mistake about talking about going to Defcon on a company Slack channel and the security guy insisted I interview).

Re: Former employees say Lyft staffers spied on passengers

#150

Post by djsumdog »

ilamont wrote: post #16

That sure changes the Uber vs. Lyft media narrative.

Not really. Uber created the Hell Map, Greyball, and had the two harassment memos. This just seems to be a failure to actively monitor their audits and do permissions correctly .. something that Uber got hit with and fixed too.

Lyft just needs to deal with this issue now that it's public, not it's not specific to Lyft. It's really difficult to effectively scan for abuse, even when you audit everything. I've seen similar issues at many companies.

This Lyft situation might be more oversight where Uber seems to be more malice.

Post reply on HN