Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

181–190 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#181

Post by marshallbrekka »

schwabacher wrote: post #178
ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

The tricky part about this sounds like it would be specifying in the proxy service which parts of structured requests are responses are PII - how do you handle this?

In short, our REST based APIs are done via a YAML syntax, but our newer APIs are through Protocol Buffers.

See my other comment for more details https://news.ycombinator.com/item?id=16237349

Re: Former employees say Lyft staffers spied on passengers

#182

Post by teej »

mmanfrin wrote: post #79

The screenshots from the leaker mention that they are using "redshift", which is the name of Amazon's RDB product. Which means this is about people who have access to the database. This is unsurprising that they could access customer data given access to their database. I'm not sure how you prevent this without preventing access to the db (and there are legitimate reasons people within the company would have access -…

Redshift doesn’t have column level access permissions but it does have schema/table level access permissions. That is more than sufficient to prevent this kind of issue.

Re: Former employees say Lyft staffers spied on passengers

#183

Post by iovrthoughtthis »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

I've always wanted to do this but couldn't justify the time as my business partner didn't value user privacy as much.

It would have made GDPR compliance waaaay easier.

Could you write it up as a blog post? I would love to know more.

Re: Former employees say Lyft staffers spied on passengers

#184

Post by marshallbrekka »

iovrthoughtthis wrote: post #183
ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

I've always wanted to do this but couldn't justify the time as my business partner didn't value user privacy as much. It would have made GDPR compliance waaaay easier. Could you write it up as a blog post? I would love to know more.

https://news.ycombinator.com/item?id=16236798

https://news.ycombinator.com/item?id=16237349

Re: Former employees say Lyft staffers spied on passengers

#185

Post by yellow_postit »

Consultant32452 wrote: post #129
mikeash wrote: post #66

Earlier quoted context omitted.

I generally agree with you, but I think it should be pointed out that unauthorized access to that unlocked box carries severe punishment. A big part of the problem with things like this is that not only are there no controls preventing access to private info, but there are also few if any consequences.

How much control do you think there was in the businesses that got those wrapped pieces of paper with your banking account information? Sure, there are penalties while it's in the box in your yard, but not really once it was at its destination. I bet it's much more strict today than it was a few decades ago.

I'm not so sure. There was a lot less surface area then to secure vs today's "collect all the data" ethos

Re: Former employees say Lyft staffers spied on passengers

#186

Post by tzs »

marshallbrekka wrote: post #155
wyattjoh wrote: post #137

Earlier quoted context omitted.

Are you using something like Vault [0] for that? Always been interested in different approaches for this. [0]: https://www.vaultproject.io/

The service is written in-house, but we do use Vault for things like provisioning temporary credentials.

Why in house?

We did a similar thing for credit card storage. We did it in house because I failed to find any open source solution that I liked that would fit in with the rest of our stuff. Things in this space (free or commercial) seemed to have strong opinions about how the rest of your software should work.

I received at one point permission to release our stuff as open source, but didn't have time to clean it up for outside release. I could probably get that permission renewed and find time to do it, but I'm not sure if it would be worth it, for a couple reasons.

1. Once upon a time I got totally fed up with the idiocy and complexity that is SOAP and the way I kept running into subtle incompatibilities between SOAP servers and SOAP clients when the clients were provided by different vendors than the servers and were in different languages. I yelled "SCREW SOAP!" and hacked out that weekend something I called RADIO (named after the old joke [1]). RADIO lets you write a service in Perl with some annotations in comments that describe the services provided. You then run that through the RADIO generator, and it spits out a Perl CGI that implements the service, and client modules for it in Perl, PHP, and Python. The Perl CGI also provides a human usable interface on the web that gives you a form-based interface that provides documentation for each API call and lets you invoke them from a browser.

I used RADIO to implement the credit card storage service. I'm not sure many people would be interested in running a Perl service implemented using a weird sort of framework sort of code generator.

2. How it uses cryptography (choice of cipher, mode, padding, and such) has not been reviewed by a cryptographer. I know enough to not implement my own cryptographic primitives, of course, and so used well-known implementations from CPAN. However, I still had to make choices about HOW to use those, and those choices have not been checked by an expert.

[1] Two polar bears are sitting in a bathtub. The first one says, "Pass the soap." The second one says, "No soap, radio!" https://en.wikipedia.org/wiki/No_soap_radio

Re: Former employees say Lyft staffers spied on passengers

#187

Post by mys_throwaway »

I happen to know that the former country manager of Uber in Malaysia used driver personal information to bully and then swindle a gig worker at another (but not competing) gig-economy startup.

Long story short, he pressured the worker into doing a gig for free if he could guess his birthday. Not quite a fair gamble considering he knew the guy's birthday from when he'd signed up as a driver for Uber.

This would still be a terrible misuse of confidential information if he'd stopped at the poorly executed joke, but the highest ranked Uber employee in Malaysia instead insisted the marginally employed freelancer hold to the agreement.

Re: Former employees say Lyft staffers spied on passengers

#189

Post by 0xB31B1B »

mys_throwaway wrote: post #187

I happen to know that the former country manager of Uber in Malaysia used driver personal information to bully and then swindle a gig worker at another (but not competing) gig-economy startup. Long story short, he pressured the worker into doing a gig for free if he could guess his birthday. Not quite a fair gamble considering he knew the guy's birthday from when he'd signed up as a driver for Uber. This would still…

What does this have to do with lyft?

Re: Former employees say Lyft staffers spied on passengers

#190

Post by tomschlick »

averagewall wrote: post #115
nkkollaw wrote: post #65

Earlier quoted context omitted.

Perhaps not actively, but I bet in case of a hot woman or something weird going on they'll know where the monitors are. I also have two separate family members that have businesses with cameras, and they both look at what's going from an app on their iPads while they watch TV in the evening (actually, having seen them do it is probably why I know videos at businesses are not handled properly).

Don't public places like shops have to have a sign saying there's CCTV? So customers know they're watched just like in the street.

No
Post reply on HN