Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

211–220 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#211

Post by nkkollaw »

CodeWriter23 wrote: post #191
nkkollaw wrote: post #56

I was talking about this with my girlfriend at dinner tonight. While we were eating, I noticed a few cameras that got a view of the whole restaurant, and wondered: of course filming the restaurant might be useful in case of a robbery (?) or for insurance, etc., but what are the chances the minimum-wage employees that checks those DON'T use it to check out hot women or embarassing stuff that happens from time to time.…

Chances are, the field of view is so wide there isn’t much of your GF to be seen in the recording, even in HD.

Sure, but it was just an example. What about if I was with my lover, and I didn't want my wife to know? If someone from the staff knew my wife, how do I know they won't send the video to her?

What if I was drunk and tripped or made a fool of myself in some other way and I didn't want that to end up on YouTube or /r/PublicFreakout on Reddit?

Etc., etc.

We just don't know. Of course I could sue the person if what's been done is illegal, but it's a video and the damage would be done and hard to repair.

Re: Former employees say Lyft staffers spied on passengers

#213

Post by vidarh »

segmondy wrote: post #159
marshallbrekka wrote: post #154

Earlier quoted context omitted.

I can elaborate on these points. The service acts more like a key value store (this is a simplified explanation, but for your questions it will do). You give it a value, it gives you back a token, which you can later exchange for the original value. This means the real value is stored in the encryption service, not in the receiving applications database. This gives us the flexibility to perform key rotation (and even…

For de-anonymizing, the idea is to give the encrypted service the plain text and get a matching token. But then that will be more of a hash. If you are encrypting where all the tokens are different, you can't do a join or analysis. You can't for instance count how many unique phone numbers you have. If a user is using your app, how do they see their PI data?

> If you are encrypting where all the tokens are different, you can't do a join or analysis.

That would hopefully be part of the reason for doing it this way.

I once worked on a system where we encrypted most customer data on registration and took it entirely off line once a day (so new data was in encrypted form online for a day, and then was air-gapped permanently).

The fact that marketing etc. had to request reports to be run manually on the airgapped customer database was an important barrier that made them think about how they could meet their needs without it.

Sometimes, of course, they had genuine needs that needed access to the unencrypted data, but it was rare.

I'm a big fan of making it take extra effort to do these things - time and resources seems to be a far stronger barrier than requiring authorization.

Re: Former employees say Lyft staffers spied on passengers

#214

Post by vidarh »

jstarfish wrote: post #118
lobo_tuerto wrote: post #109

Earlier quoted context omitted.

"Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason." Then you should not have access to it? People will touch them if they can. That's why Access Control rules exist.

That might be how we deal with children who can't handle responsibility, but the absence of technical controls for every nuance of life is why ethics and code of law exists for adults. Access controls are not a substitute for maturity.

> Access controls are not a substitute for maturity.

But maturity is not a substitute for access controls either.

In any organization of some size, no matter how much you hire for "maturity", eventually people will slip past who have all kinds of reasons they'll be able to justify to themselves for deciding it's too tempting to look at things they shouldn't.

Re: Former employees say Lyft staffers spied on passengers

#215

Post by OliverJones »

ilamont wrote: post #16

That sure changes the Uber vs. Lyft media narrative.

Disagree. This press report, rather, tries to piggyback on the Uber narrative. Hey, it got me to click!

It's clear from the stuff in the report that Lyft prohibits misuse of PII. The substance of the article is "sometimes people violate our prohibition." The substance of Uber's problems is "our executives and everybody else have free rein on the PII we collect." It's different.

Re: Former employees say Lyft staffers spied on passengers

#216

Post by OliverJones »

Protection of PII has, for a long time, been a central tenet of USA-based health care IT (due to the HIPAA / ARRA-2009) regulations.

It's possible to do that fairly well, and still leave need-to-know exceptions. (The subsititute nurse on the intensive care unit needs to know if a particular patient has Crohns disease, for example).

My point is, PII CAN be protected reasonably well. It takes executive will to do so, and training, and monitoring.

I worked in a hospital for a while. They had good training on how to avoid misusing PII. It starts with "don't look up your ex or your senator" and goes into ways to keep patient data safe.

When there IS a leak HIPAA-covered operations are obliged to disclose it. See here for the catalog of recent disclosures.

   https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
Doing privacy right is systemically possible. But it's a systemwide task, not just a one-off training or audit.

(Now, we can talk about whether HIPAA's main point--preventing insurers from abusing patient data--is working or not. Your doc makes you sign a permission slip letting insurers see your information, so you waive that protection in return for reimbursement. But that's a different issue.)

Re: Former employees say Lyft staffers spied on passengers

#217

Post by datr »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

We considered doing something like this on a project once but we had concerns about performance. How much latency does your API proxy add in for responses with thousands of tokens?

Additionally we found that this broke any sort of database indexing. Let's presume that Lyft would need to tokenize the start and end points of journeys (otherwise it would be quite easy to de-anonymise someone) then just doing simple queries like I want to know how many journeys happen in this area either become incredibly slow or you have to have anticipated needing this type of query and providing a non-tokenized "area" field which can be indexed (but is sufficiently coarse not to leak data). Were you able to come up with any sort of solution for this issue?

Re: Former employees say Lyft staffers spied on passengers

#218

Post by walshemj »

chipperyman573 wrote: post #127
walshemj wrote: post #51

Earlier quoted context omitted.

I remember a briefing when I worked for BT in the UK some one looked up for a mate his exes new address - who then got murdered. There was also the case involving hit men who found the address of a targets mom and dad who where also killed by bribing some one. BT took security v seriously and you had better hope if you did something bad that the cops or the even the secret service (MI5) got to you before the internal…

>BT took security v seriously and you had better hope if you did something bad that the cops or the even the secret service (MI5) got to you before the internal security team did. I would rather be "dealt with" by BT than with the cops or secret service. BT can fire you, the cops and SS can take away your rights (with due process)

As a former PTT IB or SD was descended from the unit in the GPO that dealt with stealing for the post so had some odd quasi legal standing - its also where the secret squirrels worked.

They have a bad reputation as in the bad old days some of the confessions involved falling down stairs, which I was hinting at :-)

Re: Former employees say Lyft staffers spied on passengers

#219

Post by DerBesserWisser »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

IMHO the problem is not encryption but to wide access rights ("Marketing needs access") and bulk access ("get me all customer data").

Re: Former employees say Lyft staffers spied on passengers

#220

Post by buildbuildbuild »

Can unfortunately confirm that friends at both Lyft and Uber have in the past known my ride history. I admittedly had to push a bit jokingly for either to look it up, but the fact that it is even possible for insiders to access internal production databases makes me suspect this problem is far more widespread than just at ridesharing companies.

I wonder who at Fastmail can read user emails? Who at Heroku can access my code or ENV secrets? Can bank employees see recent transactions, bypassing ACH verification deposits’ “Security”?

Sad how rare end to end encryption is as a feature in 2018.

Post reply on HN