Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

221–230 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#221

Post by dx034 »

buildbuildbuild wrote: post #220

Can unfortunately confirm that friends at both Lyft and Uber have in the past known my ride history. I admittedly had to push a bit jokingly for either to look it up, but the fact that it is even possible for insiders to access internal production databases makes me suspect this problem is far more widespread than just at ridesharing companies. I wonder who at Fastmail can read user emails? Who at Heroku can access m…

Many companies have userdata access heavily restricted and audit every access. It's not that hard to log all queries to production that don't come from the system. And if a developer runs queries against the production database that should pop up somewhere immediately.

Not different in banks, any lookup of customer accounts is monitored and checked. Looking up a friend's account will get you fired immediately (or worse).

Re: Former employees say Lyft staffers spied on passengers

#222

Post by rmc »

anigbrowl wrote: post #141
ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

Technical solutions are great, but ultimately this is a human problem. Not every firm has the resources or know-how to do all that, but any firm can have a clear policy of termination and lawsuits for anyone found abusing access to customer data.

> Not every firm has the resources or know-how to do all that

The upcoming EU Data Protection law (GDPR) has fines for data protection breeches. It can be up €20 million or 4% of global revenue. And NGOs can sue you on behalf of affected people. When there's a price tag on non-compliance, suddenly it becomes easier to justify allocating resources to doing it (or paying someone else to tell you how to do it).

Re: Former employees say Lyft staffers spied on passengers

#223

Post by rmc »

OliverJones wrote: post #216

Protection of PII has, for a long time, been a central tenet of USA-based health care IT (due to the HIPAA / ARRA-2009) regulations. It's possible to do that fairly well, and still leave need-to-know exceptions. (The subsititute nurse on the intensive care unit needs to know if a particular patient has Crohns disease, for example). My point is, PII CAN be protected reasonably well. It takes executive will to do so, a…

> PII CAN be protected reasonably well. It takes executive will to do so

These is where the EU's new data protection law (GDPR) could help. It has large fines, and the ability for NGOs to sue you on behalf of users. When the alternative is a big fine, it's easier to find the will.

Re: Former employees say Lyft staffers spied on passengers

#224

Post by rmc »

dkarl wrote: post #96
jamestimmins wrote: post #59

Earlier quoted context omitted.

This was how it worked when I worked in admissions during college. You had access to every applicants' information, grades, essays, etc., as well as counselor feedback. But you were told that if you looked up yourself, someone you knew, or any celebrities, then you could be fired. I don't know if there were automated checks for that kind of thing, but everyone knew there was a line you didn't cross.

At Lyft people did think there were automated checks, did know there was a line that shouldn't be crossed, and yet there was rampant abuse. Don't you suspect that many of the students in your position abused their access? I think companies should be responsible for implementing effective security, whether that means preventing improper access or at least detecting it and punishing it after the fact, not just establis…

> I think companies should be responsible for implementing effective security

That's what the EU data protection law requires! And there are high fines, and new abilities coming into force in May!

Re: Former employees say Lyft staffers spied on passengers

#225

Post by dx034 »

ryanfreeborn wrote: post #192
mattmanser wrote: post #10

Lyft tells TechCrunch that staffers in several departments that might need access to this data for their job have the ability to look up this information See, that's a complete lie and that's the attitude that needs to sop. No-one needed access. Analytics definitely didn't. Engineers never did. Customer services should have to request permission from the customer before accessing sensitive data, with a valid reason.…

This is a pretty absolutist approach. >What's the need? How about plain old abuse? People using services to break the law, particularly crimes with victims? Safety risks? - An uber passenger sees their driver has a gun in the cup holder; they report it to uber. - A Square merchant is using Square to launder serious money and Square catches it. - A Dropbox user is uploading child pornography that indicates active chil…

Pretty simple: some departments have access but everything gets logged and audited. If you cannot connect a request to a ticket, you'll get questioned. If you abused your access, you'll be fired immediately. Other industries handle it that way (e.g. banks). I know enough people in banking and know that there's no chance they would ever risk looking up my accounts.

Re: Former employees say Lyft staffers spied on passengers

#226

Post by dx034 »

tzahola wrote: post #17
lhorie wrote: post #2

Someone I know was just commenting that from convos w/ people in other companies, it seems many startups have benefitted from not being under the limelight, and thus had the chance to quietly clean up their own messes while Uber was taking all the heat from the media.

So basically Uber is the Weinstein of startups.

But it appears that Weinstein helped to clean up the industry a lot. Would be great if Uber helps to make startups more responsible (I doubt that).

Re: Former employees say Lyft staffers spied on passengers

#227

Post by dx034 »

throwawaylyfty wrote: post #80

I worked there. I was an engineer and definitely needed access to these data. Fraud and abuse is constantly evolving and touches every part of the business. Everything was audited and I never saw or heard of a single abuse of access. Privacy was talked about seriously at onboarding and other trainings. I have no doubt if somebody was caught abusing this they’d be fired.

Why do you need access as an engineer? Databases for testing should have all sensitive information removed (you can still debug errors). I cannot think of many cases where an engineer will need to have read access to the production database.

Re: Former employees say Lyft staffers spied on passengers

#228

Post by hoorayimhelping »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

>I don't get why more companies don't follow our approach.

How much latency does this process add to the rendering of a web page? How many people did it take to design, implement and now maintain?

Re: Former employees say Lyft staffers spied on passengers

#229

Post by dx034 »

mmanfrin wrote: post #79

The screenshots from the leaker mention that they are using "redshift", which is the name of Amazon's RDB product. Which means this is about people who have access to the database. This is unsurprising that they could access customer data given access to their database. I'm not sure how you prevent this without preventing access to the db (and there are legitimate reasons people within the company would have access -…

You can do all development, testing and debugging on databases that have sensitive information removed. Just replacing names and email addresses goes a long way and shouldn't make a difference for the engineer. If there's a bug with a certain ride, the ID for that is enough to test.

Read access to production data is only necessary in very few cases and can be heavily audited.

Re: Former employees say Lyft staffers spied on passengers

#230

Post by buildbuildbuild »

dx034 wrote: post #221
buildbuildbuild wrote: post #220

Can unfortunately confirm that friends at both Lyft and Uber have in the past known my ride history. I admittedly had to push a bit jokingly for either to look it up, but the fact that it is even possible for insiders to access internal production databases makes me suspect this problem is far more widespread than just at ridesharing companies. I wonder who at Fastmail can read user emails? Who at Heroku can access m…

Many companies have userdata access heavily restricted and audit every access. It's not that hard to log all queries to production that don't come from the system. And if a developer runs queries against the production database that should pop up somewhere immediately. Not different in banks, any lookup of customer accounts is monitored and checked. Looking up a friend's account will get you fired immediately (or wor…

What I worry about is whether the logging is at the application level or database level.

Would not be surprised if my banker’s crusty windows XP teller software’s auditing could be bypassed by an unexpectedly-savvy insider.

Post reply on HN