Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

231–240 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#231

Post by traviscj »

mattmanser wrote: post #204
tallanvor wrote: post #199

Earlier quoted context omitted.

A balance has to be made. The parent remark does not show an understanding of the realities of working on a service on all levels. There are many times when developers need access to specific customer data. Pretty much every company has in their TOS verbiage to note that employees may have to access customer data without their specific consent. That said, companies can and should have multiple layers to help prevent…

But I do have understanding. Because I've actually worked in a company with these safeguards. It handled extremely sensitive data of tens of millions of Britons. Normal engineers had no access to live data, 2 senior managers were the only ones in the engineering team with access to live passwords, etc. It is practical to put extremely heavy restrictions in place between engineers and the live data and they can still…

Why does anyone have "access to live passwords"? That point alone calls into question all of their practices, to me...

Re: Former employees say Lyft staffers spied on passengers

#232

Post by jaclaz »

nkkollaw wrote: post #194
averagewall wrote: post #115

Earlier quoted context omitted.

Don't public places like shops have to have a sign saying there's CCTV? So customers know they're watched just like in the street.

Not in Italy nor Poland. Also, what difference would that make? I already know I'm being filmed, the problem is that there is no control over how that video is used.

>Not in Italy nor Poland.

Which does not mean that there isn't a Law (in Italy) mandating it.

[Italian] Articolo 13 del Decreto Legislativo n.196/2003 e Videosorveglianza - Provvedimento generale - 29 aprile 2004:

http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-... [/Italian]

In a nutshell: http://www.garanteprivacy.it/Garante-Home-theme/images/origi...

Surely it makes no difference whatsoever.

Re: Former employees say Lyft staffers spied on passengers

#233

Post by jacquesm »

telchar wrote: post #174
megablast wrote: post #147

Earlier quoted context omitted.

Except putting barriers can cause even worse problems. If I can’t look up someone’s allergies because the system doesn’t think I should, fuck them right?

Exactly, barriers to looking up a patient's information can be fatal. I need to give someone medication now to stabilize them. What medications are they on now? Can't look it up? Better give it to them and hope there's no adverse reaction. Better to avoid that situation and implement auditing while making sure people know the rules are enforced.

"override authentication" -> You have chosen to override the authentication protocol, you are logged in as John Doe, all your actions will be subject to internal affairs review, continue yes / no?

Re: Former employees say Lyft staffers spied on passengers

#234

Post by Cthulhu_ »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

For a system like Lyft, I think you'd want all rides to be anonymized by the user's app, so that in case the user contacts support, they can if need be give permission (and send the key) for support to review a single ride. Something like that.

A bit more tricky for drivers though, due to billing and tracking and such.

Re: Former employees say Lyft staffers spied on passengers

#235

Post by katastic »

jstarfish wrote: post #14
mpolichette wrote: post #5

When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also sh…

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. Indeed. The FCRA accounts for bored clerks looking up random peoples' credit history. Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason. I'm no fan of regulation but the wild west of PII is long past needing to be tamed. Companies need to be held respons…

I had a family friend who had access to a medical database. I joked, "I wonder if I'm in there." She said, "Yep."

I remembered that Seinfeld episode where Elaine wants to change her file. I wondered what was in mine.

"Can I see mine?" I said excitedly.

"Absolutely not." her demeanor changed. Her professionalism kicked in.

I was just curious about the data the same way I am about any other data. I didn't think it was a big deal (even MY OWN data?!). But she sure as hell did.

And here I was, a family friend. Not a stranger. Normally those people are given more leeway in your life.

So if she can take that stuff seriously, I don't see why the hell we can't expect nothing less from everyone else with access to sensitive data. We don't give custodians keys to every room in the building and then expect them to go snooping through everyone's computers, files, etc.

But somehow, the human element kicks in, and we don't see a mental difference between "googling" what we're supposed to, and one... little... search of curiosity. Somehow, an extra Google/db search isn't as bad as rifling through someone's legal documents in their desk.

Anyhow, she was definitely spooked enough that you can be sure she had many hours/talkings/whatever to scare her into never doing non-standard searches and that she could go to federal jail for doing it.

Are they really tracking? Maybe. Hopefully! But it was enough to scare this person into doing her job and only her job.

So my point is simply: Solutions exist, if companies and organizations are willing to actually implement them. But until companies are fined for violating people's privacy, they're never going to implement it.

I can't get half my clients to upgrade from outdated versions of Windows without justifying the cost upgrade. Companies simply aren't going to care until we make it HURT their bottom line for their negligence.

Re: Former employees say Lyft staffers spied on passengers

#236

Post by djsumdog »

mattmanser wrote: post #201
djsumdog wrote: post #144

Earlier quoted context omitted.

I agree with you. I worked at a BlueCross and when debugging front-end apps, and I'd often dig through the database to check to see what is in each table and what could be throwing an error. I'd often bright up a debugging tool called TeaLeaf that let me watch the entire web session (this was back in 2009; so the full DOM tracking we complain about now has been available for quite some time). Technically, we couldn't…

That you casually talk about breaking the law with incredibly sensitive data is shocking. And worse still, you built in a system that circumvented the official policy, simply because you weren't capable of doing your job. You basically built in an illegal back door. If you were my employee I would fire you on the spot for gross negligence when I found that. Or maybe if you were a junior you'd be given a massive dress…

> You basically built in an illegal back door.

Wat? No, we build the system to block group44 access to all our own diagnostic tools for downstream users. I'm just saying we could also get around it because we build it and had direct db access. We didn't though, or at least I didn't.

I did not violate the law at all. We might have had to look at peoples' health claims information to debug issues, and that's fine, so long as we never disclose that data.

That was a decade ago, so they might have tightened things up. Still, at some point, some people are going to have access to all the data (A DBA is not going to be very effective at his/her job if they don't have admin access on production).

Re: Former employees say Lyft staffers spied on passengers

#237

Post by chaostheory »

mattmanser wrote: post #206
chaostheory wrote: post #70

Earlier quoted context omitted.

> What's the need? It isn't needed all the time but the one scenario I can think of is for debugging. Sometimes it's hard to dissect or even replicate a bug without the original data.

Discussed elsewhere in the thread, it's definitely not needed day to day. The number of devs popping up in this thread who think routine access is needed to live data just to be able to debug is quite worrying. In the rare instances it is, an anonymized version of the live db should be used to recreate the bug. If this doesn't work, then you might put in temporary logging accessible to only approved people, which is…

> it’s definitely not needed day to day

Yes I agree which is why that was the first sentence of my comment, which was in response to your comment which stated, “No-one needed access... Engineers never did.” It’s great that you changed your position, but please don’t make it seem like I was advocating for unfettered, 24/7 access to customer data when I clearly didn’t write that

Re: Former employees say Lyft staffers spied on passengers

#238

Post by marshallbrekka »

hoorayimhelping wrote: post #228
ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

> I don't get why more companies don't follow our approach. How much latency does this process add to the rendering of a web page? How many people did it take to design, implement and now maintain?

For an API call that requires decrypting data it can add about 5-10ms, most of that comes from reading the values from the token database. Encrypting will incur a similar performance penalty (again from the database).

The core pieces (API Proxy, Encryption Service, secure/general infrastructure divide) we're done by me in the first 2-4 months.

We now have a team of three (myself included) who maintain those systems (among many other responsibilities).

Re: Former employees say Lyft staffers spied on passengers

#239

Post by lakechfoma »

This is a shame for obvious reasons but I don't like the comparison to "god view". Uber designed a UI around accessing PII for their employees to use wanton, Lyft sounds like they need to get their data access under control, stop making excuses for why anyone "needs" real user data, and actually run audits.

Re: Former employees say Lyft staffers spied on passengers

#240

Post by iamdave »

marshallbrekka wrote: post #180
misterbowfinger wrote: post #173

Earlier quoted context omitted.

Would you consider open sourcing it? It seems quite interesting and valuable

It's so specific to our architecture that there would be little value in open sourcing it. That being said, there are some lessons we learned along the way that I do think are worth sharing. As I mentioned above the API proxy supports REST and gRPC API calls. For REST based APIs, we developed a YAML syntax for declaratively specifying (per route) the input/output keys that needed to be encrypted/decrypted. This is ac…

I don't get why more companies don't follow our approach

There's your value,but your own admission.

Post reply on HN