Former employees say Lyft staffers spied on passengers • Hacker News Board

Re: Former employees say Lyft staffers spied on passengers

#251

Post by CodeWriter23 » Sat, Jan 27, 2018, 8:59 AM UTC

nkkollaw wrote: post #211

CodeWriter23 wrote: post #191

Earlier quoted context omitted.

Chances are, the field of view is so wide there isn’t much of your GF to be seen in the recording, even in HD.

Sure, but it was just an example. What about if I was with my lover, and I didn't want my wife to know? If someone from the staff knew my wife, how do I know they won't send the video to her? What if I was drunk and tripped or made a fool of myself in some other way and I didn't want that to end up on YouTube or /r/PublicFreakout on Reddit? Etc., etc. We just don't know. Of course I could sue the person if what's bee…

Well that person who knows your wife probably only needs their voice to tell your wife...

From what I’ve seen, there may be a display in view of the staff and/or public. But the DVR and controls are usually locked up for the simple reason the owner doesn’t want to have to pay to call in a tech every time an employee monkeys with the system.

Re: Former employees say Lyft staffers spied on passengers

#252

Post by afpx » Sat, Jan 27, 2018, 2:34 PM UTC

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

The biggest issue is that consumers don’t read privacy policies or user agreements. If a company gets a user to waive their privacy, their data can and will be traded on the secondary market. It’s just simple economics.

I think most people who reside in the US would be shocked if they knew how much PII is traded about them. Very few people these days don’t have a personal record. Knowing what’s out there, I wish I lived in the EU.

Re: Former employees say Lyft staffers spied on passengers

#253

Post by dx034 » Mon, Jan 29, 2018, 9:29 AM UTC

buildbuildbuild wrote: post #230

dx034 wrote: post #221

Earlier quoted context omitted.

Many companies have userdata access heavily restricted and audit every access. It's not that hard to log all queries to production that don't come from the system. And if a developer runs queries against the production database that should pop up somewhere immediately. Not different in banks, any lookup of customer accounts is monitored and checked. Looking up a friend's account will get you fired immediately (or wor…

What I worry about is whether the logging is at the application level or database level. Would not be surprised if my banker’s crusty windows XP teller software’s auditing could be bypassed by an unexpectedly-savvy insider.

Logging is done at every level. OS, network and multiple times on a db level (access log plus execution log).