Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

331–340 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#331

Post by amazingman »

ctennis1 wrote: post #200
claudiulodro wrote: post #31

Earlier quoted context omitted.

I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...

Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don't have 2FA - because they don't login - but they have full access to most source. In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to s…

This is almost certainly what actually happened.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#332

Post by brightball »

chakalakasp wrote: post #170

Man, I don't know if Uber is evil or if most tech companies are evil and Uber just doesn't drop the kind of money on PR strategery that an evil company need to drop in order to seem normal. But either way, holy cow does that company come off as toxic. They've completely revolutionized the drive-for-hire industry and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work enviro…

I never quite know how to think about them. On the one hand, they’d changed an entire industry in a way that people wanted but was getting serious resistance from the entrenched players. They had to break a lot of rules and go around a lot of people with a whole lot of connections to get where they are and in the process made a lot of enemies.

I expect blowback. I expect negative news. They essentially pulled it off by looking at every day as combat where fighting dirty was rewarded.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#333

Post by starik36 »

krelian wrote: post #277
chakalakasp wrote: post #170

Man, I don't know if Uber is evil or if most tech companies are evil and Uber just doesn't drop the kind of money on PR strategery that an evil company need to drop in order to seem normal. But either way, holy cow does that company come off as toxic. They've completely revolutionized the drive-for-hire industry and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work enviro…

Uber is like the Donald Trump of corporations. It sets new ground in how openly vile you can be without any consequences. Just like Donald Trump the real danger is not in Uber itself but in whatever it will be that uses it as a role model.

I propose a new law, similar to Godwin's.

"As an online discussion grows longer, the probability of a comparison involving Trump approaches 1"

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#335

Post by linkregister »

misun78 wrote: post #308
stevenj wrote: post #4

Ever since Susan Fowler told her story about what happened to her at Uber, I have only used Lyft, and have encouraged all my friends to do the same. I plan to never use Uber again.

Uber employee chiming in - while I entirely sympathize with HN's frustrations around our ethics and can't really justify our actions around this data breach, it is very much worth noting that Lyft would not exist were it not for Uber's extremely aggressive practices. There were/are far too many protectionist policies at play at most locales that -- not out of pure coincidence -- needed a company as aggressive as Uber…

I disagree that Lyft would not exist; Lyft invented the UberX category. Originally Kalanick complained about Lyft's creative interpretation of the law, before succumbing to internal employee pressure to introduce a competitor. Years after its introduction, Kalanick admitted that he didn't believe in UberX until it demonstrated its success.

That said, almost all of the notable legislative and regulatory battles were conducted and won by Uber.

The wrongful actions by companies do get forgiven eventually, as toxic executives leave (as in the case of the CEO, Legal Officer, and now the CSO), but no public is foolish enough to immediately absolve any company of wrongdoing. Uber will have a reputation for sexual harassment long after it meets or exceeds the standards of other large companies.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#336

Post by linkregister »

euyyn wrote: post #95
linkregister wrote: post #71

Earlier quoted context omitted.

The current deletion process is smooth and can be completed in-app.

Why bother? I just deleted the app and forgot about it. Is there something I should know?

You may or may not want to remove your information, especially if you change phones. Someone getting your phone number could charge rides to your account if you don't unlink your credit card information.

It's also good hygiene to delete accounts. I don't typically do it, but when a company offers an easy delete button, I won't refuse.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#337

Post by ec109685 »

chadbennett wrote: post #102
sthomas1618 wrote: post #30

"Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company." S…

81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches or data leaks. Most organizations believe that 2FA and SSO are the answer but this proves that 2FA/SSO are not enough.

81% — that is a very precise number.

Folks should be using short lived aws tokens to avoid the possibility of having tokens in source control: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentia...

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#338

Post by ACow_Adonis »

knowaveragejoe wrote: post #275
wallace_f wrote: post #262

Earlier quoted context omitted.

Speaking of politics, media influence and tech, a fair number of average joes have a terrible opinion of Musk/Tesla/SpaceX; but these same people are unaware, or maybe vaguely aware the US Gov spent >10billion, just in direct financial losses, bailing out GM. If everyone in the country was told "write a check to GM for $50 or go to jail," and conservative media wasn't berating Tesla/Musk, public opinion would be a lo…

This is news to me, I've never come across an average person having a negative opinion of Musk. On the contrary they think of him as some iron-man like figure.

Most "average people" I know (admittedly on the other side of the world) have some name recognition for Tesla the company (they make expensive cars and batteries right?) and would probably struggle to tell you who elon musk is, let alone have an opinion on him. The tech bubble has thick walls sometimes...

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#339

Post by nradov »

misun78 wrote: post #308
stevenj wrote: post #4

Ever since Susan Fowler told her story about what happened to her at Uber, I have only used Lyft, and have encouraged all my friends to do the same. I plan to never use Uber again.

Uber employee chiming in - while I entirely sympathize with HN's frustrations around our ethics and can't really justify our actions around this data breach, it is very much worth noting that Lyft would not exist were it not for Uber's extremely aggressive practices. There were/are far too many protectionist policies at play at most locales that -- not out of pure coincidence -- needed a company as aggressive as Uber…

You've got your history wrong. Lyft actually launched their ride sharing service before UberX. So don't take credit for Lyft's existence.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#340

Post by clementine95 »

wallace_f wrote: post #293
knowaveragejoe wrote: post #275

Earlier quoted context omitted.

This is news to me, I've never come across an average person having a negative opinion of Musk. On the contrary they think of him as some iron-man like figure.

How many people do you know that listen to Rush Limbaugh or read Breitbart? Apparently none. Personally, I like him quite a bit, but to be fair I know that outside of my own echo chamber of my news and social media feeds, that there are a lot of people who don't like him, and where that negativity is coming from.

He also gets a lot of heat in leftist circles for his anti-union tactics & rhetoric.
Post reply on HN