A few days ago (on the discussion of the Uber app tracking users' movements after the end of their ride) an Uber employee commented on their data handling: [0]<p>> Individual users' data is very closely guarded internally. It's immensely difficult to look at user data without specific access. Overwhelmingly, this data is queried in aggregate and fed into machine learning systems. The risk of abuse is exceptionally low.<p>Obviously this doesn't add up. What gives?<p>[0] <a href="https://news.ycombinator.com/item?id=13085775" rel="nofollow">https://news.ycombinator.com/item?id=13085775</a>
> Uber would not give more details on its technical controls. In practice, the security sources said, Uber’s policy basically relies on the honor system. Employees must agree not to abuse their access. But the company doesn’t actually prevent employees from getting and misusing the private information in the first place, the security sources said.<p>If true, that is fantastically ludicrous.<p>It seems I wasn't paying attention, in 2014 - as this "God view" news passed me by. I will be keeping a closer eye on this as it plays out.<p>Uber obviously seems to be in a strong position, but going only by this article, Uber might fare poorly in a multi-region privacy-legislation legal battle (war?).
This seems like a good place to tell Uber users that the only way of removing your credit card details from your Uber account is to either:<p>a) plead with Uber's customer service to do so<p>or<p>b) add another payment method (like another credit card)<p>This, of course, is horribly bad practice. I can only imagine that they arrived at this very peculiar arrangement after extensive A/B testing - Uber has hired plenty of FB folks and those people tend to be really into that kind of thing. I haven't seen this kind of outright customer-hostility from a large Internet company.. well, ever, before.<p>So, no, I'm not surprised that this company is doing other unethical things - it sort of seems interwoven into their DNA.
Don't forget that Uber now requires you allow them to access your location, even when you aren't using their app [1].<p>Side note: consider the value to foreign (or domestic) intelligence agencies of this weakly-guarded pot of gold.<p>[1] <a href="http://www.theverge.com/2016/11/30/13763714/uber-location-data-tracking-app-privacy-ios-android" rel="nofollow">http://www.theverge.com/2016/11/30/13763714/uber-location-da...</a>
I've begun to ditch apps that I've perceived as going downhill regularly, and its been working out pretty well. Uber, Youtube, Facebook/Instagram, and Twitter have decent mobile sites.<p>I can even silo whatever service I want into its own browser to limit tracking, and all location/permissions/etc are all sandboxed by the browser.<p>A huge bonus is battery life + ad blocking.
This article merely re-reports this source: <a href="https://www.revealnews.org/article/uber-said-it-protects-you-from-spying-security-sources-say-otherwise/" rel="nofollow">https://www.revealnews.org/article/uber-said-it-protects-you...</a><p>Mods should probably change the OP to link there.
Let me ask a question of everyone complaining: why not use Lyft? I switched.<p>Yeah, their prices are a little more than uber's, and their wait times are a bit higher, but these are functions of scale.
I seriously don't understand why the updated Uber app asks to access my location all the time -- as opposed to only when I'm using the app. Not only is it not required but it's a huge drain on the phone's battery, potentially decreasing the battery's life.<p>Now I'm from a third-world country and can't afford to buy a $1000 phone every year, so I have to be careful with the life of my phone.<p>The turnaround this, I found, is to disallow location to the Uber app when not using the app and allowing access only when I use the app. This, however, is a pain and the Uber app behaves weird if I do so (the previous trip does not end after hours of it actually ending).<p>Very poor UX from Uber, potentially dangerous, definitely unethical. This is definitely a trend -- startups start with being caring of its customers, but once they grow big, they become callous and even malicious when it comes to users (I don't ask of them to give every customer personal support, but not mis-using customers is the least I can expect).
Operationally, "God Mode" doesn't need to show who the passenger is. It's reasonable to have info about where all the cars are and their status and destination available to everyone involved with dispatching, but passenger identity? Sloppy.<p>Do they still have "Ride of Glory" detection?
I think it's time for the government to give you as many names as you want to give out to companies, and there's no reason for anyone who isn't suing you for it to know which of your aliases go together. Also aliases should be shared, to further conflate things. (nothing should stop my friends and i from sharing an alias and persona - companies should be legally forced to bend over backwards and enable this, for everyone. For example Google should be legally forced to allow you to create a new gmail inbox with a new name in a single click and not have it tied on any way to the old name.) Also credit card companies should be forced to give you as many cards in whatever names that you ask for. Nobody who isn't suing you should have a right to know your true name. They shouldn't even have it on record. If they wanna know something about you, they should ask you.<p>It works for writers, celebrities, etc - why not the rest of us.<p>EDIT to clarify: this is a serious comment, you can read it literally.
Creating an audit system and locking down "God" mode seems like something that would save Uber a lot of major headaches down the road. How often do Uber employees need to legitimately track someone's information other than in response to a customer request? I'm guessing about as often as the average Google employee needs access to a specific user's search history, which is to say, fairly rarely.<p>Without locking down such access, you get incidents like these (and this was even when Google purportedly had strong auditing): <a href="http://www.pcmag.com/article2/0,2817,2369188,00.asp" rel="nofollow">http://www.pcmag.com/article2/0,2817,2369188,00.asp</a><p>> <i>Google this week confirmed that it fired an engineer who accessed the Gmail and Google Voice accounts of several minors and taunted those children with the information he uncovered.</i><p>The public sector has its fair share of these too: <a href="http://articles.orlandosentinel.com/2013-01-22/news/os-law-enforcement-access-databases-20130119_1_law-enforcement-officers-law-enforcers-misuse" rel="nofollow">http://articles.orlandosentinel.com/2013-01-22/news/os-law-e...</a><p>Here's a URL to the plaintiff's declaration: <a href="https://www.documentcloud.org/documents/3227535-Spangenberg-Declaration.html" rel="nofollow">https://www.documentcloud.org/documents/3227535-Spangenberg-...</a><p>Lots of tidbits there...including how all payroll information is apparently contained in an "unsecure Google spreadsheet"
Can't wait for a class-action lawsuit.<p>This is precisely why it makes sense to keep database data encrypted even to admins and why it makes sense for ride-sharing companies to be co-operatives or non-profits.<p>Profit-seeking companies engage in bad behaviours all the time.
"stalk celebrities and their exes"
sounds to me like it could mean:<p>- stalk celebrities, as well as the exes of said celebrities<p>- employees stalk their exes and also some celebrities<p>It's obviously the latter but couldn't the same sentence imply the former as well? Is their a better way to formulate this sentence in a non-ambiguous way?
I've switched to using the mobile site[0] now Uber wants to track my location 'Always' on iOS.<p>[0] <a href="https://m.uber.com" rel="nofollow">https://m.uber.com</a>
I think there is a need to regulate how data is used in internet companies. I mean there is the same need for NSA and surveillance, but I'm much more anxious about how a company can be irresponsible compared to a federal agency.<p>Every time you have customer's information, the people responsible for giving access to that data should be held responsible...
I wonder what it's like working for Uber and hearing this story. I imagine people form into two camps, with one doubling down their loyalty to the company (which could be properly placed for all we know), and another that becomes a little more suspicious walking into work next time.
The internet can really blow things out of proportion.<p>1980's: long distance company has employee(s) poking around messaging system and sells to newspaper. Few know. All voice over network is stored "searched" for "key" phrases. Very few know. Moreover there are no blogs or places to tell ones story.<p>Now one little confessional outing becomes widespread and thus assumed to be happening all the time.<p>I am sure (without facts) that uber is no worse than AT&T back in the day but now so so so many people can read and tell their stories.<p>Does anyone really think or expect communication via electricity is truly protected?
Can we make the rule that it's not OK to post negative stories about YCombinator companies on this site?<p>There are a million places to talk negative about everyhing. Here, we're trying to build things. We know no one is perfect. Lets make this place a bastion of positivity instead of negativity.
> Reveal reports that Uber also changed the name of that tool [from "God View"] to "Heaven View."<p>What a useless change just for the sake of being politically correct. Are companies going to start removing "God Mode" from video games and calling it "super mode"? Seems crazy they would muck with naming to be PC even for internal tools