News for hackers. Stuff that matters.
Re:Uber employees used the platform to stalk celebrities and... by mwfj on Monday December 12, 2016 @10:25PM (#13164189)
This seems like a good place to tell Uber users that the only way of removing your credit card details from your Uber account is to either:

a) plead with Uber's customer service to do so

or

b) add another payment method (like another credit card)

This, of course, is horribly bad practice. I can only imagine that they arrived at this very peculiar arrangement after extensive A/B testing - Uber has hired plenty of FB folks and those people tend to be really into that kind of thing. I haven't seen this kind of outright customer-hostility from a large Internet company.. well, ever, before.

So, no, I'm not surprised that this company is doing other unethical things - it sort of seems interwoven into their DNA.

Re:Uber employees used the platform to stalk celebrities and... by angry-hacker on Tuesday December 13, 2016 @08:21AM (#13166542)
Another way I discovered by accident: Add paypal, remove cc, revoke PayPal from its own settings. PayPal is left there buy there is no way to charge you anymore.
Re:Uber employees used the platform to stalk celebrities and... by eeeeeeeeeeeee on Tuesday December 13, 2016 @07:34AM (#13166308)
I uninstalled Uber after it wanted to track my location before and after using the app. That wasn't the only reason, but it was the final straw. As much as I loathe using taxis, I'm actually more annoyed with Uber and their business practices.
Re:Uber employees used the platform to stalk celebrities and... by dominotw on Tuesday December 13, 2016 @12:04AM (#13164598)
>So, no, I'm not surprised that this company is doing other unethical things - it sort of seems interwoven into their DNA.

Grubhub refused to delete my account even after pleading with them to do so many many times. To me seems like a general tech company trend not something specific to uber.

Re:Uber employees used the platform to stalk celebrities and... by robrenaud on Tuesday December 13, 2016 @12:18AM (#13164661)
Is it legal to refuse to delete a users account?
Re:Uber employees used the platform to stalk celebrities and... by curryhowardiso on Tuesday December 13, 2016 @04:56AM (#13165721)
This is actually a great technical and legal question. And it depends a lot on the type of service you have, and which jurisdiction's law governs you and your service provider.

On the one hand, we have the EU's "right to be forgotten" actions against Google, which seem to be gaining ground and are essentially bona fide in their protection of the consumer/society, in the sense that it might be a good idea for other jurisdictions to adopt it as well.

But consider the EU (and worldwide) regulation of banking and transactional accounts. Particularly the prohibitions on money laundering and counter-terrorism funding (AML/CTF laws). You're not allowed to open and close a bunch of bank accounts, which means that you don't really have a "right to be forgotten" in this sense either. Nor, if you are not a "legit" user, should you be.

From a technical standpoint, how do you detect the law abiding citizens that want to close (in the sense of permanently deleting records) their account(s) from the malfeasant actors that want to launder money or fund terrorism by holding many accounts over time in order to obfuscate their transaction patterns.

It's an interesting question that the law -- and to a certain extent, the people -- have not yet got a good answer

Re:Uber employees used the platform to stalk celebrities and... by DanBC on Tuesday December 13, 2016 @07:37AM (#13166317)
RtbF is possibly not relevant here. More important would be the EU regulations on data protections. These say that companies must explain what data they're gathering and why they gather it; and that companies can only gather what they need; and only keep it for as long as they need; and that it must be accurate; and that customers have a right to see the data and to have corrections made.

But even the EU has exemptions and complications around data that's used to prevent crime.

Re:Uber employees used the platform to stalk celebrities and... by throwaway199128 on Tuesday December 13, 2016 @07:18AM (#13166234)
Google retaliates though by putting the reasons for removal on "chillingeffects.org". Chilling indeed that a company has no respect for privacy.
Re:Uber employees used the platform to stalk celebrities and... by smcl on Tuesday December 13, 2016 @06:07AM (#13166003)
I'm seeing a few replies suggesting that it varies between EU/US etc ... but either way it sounds like a REALLY effective way to piss off those customers and guarantee they'll never come back and use your service in future (or share such "horror" stories with their friends and relatives). I don't get why those companies would go out of their way to make things difficult for themselves in the long run
Re:Uber employees used the platform to stalk celebrities and... by johansch on Friday December 16, 2016 @12:56PM (#13195215)
(Sorry, late.)

These companies don't seem to tend to think long-term, at least not at this level. It's all about growth acceleration/hacking.

Re:Uber employees used the platform to stalk celebrities and... by andygambles on Tuesday December 13, 2016 @05:13AM (#13165789)
HMRC (UK Tax Office) requires us to keep transactional information for 6 years.

Upon request we delete accounts but if they have transactional data this is still held in accordance with our legal requirements.

Re:Uber employees used the platform to stalk celebrities and... by toyg on Tuesday December 13, 2016 @06:26AM (#13166053)
Transactional data surely does not have to include full card and address details though. That would contradict EU directives on sensitive data and privacy.
Re:Uber employees used the platform to stalk celebrities and... by andygambles on Tuesday December 13, 2016 @08:54AM (#13166727)
We do not keep any card data.

We have to keep address details to prove we have charged VAT correctly.

Re:Uber employees used the platform to stalk celebrities and... by erelde on Tuesday December 13, 2016 @02:43AM (#13165227)
I think in some countries companies/websites have to keep a trace of all accounts. So they don't really delete accounts, pretend they do and move them to another DB.
Re:Uber employees used the platform to stalk celebrities and... by taejo on Tuesday December 13, 2016 @04:00AM (#13165513)
Not in the EU.
Re:Uber employees used the platform to stalk celebrities and... by jbronn on Tuesday December 13, 2016 @12:25AM (#13164692)
Yes. Unless they said otherwise in their TOS.
Re:Uber employees used the platform to stalk celebrities and... by kbart on Tuesday December 13, 2016 @04:08AM (#13165546)
Actually, it depends on a country. For example, EU laws override ToS.
Re:Uber employees used the platform to stalk celebrities and... by JoshTriplett on Tuesday December 13, 2016 @04:51AM (#13165709)
Only for companies under EU jurisdiction.
Re:Uber employees used the platform to stalk celebrities and... by kbart on Tuesday December 13, 2016 @05:08AM (#13165772)
Pretty much all bigger companies have subsidiaries in EU (Uber included), so they must obey EU laws too. I think it's only a matter of time when Uber will get sued for privacy violations.
Re:Uber employees used the platform to stalk celebrities and... by dominotw on Tuesday December 13, 2016 @01:02AM (#13164851)
thats what i assumed too. they outright told me that they won't delete my account. Instead they sent me bunch of these totally irrelevant emails to me( probably just made a false assumption due to the timing)

"Thank you for reaching out and providing us with the opportunity to clarify. We welcome and accept employees with all political beliefs at Grubhub, no matter who they voted for in this or any election. We do not discriminate on the basis of someone's principles, or otherwise. The message was intended to advocate for inclusion and tolerance -- regardless of political affiliation -- during this time of transition for our country.

Thank you, Grubhub"

Re:Uber employees used the platform to stalk celebrities and... by bigmofo on Tuesday December 13, 2016 @03:13AM (#13165336)
When you lose your credit card and you call your credit card company and them them that you lost it, they issue you a new card with new numbers; this way anybody that had the information on the card would not be able to make further transactions. I would consider the card lost when a company would not delete the credit card information on my request to delete the information.
Re:Uber employees used the platform to stalk celebrities and... by singlow on Tuesday December 13, 2016 @03:36AM (#13165428)
A new number doesn't necessarily prevent charges from vendors who had the old one. For your convenience the banks actually allow new charges on the old cards after they are cancelled. I assume they whitelist vendors that have good reputations or filter based on patterns of charges against your account which you have not disputed.

Verizon was able to charge against my old account for over a year. I kept getting snail mail letters from my bank telling me that the card I was using had been cancelled and that I needed to update it, but I kind of just wanted to see how long they would let it go.

In other cases, the bank will actually update the vendor with your new card number so that subscriptions are not interrupted.

Re:Uber employees used the platform to stalk celebrities and... by ranman on Tuesday December 13, 2016 @04:39AM (#13165678)
>In other cases, the bank will actually update the vendor with your new card number so that subscriptions are not interrupted.

That's apparently a feature: https://usa.visa.com/dam/VCOM/download/merchants/visa-accoun...

Re:Uber employees used the platform to stalk celebrities and... by cm2187 on Tuesday December 13, 2016 @07:03AM (#13166177)
Even if it is stolen? This thing is massively dangerous. It ensures your credit card details are stored all over the place for them to be leaked or stolen, with no way for the consumer to clean this up.
Re:Uber employees used the platform to stalk celebrities and... by brianwawok on Tuesday December 13, 2016 @07:55AM (#13166418)
In theory they would make sure it was an account you used before the theft.
Re:Uber employees used the platform to stalk celebrities and... by cm2187 on Tuesday December 13, 2016 @08:06AM (#13166466)
Yeah but letting services expire with the credit card unless you still use them is not a bad way to get rid of all the services you subscribed thinking it could be useful but never used.

Reminds me of what was done in the military (I think it was in a European country). Officers were spending their time writing reports that were never read. They introduced a policy under which for a given time everyone should stop writing reports until someone complained that they were not receiving it. And if that didn't happen this type of report would be scrapped.

Re:Uber employees used the platform to stalk celebrities and... by zeven7 on Tuesday December 13, 2016 @09:12AM (#13166852)
Hmm, I feel like in my job I write a lot of things that no one ever reads (issue notes, extra commit information, comments) with the expectation that it'll be helpful information if I or someone else ever does need to look to figure out why I did something.

And it has been helpful. I mean maybe about 1% of it is read later at some point and helps clarify a situation. 99% of it is never seen again. That 1% of the time it's really helpful to have it.

Re:Uber employees used the platform to stalk celebrities and... by bigmofo on Wednesday December 14, 2016 @12:00AM (#13173969)
That is pretty screwed up. So, you have a merchant that is stalking one and they get updated information.

I think I will stick with with the new next gen taxi service where one pays with cash.

Re:Uber employees used the platform to stalk celebrities and... by warcode on Tuesday December 13, 2016 @06:14AM (#13166020)
If you report it as stolen and ask for it to be blocked that will stop all transactions on it.

If it expires or you get a new card in a normal flow it can be charged further.

Re:Uber employees used the platform to stalk celebrities and... by bigmofo on Tuesday December 13, 2016 @11:54PM (#13173943)
I have done this. Yes, they initial did keep the subscription going. However, I told the credit card company that I did not authorized any further; they reversed everthing out. I really wonder whether they give the company the new information or whether they just allow authorization using the old numbers; seems like it is pretty screwed up security if they give the new information to the company.

Also, if you say: - Card was lost. - After reviewing all accounts, it was discovered that the CC information couldn't be deleted from the ubuer UI. - I hereby do not authorized uber to make any charges. - tell them in writing or record the conversation.

I don't see any way uber can make any valid charges against your account (assuming no more action on one's part).

I also wonder whether it follows CC guidelines/rules to keep CC information when the customer has explicitly tried to remove and communicated to the company to remove said information.

Re:Uber employees used the platform to stalk celebrities and... by bogomipz on Tuesday December 13, 2016 @08:47AM (#13166697)
>"For your convenience the banks actually allow new charges on the old cards after they are cancelled."

I have not heard this before. My bank certainly doesn't do this and its a major bank. I actually proactively ask for new cards periodically so that the old ones are no longer valid.

Re:Uber employees used the platform to stalk celebrities and... by jlgaddis on Tuesday December 13, 2016 @07:30PM (#13172722)
Yep, AmEx for example will provide vendors with the new numbers, expiration dates, etc., when your card expires and they issue you a new one.
Re:Uber employees used the platform to stalk celebrities and... by Havoc on Tuesday December 13, 2016 @12:09PM (#13168385)
The old card details still stay live depending on how they issue the new card.

Currently have two Amex cards with different numbers that show up as 1 card on their online portal & get treated as one.

Re:Uber employees used the platform to stalk celebrities and... by manyxcxi on Tuesday December 13, 2016 @07:58AM (#13166434)
I don't have any financial stake in them, I'm just a pleased patron, but it's this stuff that had me leaping to be an early adopter of Final[0].

Flat out, it's a credit card- but with their site or app you can generate single use numbers and CV2, or you can generate merchant locked numbers for things like Uber. There's a lot more they offer, but those two things are what I got it for and how I use it.

[0] https://www.getfinal.com

Re:Uber employees used the platform to stalk celebrities and... by SippinLean on Tuesday December 13, 2016 @09:38AM (#13167044)
Some caveats being an industry-low cash back (1%) and they charge an annual fee after the first year. Another alternative is to check with your current CC company, many already offer single-use numbers.
Re:Uber employees used the platform to stalk celebrities and... by Xcelerate on Tuesday December 13, 2016 @08:40AM (#13166654)
Any quicker way to get that than waiting for 354,000 people to get it first?
Re:Uber employees used the platform to stalk celebrities and... by mszkoda on Tuesday December 13, 2016 @08:52AM (#13166716)
Some banks offer a similar service on their credit cards. I know BoA has one called ShopSafe[1] and I'm sure there are others.

[1]https://www.bankofamerica.com/privacy/accounts-cards/shopsaf...

Re:Uber employees used the platform to stalk celebrities and... by mikehollinger on Tuesday December 13, 2016 @09:09AM (#13166829)
Citi offers a one time use credit card number feature on some of their account types and has done so for quite some time.
Re:Uber employees used the platform to stalk celebrities and... by vitobcn on Tuesday December 13, 2016 @09:11AM (#13166843)
I believe this is what https://privacy.com/ does as well without the wait time.
Re:Uber employees used the platform to stalk celebrities and... by llukas on Monday December 12, 2016 @11:03PM (#13164340)
LOL. That's why some banks have option to generate CC numbers on the fly and tying those numbers to particular vendor.
Re:Uber employees used the platform to stalk celebrities and... by johansch on Monday December 12, 2016 @11:07PM (#13164353)
That is exactly what I ended up using (to create a second "payment method" with limited funds so that I could delete the real one).

But still, this is not something that I expect to have to stoop to when dealing with an Internet company valued at ~$68B.

Btw: This is what you get when you try to delete the first (and last) valid payment method:

http://i.imgur.com/Y4PEOS4.png

Re:Uber employees used the platform to stalk celebrities and... by mbreedlove on Monday December 12, 2016 @11:34PM (#13164459)
Who still does that? I know American Express used to offer one-time CC numbers, but no longer does.
Re:Uber employees used the platform to stalk celebrities and... by techsupporter on Monday December 12, 2016 @11:59PM (#13164570)
I have a credit card called Final VISA that does it as their main feature. (Signed up for it from here on HN; it's OK.)

Another company, Privacy.com, does on-the-fly numbers as debit cards drafting from your bank account.

Re:Uber employees used the platform to stalk celebrities and... by thasaleni on Tuesday December 13, 2016 @03:25AM (#13165381)
Such a shame that Privacy.com app is country locked, I'm from South Africa and would definitely use something like this
Re:Uber employees used the platform to stalk celebrities and... by fgandiya on Monday December 12, 2016 @11:49PM (#13164529)
Bank of America does. Only for credit cards though.
Re:Uber employees used the platform to stalk celebrities and... by cookiecaper on Monday December 12, 2016 @11:58PM (#13164564)
I know Discover offered it about ten years ago (saw a friend use it). I don't know if they still do. Always thought it was a cool feature and wanted a card that would allow it, but up to this point I don't think any of mine do.
Re:Uber employees used the platform to stalk celebrities and... by dtparr on Tuesday December 13, 2016 @12:33AM (#13164730)
Discover stopped offering them a few years back. At one time I had three cards that had this option and they all slowly stopped, basically saying their fraud detection was good enough the extra trouble wasn't worth it for them.
Re:Uber employees used the platform to stalk celebrities and... by mszkoda on Tuesday December 13, 2016 @08:53AM (#13166726)
Re:Uber employees used the platform to stalk celebrities and... by kgrin on Tuesday December 13, 2016 @12:32AM (#13164725)
Certain Citibank cards (not all though)
Re:Uber employees used the platform to stalk celebrities and... by kalleboo on Tuesday December 13, 2016 @04:58AM (#13165734)
My bank in Sweden supports it for their MasterCard debit cards
Re:Uber employees used the platform to stalk celebrities and... by panda88888 on Tuesday December 13, 2016 @12:32AM (#13164728)
My Citibank MasterCard provides one-time use CC number.
Re:Uber employees used the platform to stalk celebrities and... by grey-area on Tuesday December 13, 2016 @07:34AM (#13166307)
Google Adwords do this, and vultr.com do it as well. I agree it's really user-hostile and a dark pattern to allow users to enter payment details and then refuse to delete them.

I don't want to leave my credit card details on the servers of hundreds of companies, or allow them to charge at will, but it's obvious why from the companies point of view why this is attractive.

Re:Uber employees used the platform to stalk celebrities and... by johansch on Friday December 16, 2016 @12:53PM (#13195190)
At least Adwords is a mostly B2B service. Google doesn't do this on their consumer-focused services.
Re:Uber employees used the platform to stalk celebrities and... by JumpCrisscross on Monday December 12, 2016 @11:24PM (#13164421)
the only way of removing your credit card details from your Uber account is to...

You could also ask them to delete your account and certify that all PIO and payment information has been purged. Depending on your state if residence, there may be other things you can ask for.

Re:Uber employees used the platform to stalk celebrities and... by ibejoeb on Tuesday December 13, 2016 @02:37AM (#13165202)
I was recently unsettled when I installed Lyft on a new phone after a pretty long lapse. Sure enough, with no verification of any kind, my credit card information was still there. Apparently it is keyed to the phone number. Insane.
Re:Uber employees used the platform to stalk celebrities and... by lostlogin on Tuesday December 13, 2016 @02:56AM (#13165283)
Crumbs. Are numbers in the US recycled as quickly as they are here in New Zealand?
Re:Uber employees used the platform to stalk celebrities and... by dalyons on Tuesday December 13, 2016 @03:11AM (#13165328)
Yes, typically within 30 days
Re:Uber employees used the platform to stalk celebrities and... by fencepost on Tuesday December 13, 2016 @09:33AM (#13167001)
Phone number or Google / iCloud account? Pretty sure Lyft wants identification permission.
Re:Uber employees used the platform to stalk celebrities and... by firloop on Monday December 12, 2016 @11:19PM (#13164404)
Airbnb works the same way with credit cards.
Re:Uber employees used the platform to stalk celebrities and... by ars on Tuesday December 13, 2016 @02:55AM (#13165282)
Just use an online credit card number generator to put in a random number. Also see if you can use a test number (there are lists online).
Re:Uber employees used the platform to stalk celebrities and... by kakarot on Tuesday December 13, 2016 @03:04AM (#13165309)
Great short-term solution, bad long-term solution.
Re:Uber employees used the platform to stalk celebrities and... by ars on Tuesday December 13, 2016 @03:05AM (#13165311)
Why? If someone tries a charge it'll get rejected since the name and expiration date won't match (unless you get crazy [un]lucky).

Just change it to that and never use it.

Re:Uber employees used the platform to stalk celebrities and... by kakarot on Tuesday December 13, 2016 @06:37PM (#13172353)
It doesn't solve the problem of Uber's Dark UI tactics, and it's a fend-for-yourself solution that leaves behind the less savvy majority of users.
Re:Uber employees used the platform to stalk celebrities and... by paublyrne on Tuesday December 13, 2016 @03:26AM (#13165386)
Is there any concern that in doing this you're exposing yourself to accusation of attempted fraud?
Re:Uber employees used the platform to stalk celebrities and... by dmichulke on Tuesday December 13, 2016 @04:22AM (#13165594)
"Oh, I must have accidentally mistyped a few digits, however, since I don't intend to use your service anymore, you can just delete it"

"Well, I cannot delete it"

"Oh, well, thanks, good bye"

Re:Uber employees used the platform to stalk celebrities and... by tomsthumb on Tuesday December 13, 2016 @03:33AM (#13165416)
One the one hand you /do/ want them to believe the fake is your cc number, but on the other hand you /don't/ intend they charge the number.
Re:Uber employees used the platform to stalk celebrities and... by pyrale on Tuesday December 13, 2016 @03:15AM (#13165344)
I would be surprised to learn that method b actually deletes any information from Uber's db.
Re:Uber employees used the platform to stalk celebrities and... by briceb8e on Tuesday December 13, 2016 @02:53AM (#13165276)
Set Paypal as payment method, then close Paypal account.
Re:Uber employees used the platform to stalk celebrities and... by Hilyin on Tuesday December 13, 2016 @01:22AM (#13164949)
try changing your card's expiration date to an expired date, this has worked for me in other situations like this
Re:Uber employees used the platform to stalk celebrities and... by paulmd on Tuesday December 13, 2016 @09:42AM (#13167064)
Credit card vendors with a high reputation score have extraordinary powers.

During the credit card auth they are told whether the expiration, CVV, and ZIP code match and they can choose to accept the charge even if they do not match, although they do so at some additional risk of the charge being flagged/reversed. They can even charge expired and cancelled credit cards as well.

Expiration/CVV/ZIP checking are an additional security layer but they are there for the merchant, not for you. A credit card number is all a merchant actually needs to make a charge.

> Most consumers think their credit card expiration dates -- the month and year in which their cards are supposed to be renewed -- are a sacrosant security feature, without which a business can't process a payment.

> In fact, big players in the U.S. consumer-sales industry have developed informal agreements with credit-card issuers that allow charges to be made to consumers' credit cards without specifying the expiry month and year. This procedure works even after an individual's card has expired and been re-issued with a new expiration date.

http://www.datamation.com/columns/executive_tech/article.php...

Re:Uber employees used the platform to stalk celebrities and... by johansch on Tuesday December 13, 2016 @01:25AM (#13164960)
Trying to do that: "An error occurred trying to fulfill your request".
Re:Uber employees used the platform to stalk celebrities and... by dharmon on Tuesday December 13, 2016 @02:47AM (#13165247)
Change it to expire this month and wait a few weeks?