Former employees say Lyft staffers spied on passengers

Re:Former employees say Lyft staffers spied on passengers by ryacko on Thursday January 25, 2018 @06:14PM (#16235650)

https://danluu.com/wat/ apparently this is normal: Facebook famously let all employees access everyone’s profile for a long time, and you can even find HN comments indicating that some recruiters would explicitly mention that as a perk of working for Facebook. And I can think of more than one well-regarded unicorn where everyone still has access to basically everything, even after their first or second bad security breach. It’s hard to get the political capital to restrict people’s access to what they believe they need, or are entitled, to know. A lot of trendy startups have core values like “trust” and “transparency” which make it difficult to argue against universal access.

[ Parent | on HN ]

Re:Former employees say Lyft staffers spied on passengers by fooblitzky on Thursday January 25, 2018 @06:32PM (#16235767)

It doesn't need to be normal. There's no reason companies couldn't build a system that required approval from your manager before being able to access customer data. Any time a manager granted access, that could be audited by some second tier.

[ Parent | on HN ]

Re:Former employees say Lyft staffers spied on passengers by cwkoss on Thursday January 25, 2018 @10:06PM (#16236749)

"Okay, stay on the line. My manager went to the bathroom 15 minutes ago, he should be back any minute, and then we can proceed with..."

After-the-fact accounting for all 'sensitive' actions would probably be more practical for most business needs.

I'd put a wizard in front of the thing that grants the access token to figure out the purpose and scope of the token needed.

Information request: "Rider History"

User: current caller

Scope: Between 9 AM and 11AM today

Reason: Lost an item this morning, need to lookup driver

If you were fancy you might even be able to convert the wizard's contained information into a request against the backend. Select trip.driver, trip.time from trips where user_id={caller_user_id} and time={9:00-11:00 today}

[ Parent | on HN ]

Re:Former employees say Lyft staffers spied on passengers by sbov on Thursday January 25, 2018 @07:55PM (#16236211)

It actually seems easy to argue against: the company might trust me, but surely not all the customers trust every employee. You're simply putting the customers first.

[ Parent | on HN ]

Re:Former employees say Lyft staffers spied on passengers by anfedorov on Thursday January 25, 2018 @08:17PM (#16236306)

> I can think of more than one well-regarded unicorn where everyone still has access to basically everything

Hard to be sure, but GitHub support signed up for a friends-only beta of one of my products before I had told anyone outside my immediate circle about it.

[ Parent | on HN ]

Re:Former employees say Lyft staffers spied on passengers by matte_black on Thursday January 25, 2018 @07:32PM (#16236112)

What Unicorns would those be?

[ Parent | on HN ]