20 ms·

Didn’t Homejoy Shut Down?

• ericsidelis 11y ago
  The fact that I can still log in is scaring me, I never signed up for this and nor did I even get an email. My credit card details which are valid are still present. I find it hard to believe this information was sold and if it was, were they storing credit card info in plain string format. Wouldn't each of those businesses need an encryption key to decrypt secure card numbers. Wonder if they sold that too. Either way props to John for posting this on Medium and of course Aloke on HN.
  • grossvogel 11y ago
    Third party processors will store the card info securely and then provide only parts of it back to you via an API call. Stripe's API includes the last 4 and expiration date, as you can see here[1], so Fly Maids may not have all of that data. [1] https://stripe.com/docs/api#cards https://stripe.com/docs/api#cards
• rathboma 11y ago
  You might want to obfuscate the last 4 digits of your credit card in that screenshot given how useful it is for hacking other systems.
  • ccallebs 11y ago
    Yeah, his expiration date (if correct) is on there too.
  • johnsalzarulo 11y ago
    Card's already canceled. Thanks though.
    • Blaaguuu 11y ago
      I don't think that rathboma was suggesting that you might get fraudulent changes on the card - but any other service that you use which currently has that card on record could now potentially be compromised by anyone who knows your name and has those 4 digits - many customer support systems only need that much to verify your identity and make changes to your account.
    • thaumaturgy 11y ago
      Do all of the online services you use also no longer use the last four of that card for authentication purposes over the phone? For instance, you can sometimes use the last four of the card on a GoDaddy account to get a password reset over the phone.
    • lemevi 11y ago
      Doesn't matter, it's still confidential information that can be used to verify you or used to social engineer more information about you. "Hi sir, I'm calling in because I lost access to my account, I don't have my current card, but I do have the last 4 of my previous that I used on this service, will that be good enough?" Like don't reveal unnecessary information if you don't have to. It's low effort, high risk.
      • vladd 11y ago
        You should read: http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ >> It turns out, a billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account. Once supplied, Apple will issue a temporary password, and that password grants access to iCloud. << [Apple may have changed their policy meanwhile, but likely others did not]
    • cbhl 11y ago
      Some banks allow charges through to cancelled cards -- beware!
      • nommm-nommm 11y ago
        Hrm I've never heard of this apart from automatic billing systems ability to request the new card number. Any more specific info about that? I'm interested in how this is possible.
        • Blaaguuu 11y ago
          I know that when I canceled my American Express card, they said that they would keep the account open for an X amount of time (I wanna say ~1 year), and I would be responsible for any charges during that period, and billed normally. However that was a case of canceling because I was just closing the account - not because of fraud... I assume they have different processes.
• pavornyoh 11y ago
  Yeah, it looks the same with little tweaks. My question is did those magazines feature flymaids as they are stating? EDIT: The site looks the same and that is a clear fraud hence my question.
  • kajecounterhack 11y ago
    According to the article, no.
    • pavornyoh 11y ago
      That's a bit brazen to make those claims on the site. They can get into trouble for that and also ruin their own reputation. So I am thinking the site is a little joke? When you click on help and go to FAQs, it labels questions as "HOT". I think it is a joke.
      • revelation 11y ago
        Did you notice they literally copied their competitors site? Testimonials are the least of their worries.
        • pavornyoh 11y ago
          Yeah, I did. This is not good.
        • jpatel3 11y ago
          User of private data is really concerning. How easy someone can take liberty of using the private data for a ride :( When I read the post about someone go crazy to protect their data and communication, I feel they need to have little faith in fellow people. But this kind of instance move my confidence and make me think that we are racing against time and we will see more and more kind of this situations.
      • pziddy 11y ago
        They didn't claim they were featured. They simply displayed the logos. Lots of affiliate marketing sites do the same thing. I'm not defending the practice of course.
• livejamie 11y ago
  My old Homejoy login doesn't work on that site, and doing "forgot your password" gives an error of "user does not exist" for the email I used with Homejoy.
  • kornish 11y ago
    They're probably not porting over accounts by default, but rather waiting for users to express interest by clicking the link in the marketing email. From the original post: > Worst still, as I navigated around the site I realized the email link I clicked logged me into “My Account”. This screen had lots of my personal information, home address, email, even my credit card number.
    • chris_wot 11y ago
      So hold on... If we can work out how they encoded those activation URLs, or someone intercepts the email then they can get full access to anyone's account? I have zero sympathy for HomeJoy. They failed, which is something I can gave sympathy for. But they sold all their customer's private data without notifying them of this fact, and caused major security concerns in the process!
      • pavel_lishin 11y ago
        We don't actually know what happened here. It could have been just one founder doing something shady; it could have been a hack; it could be something we can't imagine yet. Let's not break out the pitchforks until we know who to point them at.
        • deleted 11y ago
          [deleted]
        • chris_wot 11y ago
          Actually, I'm breaking out the pitchforks. One of the requirements for PCI compliance is that you do NOT hold credit card data for any longer than absolutely required. Given HomeJoy was not doing any more billing of credit cards, these should have been removed from their system.
• martin_ 11y ago
  They may still be compliant and storing your credit card responsibly, I would assume they used Stripe or similar and they're only sending the last 4 digits back over standard http. If they're allowing you to add a new card, then there's an issue.
  • nathancahill 11y ago
    Yep, exactly right.
• marrone12 11y ago
  Looking like they sold their customer data over to fly maids or whoever was behind them. Surprised they were able to actually transfer the CC info. When I was at a company that was selling off assets, the most we could do was give them customer email addresses. I have serious doubts about the legality of this.
  • johnsalzarulo 11y ago
    That's what I thought too!
  • joshstrange 11y ago
    The site was just registered earlier this month (Created Date: 2015-10-08) [0]. I wonder if this is just rebranding or if they sold the data... [0] http://whois.icann.org/en/lookup?name=flymaids.com http://whois.icann.org/en/lookup?name=flymaids.com
  • mikegirouard 11y ago
    This appears to be very plausible. Googling "Fly Maids, Inc" shows their terms and privacy pages w/last modified dates of 2013 and 2014 respectively. https://www.google.com/search?q=%22Fly+Maids,+Inc%22 https://www.google.com/search?q=%22Fly+Maids,+Inc%22
    • JoblessWonder 11y ago
      Except it looks like the domain was dropped on 1/17/2014 and then re-registered earlier this month. The domain's WHOIS info lists: Creation Date: 2015-10-08T04:34:58Z
  • ukyrgf 11y ago
    It's only the last four digits of the card number.
• aioprisan 11y ago
  This is completely appalling and a blatant ripoff of Handy. I hope they don't get away with this.
  • johnsalzarulo 11y ago
    It's the rip-off that put me over the top. I was so pissed I had to write the article.
    • lemevi 11y ago
      I'm pretty sure them having the details Homejoy promised wouldn't be accessible is a much bigger deal, at least for me it is. If they have it, who else does?
      • johnsalzarulo 11y ago
        It's sad, but I guess feel like my data isn't really secure anywhere.
        • fredkbloggs 11y ago
          It isn't. Used to be that two could keep a secret if one were dead. Still true, unless one is a corporation; they can never really die.
  • ascorbic 11y ago
    Search for "open the door to better days" and you'll find dozens of these Handy knock-offs.
  • cballard 11y ago
    Handy is a horrid, racist company. Don't feel sorry for them. http://thebillfold.com/2014/10/my-day-interviewing-for-the-service-economy-startup-from-hell/ http://thebillfold.com/2014/10/my-day-interviewing-for-the-s...
    • 11y ago
• FussyZeus 11y ago
  Oh that's not shady at all. Assuming all this is legal (I doubt it, but hypothetically) how is this a good marketing tactic? Having all this info already stored comes off as way more creepy than convenient as evidenced by the author of the article. And yeah, I can't see this being legal in a thousand years.
  • pavel_lishin 11y ago
    > Having all this info already stored comes off as way more creepy than convenient as evidenced by the author of the article. If you're used to thinking about this from our side of things, sure. For Random Person, they might think, "gee, this is neat! And they've already got my card number and everything!"
    • chris_wot 11y ago
      No, random person thinks what we all think: "how the hell did they get my credit card details?!?!"
• narsil 11y ago
  Their robots.txt [1] prevented archive.org's Wayback machine from crawling their Privacy Policy at https://www.homejoy.com/privacy https://www.homejoy.com/privacy I would have assumed that I'd be notified if sensitive information on Homejoy was sold to a third-party or "partner", but I should have probably read their privacy policy more closely when the shutdown notice came out. [1] https://web.archive.org/web/20151023153644/https://homejoy.com/robots.txt https://web.archive.org/web/20151023153644/https://homejoy.c...
• farmdawgnation 11y ago
  This site appears to be hosted on Heroku according to the DNS information. www.flymaids.com. 3600 IN CNAME cleanerconnect.herokuapp.com. cleanerconnect.herokuapp.com. 300 IN CNAME us-east-1-a.route.herokuapp.com. us-east-1-a.route.herokuapp.com. 60 IN A 23.21.224.165 Would the author have a case for emailing Heroku's abuse address and asking them to look into it or would this fall outside their purview? My hypothesis is that they'd want to know if their services were being used in a fashion that was creepy (for lack of a better descriptor).
  • myth_buster 11y ago
    Updated Date: 27-oct-2015 Creation Date: 08-oct-2015 They be baffled by the page views they be getting! Would this be considered as "any publicity is good publicity"?
• deleted 11y ago
  [deleted]
  • deleted 11y ago
    [deleted]
• cornellwright 11y ago
  Looks like the domain was registered on Oct 8th and I can't find "Fly Maids" or similar names on the Delaware Division of Corporations. (Maybe it takes longer for it to show up?) Either way super weird and creepy.
  • jball037 11y ago
    Any C-corp created in Delaware shows up their Entity Search (link below) almost instantly, e.g. within a few minutes of the company's creation. That said, I looked on the Fly Maids webpage and they don't give the name of their corporation at all, they just show "© 2015 Fly Maids. All rights reserved." That means that "Fly Maids" could be a trademark, a fictitious name, owned by a corporation with a different name, or just owned by any random individual who hasn't registered his/her business. Another possibility is that Fly Maids is in fact registered as a corporation or LLC, but in a state other than Delaware. Yet another possibility is that "Fly Maids" is a fictitious name, and those are generally registered at the county in which they operate, and searching through each county's database would be an enormous task. My point is: in any of the above cases it could be nearly impossible to figure out who is actually running this website. And failing to find a result in the Delaware Division of Corporations website really doesn't tell you much of anything. And, as a relevant tangent: If you are really interested in finding out who owns/runs that website you could always sue Fly Maids. GoDaddy explicitly states in their Ts and Cs that they will give up owner information if there is a lawsuit brought against the owner... ----- Delaware Division of Corporations Entity Search link... https://icis.corp.delaware.gov/Ecorp/EntitySearch/NameSearch.aspx https://icis.corp.delaware.gov/Ecorp/EntitySearch/NameSearch...
    • JoblessWonder 11y ago
      As mentioned above, they don't exist or are lying. Likely the former. Their privacy page claims to give you exactly what to search for: > In the USA/rest of the world (excluding the European Union), we are Fly Maids, Inc. (doing business as Fly Maids), a Delaware corporation with our head office at 2711 Centerville Road, Suite 400, Wilmington, New Castle County, Delaware 19808. http://www.flymaids.com/privacy http://www.flymaids.com/privacy
• swang 11y ago
  Biggest thing is that CC info still being on there. That is grossly irresponsible. Not that I approve ripping people off, but hard to sympathize with Handy when Handy treats (treated?) its employees and workers poorly. As for the whole transferring over of assets without any secure certs, that's pretty shady and/or lazy not doing that. Cue someone from said company posting, "oh sorry we're not ready for public and that accidentally got sent" without mentioning why they even have the author's data or why the author's credit card data was apparently sold off.
• thaumaturgy 11y ago
  What's the big deal? Homejoy is just hacking startup downfunding... (/s) I'd like to see some kind of stronger YC influence on ethics in the companies they fund. I realize that YC doesn't have any direct control over the companies, but it could be as simple as including good ethics in the traits they look for in startup founders. A while back I started compiling a list of YC companies that spammed or otherwise behaved badly. It quickly got back-burnered by other projects, but there was AirBnB from W09, InstallMonetizer and SocialCam from W12, Zenefits from W13, Abacus and GetAirHelp from W14, Gradberry and OmniRef from W15 ... while so far it looks like the majority of YC startups are well-behaved, the trend was looking like there's a few in every batch that are willing to do shady things to meet their growth metrics. Or, in Homejoy's case, maybe make a little more money while winding down.
  • JoblessWonder 11y ago
    Does YC officially offer any ethics training/mentoring? It would be an interesting offering even if there isn't any weight behind it. Sometimes I think the message, "Hey, maybe we should all think about what we are doing and whether or not it is in the best interest of something besides our bottom line" isn't something that is brought up/told to a lot of founders. However, whether or not they listen is totally up to them and I am fine with that.
  • gkoberger 11y ago
    YC makes it very clear they will disavow any company or founder that acts unethically. YC is strict about very few things, but this was made clear in no uncertain terms (especially by Jessica). When things go bad, YC always gets involved – even if you don't read about it online. Don't blame YC just yet. We don't know what happened here. Maybe Homejoy went into debt, had their assets seized, and lost control (like with GigaOM). Maybe the investors approved or forced a reincorporation under another name. Maybe Handy bought the assets and is quickly trying to stem off churn. Or, yeah, maybe something unethical happened. Until we know what happened, though, it's all speculation.
    • thaumaturgy 11y ago
      Is this a new policy? Because the company that prompted me to start the list, Zenefits, is still a Paul Graham darling: https://twitter.com/paulg/status/654377298234224640 https://twitter.com/paulg/status/654377298234224640 Or, might be that our definitions of unethical don't match up 100%. I consider spam to be unethical, maybe you just mean more serious offenses.
• nostromo 11y ago
  Everyone is assuming that the founders sold the company data to Fly Maids, a brand-new company nobody has ever heard of before. It's also possible one of the founders just spun up the new service themselves and copied over all of the customer records. If so, they may want to prepare to be sued by their previous investors. It's one thing to fail after giving it the good ol' college try, but it's another entirely to strip the copper out of the walls on your way out. Speculation aside, they should put out a statement to clarify the relationship between the companies and what's going on with their customers' data.
  • kornish 11y ago
    That was my first assumption as well - that one of the founders was continuing to work with the same idea under a different brand. Whoever it was, they clearly capitalized on the market opening left in Homejoy's wake. A quick whois flymaids.com yields Domain Name: flymaids.com Registry Domain ID: 1966895891_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.godaddy.com Registrar URL: http://www.godaddy.com Update Date: 2015-10-08T04:34:58Z Creation Date: 2015-10-08T04:34:58Z Registrar Registration Expiration Date: 2016-10-08T04:34:58Z Registrar: GoDaddy.com, LLC Registrar IANA ID: 146 Registrar Abuse Contact Email: abuse@godaddy.com ... Registrant Organization: Domains By Proxy, LLC ... The site was only created in the last 3 weeks, and it was registered by someone who wanted to stay anonymous (which is, in fairness, very reasonable - Homejoy cofounder or not. Certainly not enough to draw a conclusion).
    • wlesieutre 11y ago
      Domain registrars often include a year of "whoisguard" (namecheap's brand for it) or similar with new domain registrations. I'm never too surprised by that until it's been over a year. Or is Domains By Proxy a more significant anonymity system?
      • bduerst 11y ago
        They're all pretty much the same - just who is controlling it. Domains by Proxy is GoDaddy's version.
• yarou 11y ago
  Whomever is responsible for this should be blacklisted from receiving funding in the future. This is a really scummy move, and the person behind it should be publicly humiliated so that they understand the error of their ways.
  • deleted 11y ago
    [deleted]
• enraged_camel 11y ago
  I'm pretty sure I know what's going on. In order to pay off their debts, Homejoy must have sold user account information, including credit cards, to a bunch of local home cleaning businesses. A shit ton of them have been popping around over the past couple of years, modeled after the advice given in this subreddit: https://www.reddit.com/r/entrepreneurridealong https://www.reddit.com/r/entrepreneurridealong The difference with these local cleaning businesses is that they are developed and ran by amateurs, who often times copy each other (or the successful giants) down to the wording on the websites, with minor branding changes. They tend to be super low-budget, so Fly Maids probably paid some "web developer" $500 to develop their website and paid zero attention to security, PCI compliance, and so on. They then purchased a bunch of LA-based user accounts from the now-defunct Homejoy, who of course did not perform any due diligence. Shitty situation to be sure. I definitely lost respect for the Homejoy founders, and will probably stay away from their next venture.
  • djur 11y ago
    How is it possibly legal to sell credit card details to a third party?
    • geofft 11y ago
      It makes sense in many cases: when, say, Verizon Wireless acquired Alltel, an Alltel customer who has automatic monthly billing set up shouldn't be required to re-set up billing with Verizon, simply because it's a new company. It's not clear to me that the same intuition applies if the Alltel equivalent is shutting down because it was mismanaged, and the Verizon equivalent was created by one of the mismanagers and has no other assets, but it's hard for me to imagine there's a meaningful legal distinction.
  • gterrill 11y ago
    It seems to be a rather incestuous industry when it comes to original content: https://www.reddit.com/r/EntrepreneurRideAlong/comments/2zezxf/im_not_saying_that_launch27_is_about_to_become/cpj2x4a https://www.reddit.com/r/EntrepreneurRideAlong/comments/2zez...
• adamhardin 11y ago
  What is the full URL of the link in the email you received? You must save your login information in your browser, otherwise I assume you would have questioned how you logged into the site at all. It could be a phishing scheme that attacked your saved login information then placed that on a dummy site in hopes that you may provide even more data. EDIT: They could have sold / transferred user data... but I don't know how they would automatically authenticate you without using some previously stored data that you, maybe unknowingly, gave them access to.
• deleted 11y ago
  [deleted]
• gondo 11y ago
  as someone mentioned in the blog comment, Fly Maids site is a complete copy (with redesigned homepage) of another cleaning service http://www.homeaglow.com/ http://www.homeaglow.com/ @johnsalzarulo out of curiosity, try if your login works on homeaglow.com f.e.: both logos are served from the same S3 bucket: https://s3q1w2e3.s3.amazonaws.com/brands/logos/fly_maids.png https://s3q1w2e3.s3.amazonaws.com/brands/logos/fly_maids.png https://s3q1w2e3.s3.amazonaws.com/brands/logos/homeaglow.png https://s3q1w2e3.s3.amazonaws.com/brands/logos/homeaglow.png
  • phonon 11y ago
    It also has the same address/registration number as the one in the privacy policy of http://cleanr.ca/ http://cleanr.ca/ "a company incorporated in England and Wales (registration number 8883585) with its registered office address at 14 Whittonditch Road, Ramsbury, Marlborough, Wiltshire, United Kingdom, SN8 2PY."
    • phonon 11y ago
      Which is in fact "HOMEJOY EUROPE LIMITED"! https://beta.companieshouse.gov.uk/company/08883585 https://beta.companieshouse.gov.uk/company/08883585
      • austenallred 11y ago
        So the probably sold the whole company and reincorporated. I almost did a deal exactly like this today.
      • djur 11y ago
        Wild speculation: could they (Homejoy or whoever is liquidating them) be trying to salvage Homejoy's best markets by creating new cookie-cutter brands for each one and then trying to find a buyer?
      • pbhjpbhj 11y ago
        Cleanr can't be "Homejoy Europe Limited", it could be a trading name of them, but in their terms Cleanr say: >"These Terms of Service and any separate agreements whereby we provide you Services shall be governed by and construed in accordance with the laws of 112 Bagot St Toronto Guelph Canada m3k1v6." // That's a pretty specific set of laws!! But it's not then the website of a UK company. FWIW in Europe legislation requires a business to have the business name and address for service on the website. They also use a @gmail.com email address, which is low trust indicator for a business IMO. It might be of note that Cleanr haven't updated their Facebook page, https://www.facebook.com/HomeCleanr/ https://www.facebook.com/HomeCleanr/, since April 2015.
• mikegirouard 11y ago
  I tried to book an appointment with a bogus email and got a 500. The logo image was broken and I noticed an interesting path when viewing it's `src` attribute: https://s3q1w2e3.s3.amazonaws.com/brands/logos/ I wonder if this is a template theme or perhaps some sort of parent company that has many brands.
• thejerz 11y ago
  While this is sleezy, and probably violating all sorts of copyright and fraud statutes, I have to commend the down-and-dirty hustle here.
  • johnsalzarulo 11y ago
    Hustle is one thing to call it I guess. ha ha.
• JoblessWonder 11y ago
  The business number referenced on the privacy page is registered to "HOMEJOY EUROPE LIMITED" https://beta.companieshouse.gov.uk/company/08883585 https://beta.companieshouse.gov.uk/company/08883585
• TaylorGood 11y ago
  Digging into trademarks, incorporations and S-1's is a weird little obsession of mine.. That said, my initial findings are that Flymaids is directly related to Homejoy. Under Privacy link of Flymaids it states "In the European Union, we are Fly Maids Europe Limited, a company incorporated in England and Wales (registration number 8883585) with its registered office address at 14 Whittonditch Road, Ramsbury, Marlborough, Wiltshire, United Kingdom, SN8 2PY." If you lookup the registration number at Wales Companies House, it shows owner as "HOMEJOY EUROPE LIMITED" https://beta.companieshouse.gov.uk/company/08883585 https://beta.companieshouse.gov.uk/company/08883585 FWIW, they changed their registered address on 8/7/15, ten days short of their announcing to cease operations: http://bit.ly/1kbHtyJ http://bit.ly/1kbHtyJ
  • JoblessWonder 11y ago
    As I mentioned in another post, they don't seem to be actually registered in Deleware and there are typos related to find/replace (support@flymaids.com.com) so I'm not sure we can discount the chance someone just cut/pasted that from the original Homejoy privacy page. Homejoy's privacy page doesn't load and the wayback machine was blocked via robots.txt so we have no good way of checking that I can think of. Also, nice to meet someone else obsessed with investigating incorporation documents. :)
    • TaylorGood 11y ago
      This may be known already, but HOMEJOY, INC. is a Delaware corporation with the filing number: 4815336 ---- As mentioned in Flymaids privacy policy, their "head office" in Delaware is actually offices to incorporate.com; a registered agent for out of state companies. Also, a DBA search in Delaware returns nothing: http://www.courts.delaware.gov/tradenames/JICKioskSearch.aspx http://www.courts.delaware.gov/tradenames/JICKioskSearch.asp...
      • chris_wot 11y ago
        Is there any way if getting the company status without having yo pay $10? Seems bizarre you have to pay to see if the company is still in business or not!
• deleted 11y ago
  [deleted]
• johnsalzarulo 11y ago
  So, it looks like there is 3 distinct yet related sites that we have been able to dig up. http://www.flymaids.com/ http://www.flymaids.com/ http://cleanr.ca/ http://cleanr.ca/ http://www.homeaglow.com/ http://www.homeaglow.com/ My hunch is that there is more. They all seem to share a lot in common. Credit for digging these up: https://medium.com/@bradbatt/their-css-references-brands-homeaglow-css-styles-css-a411975a2423#.cpqo73c3e https://medium.com/@bradbatt/their-css-references-brands-hom... https://news.ycombinator.com/threads?id=phonon https://news.ycombinator.com/threads?id=phonon
• volaski 11y ago
  I'm surprised that BusinessInsider still doesn't have an article about this. Shame on you Business Insider! It's already been an hour! I expect a headline "How Homejoy came back from grave to haunt us"
  • ikeboy 11y ago
    http://www.businessinsider.com/aaron-cheung-brings-homejoy-customers-to-fly-maids-2015-10 http://www.businessinsider.com/aaron-cheung-brings-homejoy-c...
    • volaski 11y ago
      "Homejoy, the dead cleaning startup that shuttered its doors in August, has apparently awoken from the grave to email its customers about a new partner" ==> I was so close!
      • psykovsky 11y ago
        IHNception?
• xmly 11y ago
  Very low, very low. Do not understand how investors chose these founders.
  • ajeet_dhaliwal 11y ago
    I am actually finding this intriguing and genuinely curious to know what is going on. One of the cofounders was a panelist at an event just one month before they announced their closure speaking about their growth and it didn't seem like anything was wrong (its on YouTube) so im curious to know what's up.
• nichochar 11y ago
  Always had lot's of bad feelings and vibes with these founders
• Ch_livecodingtv 11y ago
  This article here says. It was customer retention problem. http://www.forbes.com/sites/ellenhuet/2015/07/23/what-really-killed-homejoy-it-couldnt-hold-onto-its-customers/ http://www.forbes.com/sites/ellenhuet/2015/07/23/what-really...
  • deleted 11y ago
    [deleted]
• jondubois 11y ago
  Silicon valley encourages this behaviour though. It seems we've forgotten that hacking is a just a euphemism for cheating.
• throwaway13337 11y ago
  From what I gather from the other comments, it looks like most likely Homejoy's liquidator (Nortonsgroup) has sold Homejoy's user data to Homeaglow. Homeaglow copied and rebranded their own tech as Fly Maids to service this user list.
  • sajclarke2 11y ago
    This sounds horrible but is probably likely
  • nacs 11y ago
    > has sold Homejoy's user data to Homeaglow Sold it with credit card numbers attached though? That sounds awfully.. illegal even for a liquidation.
    • yeukhon 11y ago
      See http://www.pcworld.com/article/2901028/radioshack-puts-customers-personal-data-up-for-sale-in-bankruptcy-auction.html http://www.pcworld.com/article/2901028/radioshack-puts-custo... Interestingly it has been legal in one case.
      • nacs 11y ago
        Not really, FTC didn't like it: http://money.cnn.com/2015/05/19/news/companies/radioshack-customer-data/ http://money.cnn.com/2015/05/19/news/companies/radioshack-cu...
    • dguaraglia 11y ago
      They probably just exported a database of credit card tokens into a PCI-compliant system (Stripe, Braintree or the like.) The motives and method are equally shitty, but at least get some solace in assuming that your credit card number is just not out in the open. Now... how secure this transfer of tokens was, no idea. So there could be a DB dump somewhere with a token to my credit card, and anyone can use it to start charging from it. I'll keep an eye on my bills.
  • deleted 11y ago
• eCa 11y ago
  Apart from everything else in the OP; from the email he received: > I wanted to reach out personally [...] So personally is going the way of literally, which literally does or does not mean literally [1]. [1] http://dictionary.reference.com/browse/literally http://dictionary.reference.com/browse/literally
• nodesocket 11y ago
  Strange, I had an account with Homejoy, yet I just tried to log into Fly Maids and it failed with no account. Furthermore, I tried using forgot password, and it leaked that no account exists with my e-mail.
• Judson 11y ago
  Judging by the Olark (site chat) account being used, Flymaids.com is run by Homeaglow.com. Edit: Which is also the same account used on cleanerconnect.com.
• daveloyall 11y ago
  I read this whole page of comments (when it was at 105) and gk1's comment is the only one that comes even close to what I'd like to see here: > You're underestimating how far people are willing to go to appear legit. Showing logos of companies who aren't your clients -- or of publications that never mentioned you -- is common. They know most people won't check to verify. ...Along those lines: has anybody considered the possibility that the whole thing is an elaborate phishing site? Here's an avenue for investigation which seems to be unexplored here: has Flymaids hired any maids, or contracted with them, or however that works?
• aarontcheung 11y ago
  I'm one of the founders of Homejoy. I'm still very passionate about the home service space. After leaving Homejoy, I started FlyMaids, where we're exploring a few different angles on the space. We recently acquired the customer and service provider data from Homejoy. We're a small team that has been focused on moving quickly while bootstraping. We tried to quickly test different approaches, but we realize now that we did so in an unclear manner. We recognize the need to use the data we acquired responsibily. As a result, we're taking the site down, and we're going to do a better job with our testing moving forward.
  • seancoleman 11y ago
    Typically investment contracts employ non-competes to prevent founders from starting new businesses in similar spaces. Clearly this person's previous actions aren't the most ethical but I'm curious what his strategy is around this.
    • mentat 11y ago
      Aren't all non-competes illegal in California?
      • slantedview 11y ago
        If you're willing to go to battle in court, they are.
      • bravo22 11y ago
        For employment they are unenforceable but this is a different situation. It would be part of an investment contract and it is very much enforceable.
  • dsr_ 11y ago
    I'm upvoting you to get your response attention. Don't mistake that for approval of what you did.
    • 11y ago
• goomp 11y ago
  One of the comments on the article itself mentioned css being served seemingly from www.homeaglow.com, which was weird to me. So I did some investigating. Looking at the DNS of both flymaids.com and homeaglow.com, they both point to separate IPs (184.168.221.1 and 184.168.221.13 respectively), but have an additional CNAME to http://cleanerconnect.herokuapp.com http://cleanerconnect.herokuapp.com. Looking at the error on the heroku page directly, and comparing everything from the license info, help console, website copy, it seems that they are all the same company, operating under different brandings. The privacy agreements are what really get me though. Looks like they are identical, except the brand names: http://www.homeaglow.com/privacy http://www.homeaglow.com/privacy http://www.flymaids.com/privacy http://www.flymaids.com/privacy And if you go to http://cleanerconnect.herokuapp.com http://cleanerconnect.herokuapp.com and inspect the broken icon, you get "https://s3q1w2e3.s3.amazonaws.com/brands/logos/" https://s3q1w2e3.s3.amazonaws.com/brands/logos/". Looking at the two sites' logos gets you the same URL, with an actual filename: https://s3q1w2e3.s3.amazonaws.com/brands/logos/fly_maids.png https://s3q1w2e3.s3.amazonaws.com/brands/logos/fly_maids.png https://s3q1w2e3.s3.amazonaws.com/brands/logos/homeaglow.png https://s3q1w2e3.s3.amazonaws.com/brands/logos/homeaglow.png And the two domains/common backend makes sense, if it is really just a CNAME you could detect what URL the user hits and plug in a few variables. The different IP addresses on the A record are what confuse me, but I don't know much about DNS configuration. But yes, it seems that flymaids and homeaglow are the same company. And I don't think it's a stretch that homejoy was among those as well.
• johnsalzarulo 11y ago
  Did anyone else in the LA area use Homejoy, or did anyone else get this email?
• crabasa 11y ago
  I think it goes without saying that there is nothing remotely legitimate happening here. The fact that Aaron posted this comment and expected anybody to believe it is remarkable. That being said, I spent 5 minutes researching Aaron Cheung and I was astonished by what I found. He has a Twitter account, but has posted exactly 0 times [1]. He has an HN account, but has posted exactly 0 times [2], and only commented twice (including today). He graduated from MIT in 2009 and this has seemingly been the only real job he's had for the past 5 years [3]. I think, from this perspective, I understand why Aaron is doing what he's doing. It doesn't make it right, not even close, but this person has lived and breathed the home cleaning space for his entire professional career. He may not have the slightest idea what else he could possibly do instead. [1]: https://twitter.com/aarontcheung [2]: https://news.ycombinator.com/submitted?id=aarontcheung [3]: https://www.linkedin.com/in/aarontcheung Edit: I'm certainly not claiming that people who are inactive on social media are bad people. But given the complete picture of what has been reported in the media, what was revealed today and the tone-deafness of his comment, I personally think this lack of engagement is part of the explanation.
  • deleted 11y ago
    [deleted]
  • CatDevURandom 11y ago
    > He graduated from MIT in 2009 ... he may not have the slightest idea what else he could possibly do instead. There's endless ways we could speculate about why he's doing what he's doing, but is being six years out of school one of them? He spent "his entire professional career" (5 years!!!) in home cleaning. And before that it looks like he spent four years at MIT majoring in chemical engineering.
  • icey 11y ago
    Something that smells bad to me: Homejoy was facing multiple lawsuits at the time they shut down (http://www.forbes.com/sites/ellenhuet/2015/07/17/cleaning-startup-homejoy-shuts-down-citing-worker-misclassification-lawsuits/ http://www.forbes.com/sites/ellenhuet/2015/07/17/cleaning-st...). Is this some kind of end-run around that?
• S_A_P 11y ago
  Wow. Just wow. This is egregious. I would be incensed. I'm a 39 year old consultant that makes money from technology but I am starting to feel like I'm out of touch and old. This is not ok. If you fail, fail with class and dignity.
• untilHellbanned 11y ago
  Heard it here first: This is the start of YC's fall.
  • usernames_suck 11y ago
    Let's not go overboard. Hopefully, they learn from this an stop letting in "useless" Facebook for X startups. Or at least have a more rigorous interview process.
• deleted 11y ago
  [deleted]
• siegecraft 11y ago
  Just playing the VC shell game? Let's just write off the debt of this failed company and flip it into a rebrand of the same service?
• rjf90 11y ago
  Am I the only one that doesn't see any archive on https://archive.org/web/ https://archive.org/web/?
• ghayes 11y ago
  Honest question, how is this #11 right now with 901 points? It's below a story with 199 points that was posted an hour before.
  • jarek 11y ago
    It must have been heavily flagged. It's been lower than it should have been from the start. Admittedly the title of the submission isn't great so - if I'm being charitable - it's because users flagged based on title only.
    • chris_wot 11y ago
      It's been on the front page for hours now.
      • jarek 11y ago
        Yes. Right now this submission is 15 hours old, in position 25 with 1065 points and 313 comments. In position 24 is a submission from 15 hours ago with 131 points and 22 comments (https://news.ycombinator.com/item?id=10466678 https://news.ycombinator.com/item?id=10466678). In position 19 is a submission from 14 hours ago with 153 points and 70 comments (https://news.ycombinator.com/item?id=10467190 https://news.ycombinator.com/item?id=10467190). So it's not just because of exponential submission decay nor because of flamewar filtering. Last evening GMT this submission was in fourth place when by points/comments/age it should have been first. User flagging is the most charitable interpretation. edit: now at position 54, 1078 points, 315 comments, 16 hours ago. At position 53 is a story from 17 hours ago, 69 points, 13 comments (https://news.ycombinator.com/item?id=10466419 https://news.ycombinator.com/item?id=10466419)
• Animats 11y ago
  Current contents of "flymaids.com" is a 404 page: Heroku | No such app There is no app configured at that hostname. Perhaps the app owner has renamed it, or you mistyped the URL. Hosting appears to be by GoDaddy.
• sharemywin 11y ago
  I wish people wouldn't jump to conclusions with out all the facts. We don't know who bought what. Google has some of the team. Handy was in talks to by homejoy. who knows who else is involved. if handy bought the data they would have a right to their own copy.
• tomahunt 11y ago
  Looks like some big mistakes might have been made by the people over at FlyMaids. Despite all this I hope there are people close who are looking out for their wellbeing, and helping them fix the situation.
• aws_ls 11y ago
  Really surprised to see this story, get so many votes. Yes, this guy did not act very properly, and seems like its a desperate act to salvage an old business. Admittedly the copying of UI CSS from a competitor was a clear wrong, but all the others passing on data, kind of like a grey area, Ok its wrong if I have to choose one option. But what the heck, cut him some slack, he has posted immediately with his real name. What do you want, shame him into killing himself? The insensitivity is simply shocking to me. You have acted as a lynch mob today (hiding behind the technicalities), I am sorry to say that.