5 ms·

Just to play devil's advocate here, this is from the article: > The app, called WorkIt, invites users to register by providing a name, email, telephone number

Just to play devil's advocate here, this is from the article: > The app, called WorkIt, invites users to register by providing a name, email, telephone number and ZIP Code. Users can also s hare (sic) their job title and Wal-Mart store number.... That is a bunch of personally identifying information. You can easily steal somebody's identity with those bits of information, or at least have a good idea of who they are. I see how Walmart's corporate line is at least somewhat believable upon further thought. And there has been no disclosure on how they're storing this information. Are they storing it on AWS/GCE/Azure or Linode? Or do they have their own locked down racks that safeguard this information? Look, I'm not saying that there's anything malicious about this, or the Walmart isn't trying to bust worker collaboration. But, in today's security conscious world, you really should ask these questions when you're requesting PII to sign up to your app. And malice vs carelessness doesn't matter when your personal information is leaked all over the web.

btown 10y ago
"Locked down racks" is complete FUD. It's not like there's HIPAA or PCI compliance issues here. Incompetently managed bare metal servers are just as hackable, perhaps more so, than incompetently used cloud IaaS. Workers should be careful, but storage has absolutely nothing to do with this.
- jimmywanger 10y ago
  > "Locked down racks" is complete FUD. That was my point. I'd much rather have them Amazon boys or Google boys take care of my data than my own sysadmin team - the Amazon/Google sysadmins are sharp, they apply all patches, and they have procedures in place to make sure they don't do anything incredibly stupid. The fact they don't mention how they store any of this information that could have potential career altering affects bothers the heck out of me. I'd much rather they just say that they stored everything in AWS, than run their own bare metal.
  - TheDong 10y ago
    What you're saying is even more FUD though. Using AWS EC2 or GCE's compute doesn't mean you aren't responsible for sysadmining. You still have to patch your boxes, you still have not do incredibly stupid things. The actual security difference between servers on a rack and virtual machines in a cloud is roughly a dozen ip-tables rules (security groups).
    - jimmywanger 10y ago
      There are two levels, IaaS and PaaS. For IaaS, I agree that you're responsible for some sysadmining, but you start from a known good point in that bare VM OS images (for CentOS, Ubuntu, Windows, etc) will probably have all the appropriate patches applied and up to date. Of course you're on your own when it comes to spinning up your programs to make sure SQL injection doesn't work, etc etc. PaaS is another thing. In that case, if you're using AppEngine or ElasticBeanstalk or Heroku, you don't have to worry about the base infrastructure or the datastore at all. They should have all the relevant security patches applied at all times, which really cuts down the attack area to just your app, not the web server, datastore, or OS vulnerabilities.
  - byuu 10y ago
    > the Amazon/Google sysadmins are sharp, they apply all patches, and they have procedures in place to make sure they don't do anything incredibly stupid. I shared that viewpoint when I was hosting my forum on InMotion Hosting. Until they first applied an update that resulted in Apache returning all PHP files as plaintext files, revealing my SQL login credentials from the phpBB config file (thankfully I had remote DB login disabled.) And then a few weeks later, badly corrupting my entire SQL database and not being able to restore it after. I doubt Amazon/Google could be as incompetent as InMotion was, but all the same, don't trust that just because it's a company that specializes in something that you're safe from abject stupidity.
harmegido 10y ago
I'm not convinced by your argument. People freely give away this information and more to facebook, etc.
- VLM 10y ago
  But not in one giant queryable SQL table. I'd worry about parallelized spearfishing attacks across multiple stores, "Good Morning DEF, have I reached store number 12345 cash handling office? OK good to hear, this ABC at walmart corporate IT calling back about that trouble ticket your coworker XYZ entered about your store in Springfield, is XYZ at work now? Oh OK, well, anyway the ticket says XYZ is having trouble accessing the credit card portal, the ticket says you're trying to log in using the password of "password2", and back at HQ I can't log in using that password either so I'm planning on resetting her password, which will completely lock her out of the system for at least a week, unfortunately, but that's how ... Oh wait, you say there's a post it note on the monitor that her password is actually "ilovejustinbeiber", hold on a moment let me try that. How about that, it does work. Hey thanks for helping out, gonna save a lot of trouble for everyone. I'm not going to reset XYZ's password since it does work, I'll just close out the ticket with "can't reproduce problem", whoever took the ticket here couldn't enter the data right and obviously whatever problem there was is fixed now. Have a nice day out there in Springfield, Make Walmart Great Again (or whatever it is they say) Bye!" Or some team calls like twenty electronics departments and tells all of them to toss all their ipad stock into a large shipment box because they were shipped with faulty batteries while reading back all the info they gathered to build trust, then let them know a courier from UPS (fake brown uniform) will present a (fake) ID and pick up that box of ipads in an hour and they can expect replacements air shipped later that day. Remind the employee to make sure they sign and save the (fake) return receipt. Imagine what a large team could do with a phone that takes pictures, snapping serial numbers of boxes on the shelf and a half hour later reading the serial number list back to the clerk over the phone. This is all old stuff, but the advantage is you can parallelize it. If "they" hit one store every night there would be emergency emails printed out and taped up and handed out by the next week, but if you run this right you could do maybe 200, 300 stores. Even better if a competitor paid you to pull this off on Black Friday when half the IT staff took the day off anyway and all you need is to sow chaos to make money. Or do this the day before earnings are announced to really mess with them financially.
r00fus 10y ago
It's not PII [1]. That's an actual legal term. Workit apparently wants worker identifying information, and Walmart, like other employers are free to tell their workers not to provide it, but there's no ethical or legal reason they can give to workers not to use it. It's not unlike GlassDoor - lots of companies would prefer you didn't use it, but at the employee level, the advantage/disadvantage ratio is pretty in your favor. [1] https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform...
- detaro 10y ago
  Your own link lists some of the collected data as PII.
  - r00fus 10y ago
    Employment data considered "linked" information, and not core PII. Core PII is: "any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records"
    - jimmywanger 10y ago
      You're talking about core PII here. I'm saying the signup requirements probably constitute PII when taken all together. Full name (if uncommon) and email address (if private from an association/club membership, etc.). IP address (I'm pretty sure they can log your IP address unless they specifically say they don't.) And Zip code is mentioned as PII if linked to any of the above. These are all things they request for signup, and then you can optionally include your job title and your store number. All that stuff put together is very clearly PII, so I'm not quite sure what your point is.
      - r00fus 10y ago
        You need something personally identifiable, not just personal of nature to constitute as PII (I deal with actual PII on a daily basis). Adding up PII-related info together doesn't constitute PII. Many people gladly share personal details with activism sites and social networks well in excess of what this app is requesting, the only thing surprising here is the Streissand effect that wal-mart will get by naming this app.
hyperturtle 10y ago
Not sure on how secure but this article says the app is "secure". This also goes into more detail on what they use the information for. http://www.bloomberg.com/news/articles/2016-11-14/group-enlists-ibm-s-watson-to-answer-walmart-workers-questions http://www.bloomberg.com/news/articles/2016-11-14/group-enli...
GFK_of_xmaspast 10y ago
Name + telephone number + address is exactly the kind of information that you used to be able to get out of a phone book and can probably still buy from the DMV.
- jimmywanger 10y ago
  Just a niggle, but which phone number? Phone books only log land line numbers. Your mobile phone number (for large portions of the population) is one of the keys to your life.
- asddddd 10y ago
  Voter records are another good source for names + addresses (and phone/email depending on jurisdiction).
intopieces 10y ago
All of this information is probably readily available on these users' facebook profiles.
- jimmywanger 10y ago
  Really, your phone number, email address, zip code and full name are available on your facebook profile? I don't know which profiles you're looking at, but that information is available on the profiles of none of my friends.
  - intopieces 10y ago
    I'm no longer a Facebook user, but I can recall seeing several members of my family put all of that information on their profiles. As well, zip code and phone number can be found on any people-finder wbesite: whitepages.com, etc. I find it alarming too, but most people just aren't concerned with their personal data being out there in the world.
hammock 10y ago
"Invites here to register...this is a bunch of personally identifying information..." Yes. Of course. Isn't that the definition of "register"? It means to input your identifying information. Cf. First definition under intransitive verb (the sense used here): http://www.merriam-webster.com/dictionary/register http://www.merriam-webster.com/dictionary/register
- jimmywanger 10y ago
  No it doesn't. The bare minimum when you register on an anonymous website, you're asked to pick a username/password. Not all this other information. There was a link to a definition of PII in a followup comment somewhere. Combined, the information they ask about you could be construed as PII. It would be like asking for you to give your credit card number to browse an online shop. The app says that they answer questions about Wal-mart policies and redirect you to a human representative if they can't answer your question. Why do they need all this other information?
- jimmywanger 10y ago
  Your definition wordplay makes no sense. It says "to enroll one's name'. Not enroll one's real name or any ancillary information. Try again.
anigbrowl 10y ago
I'll take your concerns seriously when you post that about every single app that gets mentioned on hn. If you only care* about it for this particular app, then you might want to re-examine your biases and motivations. * and by 'care' I mean 'go to the trouble of writing a long comment on why it's such a bad thing.
- jimmywanger 10y ago
  I said I was being a devil's advocate. And the fact that an app requires such personal information to pretty much access an expert system raises my hackles. Are you really unable to tell the difference between merely registering for a site and given them your phone number and zip code?
  - anigbrowl 10y ago
    Of course I'm able to tell the difference. I'm also able to tell the difference between a labor union trying to organize workers and other forms of commercial activity.
    - jimmywanger 10y ago
      Apparently this app is just for answering frequently asked questions about HR and leave policies, with the help of IBM's watson. Which article were you reading? They were not trying to organize workers overtly, and just to give advice on lead policies requires absolutely no personal information that needs to be stored. What part of that can't you tell the difference of, that their demanding of personal information is overreach?

btown 10y ago

"Locked down racks" is complete FUD. It's not like there's HIPAA or PCI compliance issues here. Incompetently managed bare metal servers are just as hackable, perhaps more so, than incompetently used cloud IaaS. Workers should be careful, but storage has absolutely nothing to do with this.

jimmywanger 10y ago
> "Locked down racks" is complete FUD. That was my point. I'd much rather have them Amazon boys or Google boys take care of my data than my own sysadmin team - the Amazon/Google sysadmins are sharp, they apply all patches, and they have procedures in place to make sure they don't do anything incredibly stupid. The fact they don't mention how they store any of this information that could have potential career altering affects bothers the heck out of me. I'd much rather they just say that they stored everything in AWS, than run their own bare metal.
- TheDong 10y ago
  What you're saying is even more FUD though. Using AWS EC2 or GCE's compute doesn't mean you aren't responsible for sysadmining. You still have to patch your boxes, you still have not do incredibly stupid things. The actual security difference between servers on a rack and virtual machines in a cloud is roughly a dozen ip-tables rules (security groups).
  - jimmywanger 10y ago
    There are two levels, IaaS and PaaS. For IaaS, I agree that you're responsible for some sysadmining, but you start from a known good point in that bare VM OS images (for CentOS, Ubuntu, Windows, etc) will probably have all the appropriate patches applied and up to date. Of course you're on your own when it comes to spinning up your programs to make sure SQL injection doesn't work, etc etc. PaaS is another thing. In that case, if you're using AppEngine or ElasticBeanstalk or Heroku, you don't have to worry about the base infrastructure or the datastore at all. They should have all the relevant security patches applied at all times, which really cuts down the attack area to just your app, not the web server, datastore, or OS vulnerabilities.
- byuu 10y ago
  > the Amazon/Google sysadmins are sharp, they apply all patches, and they have procedures in place to make sure they don't do anything incredibly stupid. I shared that viewpoint when I was hosting my forum on InMotion Hosting. Until they first applied an update that resulted in Apache returning all PHP files as plaintext files, revealing my SQL login credentials from the phpBB config file (thankfully I had remote DB login disabled.) And then a few weeks later, badly corrupting my entire SQL database and not being able to restore it after. I doubt Amazon/Google could be as incompetent as InMotion was, but all the same, don't trust that just because it's a company that specializes in something that you're safe from abject stupidity.

harmegido 10y ago

I'm not convinced by your argument. People freely give away this information and more to facebook, etc.

VLM 10y ago
But not in one giant queryable SQL table. I'd worry about parallelized spearfishing attacks across multiple stores, "Good Morning DEF, have I reached store number 12345 cash handling office? OK good to hear, this ABC at walmart corporate IT calling back about that trouble ticket your coworker XYZ entered about your store in Springfield, is XYZ at work now? Oh OK, well, anyway the ticket says XYZ is having trouble accessing the credit card portal, the ticket says you're trying to log in using the password of "password2", and back at HQ I can't log in using that password either so I'm planning on resetting her password, which will completely lock her out of the system for at least a week, unfortunately, but that's how ... Oh wait, you say there's a post it note on the monitor that her password is actually "ilovejustinbeiber", hold on a moment let me try that. How about that, it does work. Hey thanks for helping out, gonna save a lot of trouble for everyone. I'm not going to reset XYZ's password since it does work, I'll just close out the ticket with "can't reproduce problem", whoever took the ticket here couldn't enter the data right and obviously whatever problem there was is fixed now. Have a nice day out there in Springfield, Make Walmart Great Again (or whatever it is they say) Bye!" Or some team calls like twenty electronics departments and tells all of them to toss all their ipad stock into a large shipment box because they were shipped with faulty batteries while reading back all the info they gathered to build trust, then let them know a courier from UPS (fake brown uniform) will present a (fake) ID and pick up that box of ipads in an hour and they can expect replacements air shipped later that day. Remind the employee to make sure they sign and save the (fake) return receipt. Imagine what a large team could do with a phone that takes pictures, snapping serial numbers of boxes on the shelf and a half hour later reading the serial number list back to the clerk over the phone. This is all old stuff, but the advantage is you can parallelize it. If "they" hit one store every night there would be emergency emails printed out and taped up and handed out by the next week, but if you run this right you could do maybe 200, 300 stores. Even better if a competitor paid you to pull this off on Black Friday when half the IT staff took the day off anyway and all you need is to sow chaos to make money. Or do this the day before earnings are announced to really mess with them financially.

r00fus 10y ago

It's not PII [1]. That's an actual legal term. Workit apparently wants worker identifying information, and Walmart, like other employers are free to tell their workers not to provide it, but there's no ethical or legal reason they can give to workers not to use it. It's not unlike GlassDoor - lots of companies would prefer you didn't use it, but at the employee level, the advantage/disadvantage ratio is pretty in your favor. [1] https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform...

detaro 10y ago
Your own link lists some of the collected data as PII.
- r00fus 10y ago
  Employment data considered "linked" information, and not core PII. Core PII is: "any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records"
  - jimmywanger 10y ago
    You're talking about core PII here. I'm saying the signup requirements probably constitute PII when taken all together. Full name (if uncommon) and email address (if private from an association/club membership, etc.). IP address (I'm pretty sure they can log your IP address unless they specifically say they don't.) And Zip code is mentioned as PII if linked to any of the above. These are all things they request for signup, and then you can optionally include your job title and your store number. All that stuff put together is very clearly PII, so I'm not quite sure what your point is.
    - r00fus 10y ago
      You need something personally identifiable, not just personal of nature to constitute as PII (I deal with actual PII on a daily basis). Adding up PII-related info together doesn't constitute PII. Many people gladly share personal details with activism sites and social networks well in excess of what this app is requesting, the only thing surprising here is the Streissand effect that wal-mart will get by naming this app.

hyperturtle 10y ago

Not sure on how secure but this article says the app is "secure". This also goes into more detail on what they use the information for. http://www.bloomberg.com/news/articles/2016-11-14/group-enlists-ibm-s-watson-to-answer-walmart-workers-questions http://www.bloomberg.com/news/articles/2016-11-14/group-enli...

GFK_of_xmaspast 10y ago

Name + telephone number + address is exactly the kind of information that you used to be able to get out of a phone book and can probably still buy from the DMV.

jimmywanger 10y ago
Just a niggle, but which phone number? Phone books only log land line numbers. Your mobile phone number (for large portions of the population) is one of the keys to your life.
asddddd 10y ago
Voter records are another good source for names + addresses (and phone/email depending on jurisdiction).

intopieces 10y ago

All of this information is probably readily available on these users' facebook profiles.

jimmywanger 10y ago
Really, your phone number, email address, zip code and full name are available on your facebook profile? I don't know which profiles you're looking at, but that information is available on the profiles of none of my friends.
- intopieces 10y ago
  I'm no longer a Facebook user, but I can recall seeing several members of my family put all of that information on their profiles. As well, zip code and phone number can be found on any people-finder wbesite: whitepages.com, etc. I find it alarming too, but most people just aren't concerned with their personal data being out there in the world.

hammock 10y ago

"Invites here to register...this is a bunch of personally identifying information..." Yes. Of course. Isn't that the definition of "register"? It means to input your identifying information. Cf. First definition under intransitive verb (the sense used here): http://www.merriam-webster.com/dictionary/register http://www.merriam-webster.com/dictionary/register

jimmywanger 10y ago
No it doesn't. The bare minimum when you register on an anonymous website, you're asked to pick a username/password. Not all this other information. There was a link to a definition of PII in a followup comment somewhere. Combined, the information they ask about you could be construed as PII. It would be like asking for you to give your credit card number to browse an online shop. The app says that they answer questions about Wal-mart policies and redirect you to a human representative if they can't answer your question. Why do they need all this other information?
jimmywanger 10y ago
Your definition wordplay makes no sense. It says "to enroll one's name'. Not enroll one's real name or any ancillary information. Try again.

anigbrowl 10y ago

I'll take your concerns seriously when you post that about every single app that gets mentioned on hn. If you only care* about it for this particular app, then you might want to re-examine your biases and motivations. * and by 'care' I mean 'go to the trouble of writing a long comment on why it's such a bad thing.

jimmywanger 10y ago
I said I was being a devil's advocate. And the fact that an app requires such personal information to pretty much access an expert system raises my hackles. Are you really unable to tell the difference between merely registering for a site and given them your phone number and zip code?
- anigbrowl 10y ago
  Of course I'm able to tell the difference. I'm also able to tell the difference between a labor union trying to organize workers and other forms of commercial activity.
  - jimmywanger 10y ago
    Apparently this app is just for answering frequently asked questions about HR and leave policies, with the help of IBM's watson. Which article were you reading? They were not trying to organize workers overtly, and just to give advice on lead policies requires absolutely no personal information that needs to be stored. What part of that can't you tell the difference of, that their demanding of personal information is overreach?