4 ms·

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. Indeed. The FCRA accounts for bored clerks looking up ran

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. Indeed. The FCRA accounts for bored clerks looking up random peoples' credit history. Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason. I'm no fan of regulation but the wild west of PII is long past needing to be tamed. Companies need to be held responsible for their intelligence and how it gets used.

lobo_tuerto 9y ago
"Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason." Then you should not have access to it? People will touch them if they can. That's why Access Control rules exist.
- btown 9y ago
  Too much reliance on programmatic access controls causes people to think “if it’s allowed by the controls, it’s allowed by common sense” which is rarely the case.
  - ams6110 9y ago
    On the flipside, systems that are too cumbersome to use because of access controls lead people to do things like maintain shadow systems in Excel spreadsheets just to get their work done. Of course with no security at all.
- rtpg 9y ago
  There's a bit of pragmatism involved in the level of control. If you add too much friction to the process of accessing information, then it can actually impede on actually handling user support. For example, having access to someone's ride history when trying to resolve a dispute seems relatively normal. Of course in Lyfts case it seems pretty clear that there can be more programatic locks. And auditable logs are able very good idea in general. But programatic locks are tricky. How do you transform and e-mail from a user confirming permission to history into an unlock code?
  - aiiane 9y ago
    That last bit is actually relatively straightforward - you send them a response with a link they click on taking them to a permission prompt.
  - paulie_a 9y ago
    If only we had modern phone infrastructure that could actually transfer useful info to the appropriate person... Instead we have terrible phone support that requires me to repeat the same info 3 times. That info should be unlocked the millisecond I am connected with a rep . It's not a moonshot
    - rtpg 9y ago
      Yeah totally. It's doable My feeling is that stuff is doable, but hard-ish. For example, for this case now you're writing something to interface with the phones? How do you know the phone number is for a certain client? Though I definitely see someone writing a thing where your ticketing/support system grants partial data access, you end up either making the support system pull in information from the DB... or your DB access controls being controlled through the support system. the latter one can potentially introduce security issues. The former one's easier but you can easily run into the "oh, this information's not gettable through the ticketing system".
- jstarfish 9y ago
  That might be how we deal with children who can't handle responsibility, but the absence of technical controls for every nuance of life is why ethics and code of law exists for adults. Access controls are not a substitute for maturity.
  - lobo_tuerto 9y ago
    Agreed, too bad humanity's level of maturity as a whole is very far away from ideal. If everyone did what they should we would probably be living in an utopia. But that's not the case. I don't mean that everything should be super-locked down to the point where it's inaccessible, just tweak it enough to not be misused. The idea of an audit trail is good, since you can go back in history and make any misbehaving parties accountable. Or design a system where the client authorize a rep to look into her records ---just like banks do when you ask for your balance.
  - rdiddly 9y ago
    Well, does Lyft's hiring process optimize for maturity? Do they often hire people in their 40s, for example?
  - tantalor 9y ago
    > children who can't handle responsibility Isn't the real concern bad actors? e.g., LOVEINT
  - vidarh 9y ago
    > Access controls are not a substitute for maturity. But maturity is not a substitute for access controls either. In any organization of some size, no matter how much you hire for "maturity", eventually people will slip past who have all kinds of reasons they'll be able to justify to themselves for deciding it's too tempting to look at things they shouldn't.
noobermin 9y ago
Couldn't this come under violation of terms of service under Lyft's end and open them up to class action, so there's no need for new regulation at least for this current issue. Not that I'm against new regs, I'm for it.
katastic 9y ago
I had a family friend who had access to a medical database. I joked, "I wonder if I'm in there." She said, "Yep." I remembered that Seinfeld episode where Elaine wants to change her file. I wondered what was in mine. "Can I see mine?" I said excitedly. "Absolutely not." her demeanor changed. Her professionalism kicked in. I was just curious about the data the same way I am about any other data. I didn't think it was a big deal (even MY OWN data?!). But she sure as hell did. And here I was, a family friend. Not a stranger. Normally those people are given more leeway in your life. So if she can take that stuff seriously, I don't see why the hell we can't expect nothing less from everyone else with access to sensitive data. We don't give custodians keys to every room in the building and then expect them to go snooping through everyone's computers, files, etc. But somehow, the human element kicks in, and we don't see a mental difference between "googling" what we're supposed to, and one... little... search of curiosity. Somehow, an extra Google/db search isn't as bad as rifling through someone's legal documents in their desk. Anyhow, she was definitely spooked enough that you can be sure she had many hours/talkings/whatever to scare her into never doing non-standard searches and that she could go to federal jail for doing it. Are they really tracking? Maybe. Hopefully! But it was enough to scare this person into doing her job and only her job. So my point is simply: Solutions exist, if companies and organizations are willing to actually implement them. But until companies are fined for violating people's privacy, they're never going to implement it. I can't get half my clients to upgrade from outdated versions of Windows without justifying the cost upgrade. Companies simply aren't going to care until we make it HURT their bottom line for their negligence.

lobo_tuerto 9y ago

"Just because you have access to something doesn't mean you're allowed to touch it without a valid business reason." Then you should not have access to it? People will touch them if they can. That's why Access Control rules exist.

btown 9y ago
Too much reliance on programmatic access controls causes people to think “if it’s allowed by the controls, it’s allowed by common sense” which is rarely the case.
- ams6110 9y ago
  On the flipside, systems that are too cumbersome to use because of access controls lead people to do things like maintain shadow systems in Excel spreadsheets just to get their work done. Of course with no security at all.
rtpg 9y ago
There's a bit of pragmatism involved in the level of control. If you add too much friction to the process of accessing information, then it can actually impede on actually handling user support. For example, having access to someone's ride history when trying to resolve a dispute seems relatively normal. Of course in Lyfts case it seems pretty clear that there can be more programatic locks. And auditable logs are able very good idea in general. But programatic locks are tricky. How do you transform and e-mail from a user confirming permission to history into an unlock code?
- aiiane 9y ago
  That last bit is actually relatively straightforward - you send them a response with a link they click on taking them to a permission prompt.
- paulie_a 9y ago
  If only we had modern phone infrastructure that could actually transfer useful info to the appropriate person... Instead we have terrible phone support that requires me to repeat the same info 3 times. That info should be unlocked the millisecond I am connected with a rep . It's not a moonshot
  - rtpg 9y ago
    Yeah totally. It's doable My feeling is that stuff is doable, but hard-ish. For example, for this case now you're writing something to interface with the phones? How do you know the phone number is for a certain client? Though I definitely see someone writing a thing where your ticketing/support system grants partial data access, you end up either making the support system pull in information from the DB... or your DB access controls being controlled through the support system. the latter one can potentially introduce security issues. The former one's easier but you can easily run into the "oh, this information's not gettable through the ticketing system".
jstarfish 9y ago
That might be how we deal with children who can't handle responsibility, but the absence of technical controls for every nuance of life is why ethics and code of law exists for adults. Access controls are not a substitute for maturity.
- lobo_tuerto 9y ago
  Agreed, too bad humanity's level of maturity as a whole is very far away from ideal. If everyone did what they should we would probably be living in an utopia. But that's not the case. I don't mean that everything should be super-locked down to the point where it's inaccessible, just tweak it enough to not be misused. The idea of an audit trail is good, since you can go back in history and make any misbehaving parties accountable. Or design a system where the client authorize a rep to look into her records ---just like banks do when you ask for your balance.
- rdiddly 9y ago
  Well, does Lyft's hiring process optimize for maturity? Do they often hire people in their 40s, for example?
- tantalor 9y ago
  > children who can't handle responsibility Isn't the real concern bad actors? e.g., LOVEINT
- vidarh 9y ago
  > Access controls are not a substitute for maturity. But maturity is not a substitute for access controls either. In any organization of some size, no matter how much you hire for "maturity", eventually people will slip past who have all kinds of reasons they'll be able to justify to themselves for deciding it's too tempting to look at things they shouldn't.

noobermin 9y ago

Couldn't this come under violation of terms of service under Lyft's end and open them up to class action, so there's no need for new regulation at least for this current issue. Not that I'm against new regs, I'm for it.

katastic 9y ago

I had a family friend who had access to a medical database. I joked, "I wonder if I'm in there." She said, "Yep." I remembered that Seinfeld episode where Elaine wants to change her file. I wondered what was in mine. "Can I see mine?" I said excitedly. "Absolutely not." her demeanor changed. Her professionalism kicked in. I was just curious about the data the same way I am about any other data. I didn't think it was a big deal (even MY OWN data?!). But she sure as hell did. And here I was, a family friend. Not a stranger. Normally those people are given more leeway in your life. So if she can take that stuff seriously, I don't see why the hell we can't expect nothing less from everyone else with access to sensitive data. We don't give custodians keys to every room in the building and then expect them to go snooping through everyone's computers, files, etc. But somehow, the human element kicks in, and we don't see a mental difference between "googling" what we're supposed to, and one... little... search of curiosity. Somehow, an extra Google/db search isn't as bad as rifling through someone's legal documents in their desk. Anyhow, she was definitely spooked enough that you can be sure she had many hours/talkings/whatever to scare her into never doing non-standard searches and that she could go to federal jail for doing it. Are they really tracking? Maybe. Hopefully! But it was enough to scare this person into doing her job and only her job. So my point is simply: Solutions exist, if companies and organizations are willing to actually implement them. But until companies are fined for violating people's privacy, they're never going to implement it. I can't get half my clients to upgrade from outdated versions of Windows without justifying the cost upgrade. Companies simply aren't going to care until we make it HURT their bottom line for their negligence.