2 ms·
Can unfortunately confirm that friends at both Lyft and Uber have in the past known my ride history. I admittedly had to push a bit jokingly for either to look
by buildbuildbuild 9y ago
Can unfortunately confirm that friends at both Lyft and Uber have in the past known my ride history. I admittedly had to push a bit jokingly for either to look it up, but the fact that it is even possible for insiders to access internal production databases makes me suspect this problem is far more widespread than just at ridesharing companies.
I wonder who at Fastmail can read user emails? Who at Heroku can access my code or ENV secrets? Can bank employees see recent transactions, bypassing ACH verification deposits’ “Security”?
Sad how rare end to end encryption is as a feature in 2018.
- dx034 9y agoMany companies have userdata access heavily restricted and audit every access. It's not that hard to log all queries to production that don't come from the system. And if a developer runs queries against the production database that should pop up somewhere immediately. Not different in banks, any lookup of customer accounts is monitored and checked. Looking up a friend's account will get you fired immediately (or worse).
- buildbuildbuild 9y agoWhat I worry about is whether the logging is at the application level or database level. Would not be surprised if my banker’s crusty windows XP teller software’s auditing could be bypassed by an unexpectedly-savvy insider.
- dx034 9y agoLogging is done at every level. OS, network and multiple times on a db level (access log plus execution log).