7 ms·

Reminds me of the time I bought lunch at work, and a colleague told me exactly what I bought and how much I paid for it. I called him out and said it was a luck

Reminds me of the time I bought lunch at work, and a colleague told me exactly what I bought and how much I paid for it. I called him out and said it was a lucky guess, and then he proceeded to tell me my entire payment history for the past 2 days. Turns out when I was buying lunch, he was on the phone with a friend who worked at Paytm and that guy gave away my transaction history for shits and giggles. My trust in private companies has been at it's lowest since then and I absolutely do not trust startups to keep my data safe.

lm28469 4y ago
And then people complain about how GDPR is backward and useless :/
yumraj 4y ago
> My trust in private companies has been at it's lowest since then and I absolutely do not trust startups to keep my data safe. Tesla is neither a private company, nor a startup. But, your point is still valid.
- valarauko 4y ago
  > Tesla is neither a private company, nor a startup. The parent implies 'private' in the sense of non-governmental entity (the Indian terminology), and by that metric both Tesla and Paytm are 'private' (and publicly traded)
lisasays 4y ago
I'm so glad I've never heard of that service and have no idea what it is. Thanks very much for calling them out by name, BTW. Presumably someone from that company is reading this as we speak - and soon enough, will be reporting back to us that that employee has been identified, and of course, duly fired. Right, PayTM? (BTW - that's some "colleague" you have).
- kdkdifo 4y ago
  Justice is when an Internet mob gets someone fired based on an unsubstantiated comment on an anonymous forum. We did it Reddit!
  - varun_chopra 4y ago
    My name is here, my profile has my website which in turn has my Linkedin. There's nothing anonymous about what I'm doing.
- musicale 4y ago
  Are you suggesting that Paytm is actually PayPal/Venmo?
  - lisasays 4y ago
    No, just that I don't run any of these surveillance apps unless I absolutely have to. And hence, am unfamiliar with the vast majority of them.
- kylehotchkiss 4y ago
  Indian peer to peer payments app. Generally considered one of the higher-quality made in India applications and very very widely used. Nobody will be IDed or fired until the same thing happens to a celeb or gvmt official.
- pcthrowaway 4y ago
  It's because you don't live in India. Not sure if this is still the case, but Paytm was the Venmo of India, and actually had more penetration than credit cards when I visited ~5-6 years ago.
abdullahkhalids 4y ago
I was at a hackathon once, and they had a startup fair, where various companies had their booths. One startup had created a student-management system for schools. And the rep was demoing the system. Except with live data. Showing pages of real students with their pictures, home addresses, etc! So, principles aside, the actions of companies are such that there can be no trust.
- kevviiinn 4y ago
  Someone should have walked up with their phone camera and shouted "ooh hey, nice addresses!" And just started snapping away (or at least pretending to)
  - progman32 4y ago
    Yeah. I would seriously have considered asking "did these students consent to the public dissemination of their personal data?" This kind of behavior will only go away when it becomes a shameful act in the eyes of the public.
  - Verdex 4y ago
    I would not be surprised if their resolution to someone taking pictures in order to show them the error in their ways would be for them to call to police and have you arrested.
- a4isms 4y ago
  I once had a classified ad software hustle, and I needed customer data to debug things. But one of my customers was Canada's largest gay newspaper, and ts classifieds were highly sensitive. So I wrote a routine that obfuscated the database, changing all phone numbers to 555-xxxx, changing all names to random names of fruit (So a customer might become Banana Grapes, 416-555-1234), and a few other changes to hide other possibly identifiable information. I had a menu item to do that to the database, it was under a "developer" menu that only appeared when I was personally signed in as the only superuser. I am embarrassed to say the menu item was called "mixed fruit." One day, I was signed in at the client's office, and the manager came by and wanted to do something or other. I gave him the mouse and keyboard without logging out and asking him to log back in. He did his job, then noticed the developer menu. "What's this," he murmured, and selected "mixed fruit." No confirmation dialog, no warning, it begin munging the live, production database as I watched in horror. I managed to get everything sorted and the production data restored, but I learned a few lessons that day about building super-features for myself that were extremely sharp and difficult to undo.
dilippkumar 4y ago
India really needs a massive overhaul of its digital privacy laws. I still remember when Blackberry had to pull out of India because the government wouldn’t let them operate a secure, encrypted messaging service.
sometimes_all 4y ago
Was this just Paytm's history, or all of your digital payments history (ie all transactions outside Paytm)? I'm guessing it's the former, but I'm just too paranoid to not ask...
- varun_chopra 4y ago
  Yes, it's the former.
  - sometimes_all 4y ago
    Interesting, thanks. The fact that PayTM doesn't guard sensitive personal data even when it's a local tech behemoth makes me not want to use digital payments and switch to cash.
    - Algemarin 4y ago
      Except there's no evidence that they don't guard sensitive personal data other than an unsubstantiated post.
      - Phlarp 4y ago
        [flagged]
        deleted 4y ago
        [deleted]
      - throwway120385 4y ago
        Why are you advocating sensitivity to the giant corporation here? If there's a defense its "we don't allow random employees to access these records, and anytime an access is performed we audit the access including interviewing the responsible employee and reviewing call recordings. If the access was for anything other than an approved reason we fire the employee."
pertymcpert 4y ago
uhhhh...that sounds like a...felony?
- rootusrootus 4y ago
  Paytm is an India thing. It might be illegal there, but I wouldn't count on enforcement being good for much.
photon12 4y ago
If you build robust privacy guidance mechanisms into the fabric of your startup from the beginning, your ability to handle risk management around these types of cases can be resourced to scale with the customer expectations of the system you build. Unfortunately, if you do that, you are going to be outcompeted by the teams that are working to get their first 10,000 paying customers by any means necessary, because privacy planning is less capital efficient. The companies that do get big enough to overcome their immediate survival constraints often have a harder problem identifying and providing resource needs for privacy assurance because it's less on the minds of the people in charge of making resource decisions because you have other operational scaling issues at the front of mind. Your engineers and support staff doing dumb things with your data is a risk you can have resources allocated to. But it's not on the critical path to market dominance so it shouldn't be expected to be a priority.
- throwway120385 4y ago
  Sounds like it should be illegal to share data by default, and that individuals shouldn't be able to sign away their expectation of privacy as part of a EULA.
  - jacquesm 4y ago
    That's called the GDPR. Positive, coercion free, explicit and non-tied consent is a hard requirement. See article 7: https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
    - iso1631 4y ago
      Unsurprisingly the average startup bro hates the GDPR, they see it as an obstacle to doing things with data they shouldn't
Algemarin 4y ago
I feel conflicted whenever I see a comment like this. On the one hand, let's assume it's true: a Paytm employee acted negligently. But on the other hand, what if it's not true? What if you happen to have a friend or family member who works for a Paytm competitor, or you have some grudge against Paytm for whatever reason, and are instead spreading low-key FUD about the company to make it seem like they have lax data controls and staff disregard for sensitive data? The issue is that there doesn't really seem to be a way to substantiate your anecdote.
- SV_BubbleTime 4y ago
  Good point. So how about the default should be zero knowledge or as close as we can get? How about not willingly providing information of people that actually don’t NEED it?
- chongli 4y ago
  I didn’t even realize Paytm was a real company when reading OP. It sounded like a generic name made up for purpose, like “Jane Doe” for payment companies.
- radicaldreamer 4y ago
  This is why rule of law is important. India has weak rule of law... there's no confidence from anyone that wrongdoing will be punished and there's no confidence that making up stuff to hurt a competitor will be punished.
- ifyoubuildit 4y ago
  Isn't this true of much of what you read on the internet? Edit: I'm responding specifically to this: The issue is that there doesn't really seem to be a way to substantiate your anecdote.
- causi 4y ago
  From personal experience, people will do anything they are physically capable of doing and think they can get away with. Almost nobody I know has the slightest amount of respect for any private data to which they have access. This extends from people in healthcare breaking HIPAA to tell me about how Jane Doe is an idiot who got a mayo jar stuck in her vagina to IT workers showing me John Doe's cringey nude selfies. Trust absolutely no one. If it's possible, it's happening. The goal should be able to make it not possible to the best extent and when it is, create accountability.
Dobbs 4y ago
And this right here is why the GDPR was created.
fruit2020 4y ago
You are right, I’ve worked at a bunch of companies with millions of users and access to data was almost out of control within the company. Management doesn’t really care, including the data protection officers and the likes. I only hope Google has better policies, with all the data we store in emails and in docs.
- JohnFen 4y ago
  > I only hope Google has better policies, with all the data we store in emails and in docs. I wouldn't be willing to bet on it.
- deleted 4y ago
  [deleted]
lazide 4y ago
Frankly, everyone is a risk to some extent, which is why it’s handy to just not give someone things that can be a problem if exposed. What they don’t know/don’t have, can’t be used against you. But someone with minimal direct criminal/financial risks of exposing something is definitely higher risk than others, and that is most startups. That said Amazon reps have clearly been bought out before, and individuals within most large corps have always been viable targets of blackmail, bribery, coercion, etc. It’s why some societies are so resistant to phasing out Cash. Anything else gives leverage to folks that historically it’s been a bad idea to give leverage to.
- leoqa 4y ago
  At a fertility clinic they had paperwork that asked my employer, social security number etc. I asked if this was necessary, as I was paying out of pocket. They firmly said yes and asked me to fill it out. Guess who works for $State Fertility Group, with a social 111-11-1111 and makes 100M/year.
  - kylehotchkiss 4y ago
    Birthday: January 1, 1970, 12am.
mock-possum 4y ago
Holy cannoli, that sounds like a lawsuit and a half to me…
hn2017 4y ago
Tesla is the Amazon/Google of personal transportation when it comes to data overreach and data protection. It's shocking there isn't more pushback
ren_engineer 4y ago
when it comes to security you should always assume the worst intentions, if you can think of it as possible somebody is probably doing it. This is why nobody trusted the NSA and they were proven right with the Snowden stuff
kylehotchkiss 4y ago
This is really disappointing. HDFC wouldn't ever do this to you if you used your debit card for transactions (I realize this isn't feasible for every vendor, I just mean conceptually). Now I have to wonder why Amex was banned for so long for not localizing data. The other payment apps with localized data aren't really doing that much to protect it!
SoftTalker 4y ago
What you must understand is that this is human nature not "private companies." When I was in high school I had a friend who worked at one of those 1-hr photo processing places. People would bring their film in to have prints made. And there were no small numbers of "intimate" photos on those rolls of film. Yes even in the days of film cameras, people took photos of themselves in sexual situations. Of course my friend thought it was hilarious and the shop would make extra prints of these photos to pass around among the staff. They had separate categories similar to what you'd see on any porn site. Of course it was in violation of policy but people do this stuff. If you're building something that handles photo/video images you must expect it and build in privacy from the ground up. You cannot rely on your staff to always be on their best behavior.
- smodo 4y ago
  I assume they don’t mean that they are baffled by human nature. The thing that’s sort of unexpected is that, knowing human nature, companies don’t build in safeguards for this kind of sh.
  - plagiarist 4y ago
    Exactly so. It is repugnant that level of access was even available to a employee based on nothing but curiosity. Unfortunately another part of human nature is that most people profiting off you don't give a shit about your privacy. This is why legislation such as HIPAA has to exist.
    - WalterBright 4y ago
      Do you really thing the people in government care about your privacy? Let's be real. Nobody cares about your (or my) privacy.
      - plagiarist 4y ago
        If the government gave a shit about privacy in general, Equifax would have been fined into oblivion and its owners jailed for a bit. The example is not evidence that they give a shit, it is presented as something without which our healthcare data would be traded as another commodity.
PakG1 4y ago
https://en.wikiquote.org/wiki/Mark_Zuckerberg https://en.wikiquote.org/wiki/Mark_Zuckerberg Zuck: Yeah so if you ever need info about anyone at Harvard Zuck: Just ask Zuck: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks
- opportune 4y ago
  I don’t recall the source, it may have just been anecdotes online that aren’t easily verifiable, but even after Facebook went legit as a company I’m pretty sure access to data (who’s looking at whose profile, stuff like that) was marketed as an employee perk.
  - jboy55 4y ago
    Not a perk, if you look at personal info of anyone in your social circle, you are fired, no matter who you are, for what ever reason. If you need to fix a bug, and you need to look at personal info, it is logged and reviewed, go snooping, you are fired. You use your friend as the example for that bug, you are fired. In fact, when I worked there, I was paranoid I'd accidentally look at personal info and get fired, and rigorously used test data.
    - opportune 4y ago
      This was from the early days (a few years after scaling out employees), not recently. Thanks for confirming that is no longer the case
      - Shish2k 4y ago
        For additional sense of timescale - I’ve been there for coming up to a decade, and day 1 of employee onboarding was “you will be fired immediately if you even try to do <list of activities>” (even looking up your own data at the database level is forbidden, because eg foreign keys could imply a list of who has blocked you, which is not visible in the web frontend) I’ve never dared test the auditing of the user-data-logs, but I have tested the auditing of the network-logs — when I tried ssh’ing from my work laptop to my personal web server (so that I could run an IRC client there), it took seconds for the security team to react ^^;
raldi 4y ago
My awakening was the multiple times I've been talking with a startup and said, "I was surprised there's no self-guided demo or video tour available on your website; can you show me how the product works?" and had them reply something like, "Oh, sure. The reason we don't have a demo yet is that we haven't gotten around to making fake data, but let me pull up one of our customers' accounts and give you a tour using their data. Try not to read anything."
- peterfarkas 4y ago
  Happened to me as well, with a HR-related tool, no less. I did not subscribe!
devmor 4y ago
That's horrific. I work for a fairly large payment processor and it takes multiple levels of approval and oversight from several levels of management to get time limited access to a production database or client interface - all access being logged and ticketed along the way. The idea that someone could just start looking up transactions for shits and giggles would be unheard of.
- kjreact 4y ago
  > The idea that someone could just start looking up transactions for shits and giggles would be unheard of. What about the DBA maintaining the database? Do they not have query access to the data? How about the devs who are responsible for reporting; do they develop reports using generated test data? It’s naive to believe that data is entirely secure and private. There’s always a level of trust required from employees to not share private data that they may see on the job.
  - Shish2k 4y ago
    > do they develop reports using generated test data? … yes? Develop against a test DB, then when you think you’re ready, run against prod with auditing and oversight
avg_dev 4y ago
I believe that your assessment of startups is valid. I also think your views are true of big, multinationals as well. It seems that by the time a company gets large enough, consumers start receiving some protections, but workers, not so much. - https://en.wikipedia.org/wiki/Foxconn#Controversies https://en.wikipedia.org/wiki/Foxconn#Controversies - https://en.wikipedia.org/wiki/Hyundai_Motor_Manufacturing_Alabama#Controversies https://en.wikipedia.org/wiki/Hyundai_Motor_Manufacturing_Al... etc.
yibg 4y ago
I don't think it's just private companies. Its really any thing that has data I think. I used to work at the largest telco in the country on a software project (as a consultant) that involved some integration with existing services. With some playing around it soon became clear that all services were wide open as long as you were on the internal network, you just had to know what they were and how to call them. No authentication required, no audit logs as far as I can determine. I didn't poke at it too much, but I was able to at least read an arbitrary cell phone's text messages and call logs.
JohnFen 4y ago
> I absolutely do not trust startups to keep my data safe. And you shouldn't. You also shouldn't trust established companies to keep your data safe. The track record of that sort of thing is absolutely dire.
orblivion 4y ago
I refuse to discuss certain topics during online therapy and generally avoid it overall. I wonder how secure that really is.
deleted 4y ago
[deleted]
renewiltord 4y ago
Well, that's India, though. Whether it's a private or a public company there's no real notion of privacy of data. If you want it and you have a friend with access, he'll give it to you. Your job is to then not get caught.
yalogin 4y ago
I fully expect this in India. There is no privacy in India and no education or awareness of it either. There are no laws and so no expectations either. I don’t if it’s still prevalent but I know friends who had folks from some company knock on their doors saying they will take a sample and do free blood tests and add it to their website to track it as a service. This is pre covid
tristor 4y ago
> My trust in private companies has been at it's lowest since then and I absolutely do not trust startups to keep my data safe. Hate to be the bearer of bad news, but governments aren’t any better. Local government in particular is usually an IT security nightmare. There was a local government in a state I used to reside in that required folks to have an “alarm license” for their home and fined people for false alarm police callouts. The form to apply required you to give an alarm code for the police, and of course your name, address, and phone number. Predictably, the database of information was ineffectively secured and basically public on the Internet for years before it was fixed. I don’t recall any burglaries or home invasions happening due to it, but still rather asinine. At this point in my life I have basically no faith in any institution in society and treat all information I give out as effectively compromised immediately.

lm28469 4y ago

And then people complain about how GDPR is backward and useless :/

yumraj 4y ago

> My trust in private companies has been at it's lowest since then and I absolutely do not trust startups to keep my data safe. Tesla is neither a private company, nor a startup. But, your point is still valid.

valarauko 4y ago
> Tesla is neither a private company, nor a startup. The parent implies 'private' in the sense of non-governmental entity (the Indian terminology), and by that metric both Tesla and Paytm are 'private' (and publicly traded)

lisasays 4y ago

I'm so glad I've never heard of that service and have no idea what it is. Thanks very much for calling them out by name, BTW. Presumably someone from that company is reading this as we speak - and soon enough, will be reporting back to us that that employee has been identified, and of course, duly fired. Right, PayTM? (BTW - that's some "colleague" you have).

kdkdifo 4y ago
Justice is when an Internet mob gets someone fired based on an unsubstantiated comment on an anonymous forum. We did it Reddit!
- varun_chopra 4y ago
  My name is here, my profile has my website which in turn has my Linkedin. There's nothing anonymous about what I'm doing.
musicale 4y ago
Are you suggesting that Paytm is actually PayPal/Venmo?
- lisasays 4y ago
  No, just that I don't run any of these surveillance apps unless I absolutely have to. And hence, am unfamiliar with the vast majority of them.
kylehotchkiss 4y ago
Indian peer to peer payments app. Generally considered one of the higher-quality made in India applications and very very widely used. Nobody will be IDed or fired until the same thing happens to a celeb or gvmt official.
pcthrowaway 4y ago
It's because you don't live in India. Not sure if this is still the case, but Paytm was the Venmo of India, and actually had more penetration than credit cards when I visited ~5-6 years ago.

abdullahkhalids 4y ago

I was at a hackathon once, and they had a startup fair, where various companies had their booths. One startup had created a student-management system for schools. And the rep was demoing the system. Except with live data. Showing pages of real students with their pictures, home addresses, etc! So, principles aside, the actions of companies are such that there can be no trust.

kevviiinn 4y ago
Someone should have walked up with their phone camera and shouted "ooh hey, nice addresses!" And just started snapping away (or at least pretending to)
- progman32 4y ago
  Yeah. I would seriously have considered asking "did these students consent to the public dissemination of their personal data?" This kind of behavior will only go away when it becomes a shameful act in the eyes of the public.
- Verdex 4y ago
  I would not be surprised if their resolution to someone taking pictures in order to show them the error in their ways would be for them to call to police and have you arrested.
a4isms 4y ago
I once had a classified ad software hustle, and I needed customer data to debug things. But one of my customers was Canada's largest gay newspaper, and ts classifieds were highly sensitive. So I wrote a routine that obfuscated the database, changing all phone numbers to 555-xxxx, changing all names to random names of fruit (So a customer might become Banana Grapes, 416-555-1234), and a few other changes to hide other possibly identifiable information. I had a menu item to do that to the database, it was under a "developer" menu that only appeared when I was personally signed in as the only superuser. I am embarrassed to say the menu item was called "mixed fruit." One day, I was signed in at the client's office, and the manager came by and wanted to do something or other. I gave him the mouse and keyboard without logging out and asking him to log back in. He did his job, then noticed the developer menu. "What's this," he murmured, and selected "mixed fruit." No confirmation dialog, no warning, it begin munging the live, production database as I watched in horror. I managed to get everything sorted and the production data restored, but I learned a few lessons that day about building super-features for myself that were extremely sharp and difficult to undo.

dilippkumar 4y ago

India really needs a massive overhaul of its digital privacy laws. I still remember when Blackberry had to pull out of India because the government wouldn’t let them operate a secure, encrypted messaging service.

sometimes_all 4y ago

Was this just Paytm's history, or all of your digital payments history (ie all transactions outside Paytm)? I'm guessing it's the former, but I'm just too paranoid to not ask...

varun_chopra 4y ago
Yes, it's the former.
- sometimes_all 4y ago
  Interesting, thanks. The fact that PayTM doesn't guard sensitive personal data even when it's a local tech behemoth makes me not want to use digital payments and switch to cash.
  - Algemarin 4y ago
    Except there's no evidence that they don't guard sensitive personal data other than an unsubstantiated post.
    - Phlarp 4y ago
      [flagged]
      - deleted 4y ago
        [deleted]
    - throwway120385 4y ago
      Why are you advocating sensitivity to the giant corporation here? If there's a defense its "we don't allow random employees to access these records, and anytime an access is performed we audit the access including interviewing the responsible employee and reviewing call recordings. If the access was for anything other than an approved reason we fire the employee."

pertymcpert 4y ago

uhhhh...that sounds like a...felony?

rootusrootus 4y ago
Paytm is an India thing. It might be illegal there, but I wouldn't count on enforcement being good for much.

photon12 4y ago

If you build robust privacy guidance mechanisms into the fabric of your startup from the beginning, your ability to handle risk management around these types of cases can be resourced to scale with the customer expectations of the system you build. Unfortunately, if you do that, you are going to be outcompeted by the teams that are working to get their first 10,000 paying customers by any means necessary, because privacy planning is less capital efficient. The companies that do get big enough to overcome their immediate survival constraints often have a harder problem identifying and providing resource needs for privacy assurance because it's less on the minds of the people in charge of making resource decisions because you have other operational scaling issues at the front of mind. Your engineers and support staff doing dumb things with your data is a risk you can have resources allocated to. But it's not on the critical path to market dominance so it shouldn't be expected to be a priority.

throwway120385 4y ago
Sounds like it should be illegal to share data by default, and that individuals shouldn't be able to sign away their expectation of privacy as part of a EULA.
- jacquesm 4y ago
  That's called the GDPR. Positive, coercion free, explicit and non-tied consent is a hard requirement. See article 7: https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
  - iso1631 4y ago
    Unsurprisingly the average startup bro hates the GDPR, they see it as an obstacle to doing things with data they shouldn't

Algemarin 4y ago

I feel conflicted whenever I see a comment like this. On the one hand, let's assume it's true: a Paytm employee acted negligently. But on the other hand, what if it's not true? What if you happen to have a friend or family member who works for a Paytm competitor, or you have some grudge against Paytm for whatever reason, and are instead spreading low-key FUD about the company to make it seem like they have lax data controls and staff disregard for sensitive data? The issue is that there doesn't really seem to be a way to substantiate your anecdote.

SV_BubbleTime 4y ago
Good point. So how about the default should be zero knowledge or as close as we can get? How about not willingly providing information of people that actually don’t NEED it?
chongli 4y ago
I didn’t even realize Paytm was a real company when reading OP. It sounded like a generic name made up for purpose, like “Jane Doe” for payment companies.
radicaldreamer 4y ago
This is why rule of law is important. India has weak rule of law... there's no confidence from anyone that wrongdoing will be punished and there's no confidence that making up stuff to hurt a competitor will be punished.
ifyoubuildit 4y ago
Isn't this true of much of what you read on the internet? Edit: I'm responding specifically to this: The issue is that there doesn't really seem to be a way to substantiate your anecdote.
causi 4y ago
From personal experience, people will do anything they are physically capable of doing and think they can get away with. Almost nobody I know has the slightest amount of respect for any private data to which they have access. This extends from people in healthcare breaking HIPAA to tell me about how Jane Doe is an idiot who got a mayo jar stuck in her vagina to IT workers showing me John Doe's cringey nude selfies. Trust absolutely no one. If it's possible, it's happening. The goal should be able to make it not possible to the best extent and when it is, create accountability.

Dobbs 4y ago

And this right here is why the GDPR was created.

fruit2020 4y ago

You are right, I’ve worked at a bunch of companies with millions of users and access to data was almost out of control within the company. Management doesn’t really care, including the data protection officers and the likes. I only hope Google has better policies, with all the data we store in emails and in docs.

JohnFen 4y ago
> I only hope Google has better policies, with all the data we store in emails and in docs. I wouldn't be willing to bet on it.
deleted 4y ago
[deleted]

lazide 4y ago

Frankly, everyone is a risk to some extent, which is why it’s handy to just not give someone things that can be a problem if exposed. What they don’t know/don’t have, can’t be used against you. But someone with minimal direct criminal/financial risks of exposing something is definitely higher risk than others, and that is most startups. That said Amazon reps have clearly been bought out before, and individuals within most large corps have always been viable targets of blackmail, bribery, coercion, etc. It’s why some societies are so resistant to phasing out Cash. Anything else gives leverage to folks that historically it’s been a bad idea to give leverage to.

leoqa 4y ago
At a fertility clinic they had paperwork that asked my employer, social security number etc. I asked if this was necessary, as I was paying out of pocket. They firmly said yes and asked me to fill it out. Guess who works for $State Fertility Group, with a social 111-11-1111 and makes 100M/year.
- kylehotchkiss 4y ago
  Birthday: January 1, 1970, 12am.

mock-possum 4y ago

Holy cannoli, that sounds like a lawsuit and a half to me…

hn2017 4y ago

Tesla is the Amazon/Google of personal transportation when it comes to data overreach and data protection. It's shocking there isn't more pushback

ren_engineer 4y ago

when it comes to security you should always assume the worst intentions, if you can think of it as possible somebody is probably doing it. This is why nobody trusted the NSA and they were proven right with the Snowden stuff

kylehotchkiss 4y ago

This is really disappointing. HDFC wouldn't ever do this to you if you used your debit card for transactions (I realize this isn't feasible for every vendor, I just mean conceptually). Now I have to wonder why Amex was banned for so long for not localizing data. The other payment apps with localized data aren't really doing that much to protect it!

SoftTalker 4y ago

What you must understand is that this is human nature not "private companies." When I was in high school I had a friend who worked at one of those 1-hr photo processing places. People would bring their film in to have prints made. And there were no small numbers of "intimate" photos on those rolls of film. Yes even in the days of film cameras, people took photos of themselves in sexual situations. Of course my friend thought it was hilarious and the shop would make extra prints of these photos to pass around among the staff. They had separate categories similar to what you'd see on any porn site. Of course it was in violation of policy but people do this stuff. If you're building something that handles photo/video images you must expect it and build in privacy from the ground up. You cannot rely on your staff to always be on their best behavior.

smodo 4y ago
I assume they don’t mean that they are baffled by human nature. The thing that’s sort of unexpected is that, knowing human nature, companies don’t build in safeguards for this kind of sh.
- plagiarist 4y ago
  Exactly so. It is repugnant that level of access was even available to a employee based on nothing but curiosity. Unfortunately another part of human nature is that most people profiting off you don't give a shit about your privacy. This is why legislation such as HIPAA has to exist.
  - WalterBright 4y ago
    Do you really thing the people in government care about your privacy? Let's be real. Nobody cares about your (or my) privacy.
    - plagiarist 4y ago
      If the government gave a shit about privacy in general, Equifax would have been fined into oblivion and its owners jailed for a bit. The example is not evidence that they give a shit, it is presented as something without which our healthcare data would be traded as another commodity.

PakG1 4y ago

https://en.wikiquote.org/wiki/Mark_Zuckerberg https://en.wikiquote.org/wiki/Mark_Zuckerberg Zuck: Yeah so if you ever need info about anyone at Harvard Zuck: Just ask Zuck: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks

opportune 4y ago
I don’t recall the source, it may have just been anecdotes online that aren’t easily verifiable, but even after Facebook went legit as a company I’m pretty sure access to data (who’s looking at whose profile, stuff like that) was marketed as an employee perk.
- jboy55 4y ago
  Not a perk, if you look at personal info of anyone in your social circle, you are fired, no matter who you are, for what ever reason. If you need to fix a bug, and you need to look at personal info, it is logged and reviewed, go snooping, you are fired. You use your friend as the example for that bug, you are fired. In fact, when I worked there, I was paranoid I'd accidentally look at personal info and get fired, and rigorously used test data.
  - opportune 4y ago
    This was from the early days (a few years after scaling out employees), not recently. Thanks for confirming that is no longer the case
    - Shish2k 4y ago
      For additional sense of timescale - I’ve been there for coming up to a decade, and day 1 of employee onboarding was “you will be fired immediately if you even try to do <list of activities>” (even looking up your own data at the database level is forbidden, because eg foreign keys could imply a list of who has blocked you, which is not visible in the web frontend) I’ve never dared test the auditing of the user-data-logs, but I have tested the auditing of the network-logs — when I tried ssh’ing from my work laptop to my personal web server (so that I could run an IRC client there), it took seconds for the security team to react ^^;

raldi 4y ago

My awakening was the multiple times I've been talking with a startup and said, "I was surprised there's no self-guided demo or video tour available on your website; can you show me how the product works?" and had them reply something like, "Oh, sure. The reason we don't have a demo yet is that we haven't gotten around to making fake data, but let me pull up one of our customers' accounts and give you a tour using their data. Try not to read anything."

peterfarkas 4y ago
Happened to me as well, with a HR-related tool, no less. I did not subscribe!

devmor 4y ago

That's horrific. I work for a fairly large payment processor and it takes multiple levels of approval and oversight from several levels of management to get time limited access to a production database or client interface - all access being logged and ticketed along the way. The idea that someone could just start looking up transactions for shits and giggles would be unheard of.

kjreact 4y ago
> The idea that someone could just start looking up transactions for shits and giggles would be unheard of. What about the DBA maintaining the database? Do they not have query access to the data? How about the devs who are responsible for reporting; do they develop reports using generated test data? It’s naive to believe that data is entirely secure and private. There’s always a level of trust required from employees to not share private data that they may see on the job.
- Shish2k 4y ago
  > do they develop reports using generated test data? … yes? Develop against a test DB, then when you think you’re ready, run against prod with auditing and oversight

avg_dev 4y ago

I believe that your assessment of startups is valid. I also think your views are true of big, multinationals as well. It seems that by the time a company gets large enough, consumers start receiving some protections, but workers, not so much. - https://en.wikipedia.org/wiki/Foxconn#Controversies https://en.wikipedia.org/wiki/Foxconn#Controversies - https://en.wikipedia.org/wiki/Hyundai_Motor_Manufacturing_Alabama#Controversies https://en.wikipedia.org/wiki/Hyundai_Motor_Manufacturing_Al... etc.

yibg 4y ago

I don't think it's just private companies. Its really any thing that has data I think. I used to work at the largest telco in the country on a software project (as a consultant) that involved some integration with existing services. With some playing around it soon became clear that all services were wide open as long as you were on the internal network, you just had to know what they were and how to call them. No authentication required, no audit logs as far as I can determine. I didn't poke at it too much, but I was able to at least read an arbitrary cell phone's text messages and call logs.

JohnFen 4y ago

> I absolutely do not trust startups to keep my data safe. And you shouldn't. You also shouldn't trust established companies to keep your data safe. The track record of that sort of thing is absolutely dire.

orblivion 4y ago

I refuse to discuss certain topics during online therapy and generally avoid it overall. I wonder how secure that really is.

deleted 4y ago

[deleted]

renewiltord 4y ago

Well, that's India, though. Whether it's a private or a public company there's no real notion of privacy of data. If you want it and you have a friend with access, he'll give it to you. Your job is to then not get caught.

yalogin 4y ago

I fully expect this in India. There is no privacy in India and no education or awareness of it either. There are no laws and so no expectations either. I don’t if it’s still prevalent but I know friends who had folks from some company knock on their doors saying they will take a sample and do free blood tests and add it to their website to track it as a service. This is pre covid

tristor 4y ago

> My trust in private companies has been at it's lowest since then and I absolutely do not trust startups to keep my data safe. Hate to be the bearer of bad news, but governments aren’t any better. Local government in particular is usually an IT security nightmare. There was a local government in a state I used to reside in that required folks to have an “alarm license” for their home and fined people for false alarm police callouts. The form to apply required you to give an alarm code for the police, and of course your name, address, and phone number. Predictably, the database of information was ineffectively secured and basically public on the Internet for years before it was fixed. I don’t recall any burglaries or home invasions happening due to it, but still rather asinine. At this point in my life I have basically no faith in any institution in society and treat all information I give out as effectively compromised immediately.