Hacker News Reader

Uber likely doesn't have social network data on their riders

Uber does have a feature to split a bill, and has source,destination pairs for all its trips. I bet you can do some serious social graph construction with that data.

And, as with so many things in the privacy space, combining that data with other data sources (ISP intercepts of HTTPS traffic, for example) probably provides a clearer picture than one could get from either data set alone.

What makes you think ISPs are intercepting HTTPS traffic, or have the ability to do so?

There's no reason the ISP couldn't intercept encrypted traffic or related metadata. They just can't read it.

Since wireless ISPs have been collecting and indefinitely retaining messaging data for many years, it's not beyond any reasonable expectation that wireline ISPs aren't retaining various things.

You only need to know which cell towers the phones are traveling past[1], and you get a nice relationship map (and movement data). I'm sure a similar analysis can be done with IP headers.

[1] http://apps.washingtonpost.com/g/page/national/how-the-nsa-i...

> I'm not sure Uber fits the profile for NSLs. Primarily given the fact that Uber likely doesn't have social network data on their riders so a simple court order for a single users rides and GPS locations is probably all that's available for an NSA/FBI investigations. Unlike an email provider like Yahoo/Lavabit, or an ISP for example, which could provide multi-hop data.

Well, the Uber app on Android requires access to the user's address book, call log, and location, so I'd say Uber does have valuable social network information. This is not a unique capability for an Android app, however.

Knowing who went to or from a single location at around the same time would be super interesting for counter-terrorism. Of course, the intelligent terrorist would pay with cash, which means no Uber except in India, Southeast Asia, and a few others [1].

Which raises real questions, since taxis in some regions have cameras but Uber cars may not.

[1] http://techcrunch.com/2016/02/08/uber-begins-to-see-the-payo...

They already do this, that is track all the locations of cell phones to see if there are two people that "magically" happen to travel somewhere together in unusual pattern. Example I saw was two people at random times "happening" to get on the same mass transit system.

States don't need that data because they can get even better data from telecoms & banks already with less hassle. They know your IMEI, billing information, credit card information and the location of your cellphone. Uber is completely dependent on people's cell phones as it is, so NSL-ing them adds nothing new, like the contents of communication.

The data they want is pickup, dropoff, type of car used, amount paid etc.

By the way. Relevant here. Juno is apparently offering drivers 50/month just to keep their app running. This allows them to track all that info from lyft uber arro. Pretty patentable... And Juno hasn't even laumched here in Manhattan.

Hope my driver today doesn't catch heat.

> An NSL is typically reserved for companies who can give broad access to user data, such as requiring all previous and any future data for x amount of time for 3-hops from a single persons social network (which could be hundreds of people).

"3-hops" may very well be the entire network in most cases.

As long as everyone is friends with Tom! (MySpace reference. Kids: Everyone got a free first friend on MySpace. His name was Tom.)

(Extra info: your free friend's name was Tom Anderson, he was a real person - one of the cofounders of MySpace.)

This explanation made me feel incredibly old.

Your stock symbol was the first company I bought options for, and lost thousands of dollars. The good ol'days

Who is tdfx / which company is that?

It's 3dfx, a long-defunct graphics hardware company.

> Uber said it had not received any national security letters or orders under the Foreign Intelligence Surveillance act.

This statement is likely a warrant canary:

https://en.wikipedia.org/wiki/Warrant_canary