Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off | Hacker News Reader

Uber Now Tracks Passengers’ Locations Even After They’re Dropped Off

npr.org

812 pointsdoctorshady481 comments

I saw this earlier and had hopes that the update would just let me choose "While Using" in the app settings, like some other apps allow you even if they request access even while not using the app, but the settings only allow for "Always" or "Never" on iPhone. However, you can use Uber without allowing GPS, so it's not all or nothing.

I'm a little disturbed that they need any information after I use Uber though. They know where I was picked up and where I'm going, why do they need to know where I'm at after I get dropped off? That's a little intrusive to me. The proposed argument in the article, "Uber hopes to eliminate the most frustrating part of the experience: the game of phone tag that both the rider and driver play when trying to coordinate the pickup spot," is fine and I'd accept that even though I'm extremely wary of apps that have access to my GPS data while I'n not using the app because I can't see it in fine detail (as far as I know you only can see that some app is accessing your GPS currently, not which one(s) exactly). However, Uber has no need for the data after I am finished. I'm not a fan of being tracked in general, by governments or otherwise, but for a private company to request data after I finish using their services is intrusive and maybe this is conspiracy but I wouldn't be surprised if this data is sent real time and it's possible to see where a user is at any given time after they leave the car (during that 5 minute window).

I'm also curious how this will bump up against EU privacy laws. I'm in the states and this may only be enabled for certain markets, but I wonder if this would cause issues in EU if it's enabled there.

Well it's the same company that creepily gives me a code interview in the app because it knows I go to a software company couple of times a week and pushes a job ad.

Uber has a lot of sensitive information regarding users. Who goes where and when. This in the wrong hand can be very disastrous. E.g Trump to Uber: "gimme list of all people who to to mosques frequently. No tax for you." Uber: "Here you go. Just don't tell anyone. "

While I love this scenario from a "Trump could abuse his power" narrative, have there been any recorded cases of businesses in America getting "Secret" tax breaks? Seems like it'd be pretty hard to pull off with the IRS.

Sure, maybe they "Bundled" that data it in to some ~other~ lobbied tax deal, but I'd imagine someone would whistle blow that pretty quick in this post-snowden world?

>> Seems like it'd be pretty hard to pull off with the IRS.

Unless the IRS itself is the instrument of abuse: https://en.wikipedia.org/wiki/IRS_targeting_controversy

> have there been any recorded cases of businesses in America getting "Secret" tax breaks?

The tax law itself isn't secret, but companies certainly lobby for and receive tax breaks and other benefits passed openly by Congress. That's what lobbying is about, of course.

Post-snowden? We all know about it but the power abuse still happens.

You do know that your phone company already has that info, right?

I've never had the phone company suggest I apply for a job there based on things they know about me.

Your bank has information about your accounts. So it should be ok to make it public, right?

In many countries around the world phone companies are highly regulated entities.

Fair point, however just because the phone company/NSA has this information, IMHO that doesn't make unnecessarily intrusive apps OK with me.

As far as I know the location data a phone company has is not as fine-grained as GPS. But I agree with your point that a person's call data records are very sensitive information.

So what? They don't use that data for any other reason than for billing. If they do otherwise and they are found out it would be a PR and legal disaster of epic proportions!

Code interview in the app? What do you mean?

first search result: http://www.businessinsider.com/uber-recruiting-engineers-thr...

Sorry to disrupt your narrative but a theoretical action by Trump is worse than what's already happened under Obama?

http://www.theatlantic.com/amp/article/477921/

> During that time period, state and federal law enforcement requested information on 408 riders and 205 drivers. Uber, however, only fully complied with 32 percent of requests, while partially complying with 53 percent of requests.

Not exactly an epidemic.

But that's not my point. My point is actual exploitation of Ubers data that's already happened, is worse than fear mongering politically biased hypotheticals

If you look at Uber's actual transparency report you'll see the feds only requested 65 records. The governments doing the mass data requests were mostly local, state, airports and courts: https://transparencyreport.uber.com/

That's a dramatic and very silly example.

No tax break needed.

i got one of those, it definitely creeped me out

How come no one is throwing fuss about this for Google's foobar challenge? This is the same exact thing.

In today's time, we give up privacy for convenience. If you use a smart phone, Facebook, windows/google anything you are already giving up privacy. Stop pretending that 5 mins location monitoring is a big deal.

> In today's time, we give up privacy for convenience. If you use a smart phone, Facebook, windows/google anything you are already giving up privacy. Stop pretending that 5 mins location monitoring is a big deal.

I find it quite disturbing to see ridiculous comments where one wrong is made right by pointing to other wrongs. We wouldn't need any laws or law enforcement if such logic were to be followed in every area of life.

"There are full body scanners at airports. Stop pretending that putting curtains at home is going to help."

"There are surveillance cameras in many places. Stop pretending that controlling the privacy of your personal photos really matters."

I'm sure I can imagine many other comebacks if I spend more time on this.

Stop pretending people can't decide for themselves how much privacy they want and from whom

Hmm I got the Uber challenge quite frequently but I've never gotten this Google one. How do I find this?

There's a simple way to send a message: Set the location services setting to "Never" and just enter addresses for now (copy and paste from Maps if it's easier).

The important thing is that their analytics will pick this up, and if enough users do it, hopefully point toward re-enabling "While using."

Or don't accept this app update. If/when Uber stops the current app version (with 3 privacy settings) from working with their server API, switch from Uber to a competitor.

Apple can also change their policy for ride-sharing apps, to force "While Using" as an option, or block Uber's update from the App Store.

Remember that it was only after apps abused the contact database, that permissions were added by Apple to give users control over apps. Apple can step up now and define a new policy that responds to these new abuses of user choice, within the ride-sharing app category.

This is one of the few benefits of Apple's walled garden review of apps. Perhaps we will eventually thank Uber for pushing the boundaries of etiquette, forcing Apple to regulate Uber and their peers.

You can also continue to call Uber rides with location using Apple Maps, even if you don't give the Uber app location permission.

You can also just switch it back to "Never" when you're done with your trip.

Violation of privacy laws is one thing and bad enough in itself. But let's not forget that Uber violates various taxi laws as well. In Denmark, just now, the state prosecutor has formally prosecuted Uber for colluding to violate the taxi laws. So far, different Uber drivers have received fines and those fines have now been tried in appellate courts that upheld the fines. Now it's Uber's turn for its part in the violations.

I am not a big fan of those taxi laws, but I am not a fan of billion dollar corporations just doing as they are pleased either. They seem to have no regard for laws.

Didn't the Uber execs exactly state this publicly - that they are willing to brake the laws that they see are hindering innovation and a disruption?

I remember having read something like this but am unable to find it in my archives.

It's to analyse where riders actually go after being dropped off; for example understanding that if you want to go to building XYZ you have to get off here.

Collecting data for self driving cars probably.

Yeah, but why does Uber need/care about that information? If I ask to be dropped off at X and walk a couple blocks to Y, Uber shouldn't care. I can understand the argument that maybe going to certain buildings you have to be dropped off at a specific spot, but that seems like a minor gain for something that's more than just a minor intrusion.

Great! Why not allow people to opt out of the enhanced location gathering? I'll continue the old fashioned way of telling my driver where I want to go, and retain my small shred of privacy. People who are unable to navigate the big scary world by themselves can allow Uber to collect data and drop them off where they want to go.

Just let me opt out.

> I saw this earlier and had hopes that the update would just let me choose "While Using" in the app settings, like some other apps allow you even if they request access even while not using the app, but the settings only allow for "Always" or "Never" on iPhone. However, you can use Uber without allowing GPS, so it's not all or nothing.

You can force quit the app after using it, so it doesn't get GPS access. "Always" only grants access while the app is open in the background (of foreground of course). Not pretty, but a workaround.

> (as far as I know you only can see that some app is accessing your GPS currently, not which one(s) exactly

Don't have my phone set to English, so wording might be slightly off. Settings -> Privacy -> Location Services. A purple arrow means the app used GPS "recently" (so a few minutes ago)

> why do they need to know where I'm at after I get dropped off?

In China, there's a company that provides a free loyalty point program. The store signs up for it, and users download the app and can use it to collect points when a transaction is made at the store. The points can then be exchanged for discounts and other stuff.

All of this is free. How they make money is by selling the user behavior data.

One of the features is the app tracks where the user goes after a transaction is made, so stores can find patterns and possible ways to cross promote.

For example, it might show a trend that 60% of customers will go to the movie theater after dining at your restaurant. Or will go to the Nike store after visiting yours, so perhaps you want to adjust your prices, etc.

That's all well and good, but I'm turning off Uber's access to my GPS entirely.

I'm pretty sure in Germany it'll pretty much be "this is illegal as it tracks data at the individual level". Especially since there is no need for this to enable the core service.

> as far as I know you only can see that some app is accessing your GPS currently, not which one(s) exactly

On iOS if you go into [Settings > Privacy > Location Services] you can see which apps have used your location "recently" or in the last 24 hours. There is a legend at the bottom of that page for what the icons mean.

Is there any way to see on Android?

>why do they need to know where I'm at after I get dropped off? That's a little intrusive to me

A little?

> I'm also curious how this will bump up against EU privacy laws

Waze has location settings set to Always, so I guess they won't care again.

"little intrusive" are very kind words. i would call it a brazen theft of privacy.

Uber employee here. We were told the reason to track up to 5 mins after the trip is for fraud, ex if a driver doesn't end the trip when she is supposed to. and to figure out where the pick up spots for each address are. A large building may have multiple points where people get picked up or dropped off and knowing those points would be very useful for the drivers and riders.

And just as a side note, take it with a few grains of salt but I know it's not easy to just trust a company with such personal information, and certainly I wouldn't either, but Uber as a company is very ethical and takes the responsibility that we are entrusted with very seriously.

There are a lot of things we do for our customers that isn't reported by the news, but we always try to do the right thing. Ex. When we had a few outages earlier this year, we made sure that the drivers who were active at the time were "made whole" by paying them for the time we were down.

Yes, there were issues a few years ago with statements and actions that were done, but the Uber today and the employees that work here now take a lot of pride in what they do. I would never have worked here if I didn't feel Uber was an ethical company. And neither would my coworkers. There are thousands of engineers now working here and we would be the first ones who would stand up to management if we felt that something nefarious or even careless was being done with user's personal information. Many of the company values revolve around "toe stepping" and "principled confrontation" and this means even against our own management.

So I know it's not easy to believe, and it's easy for me to say since I work here, but nothing nefarious is going on. If there was, we the engineers would be against it completely.

"Uber as a company is very ethical and takes the responsibility that we are entrusted with very seriously."

Probably every company has said that, yet we know how that usually turns out sooner rather than later (I'm looking at you, WhatsApp).

"So I know it's not easy to believe, and it's easy for me to say since I work here, but nothing nefarious is going on. If there was, we the engineers would be against it completely."

For now. What if a new higher manager comes and decides to use this information for other purposes (ad, sale etc.)? Some engineers might quit, but costumers can't take their data back.

My takeaway is: do not trust companies with more data than necessary to provide you a service and this is exactly such case.

A few things that speak a lot:

- Algorithmic Labor and Information Asymmetries: A Case Study of Uber’s Drivers https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2686227

- Uber: The Big Data Company http://www.forbes.com/sites/ronhirson/2015/03/23/uber-the-bi...

- How Uber is Selling all Your Ride Data http://www.investopedia.com/articles/investing/030916/how-ub...

- How Uber Profits Even While Its Drivers Aren't Earning Money http://motherboard.vice.com/read/how-uber-profits-even-while...

- Uber claims US regulators collected data from 11m passengers https://www.theguardian.com/technology/2016/apr/12/uber-us-r...

> but Uber as a company is very ethical

If it wasn't for the apparent money laundry[1], drivers exploitation[2], cashing out on desperation[3], and tax evasion[4], maybe I could believe that.

[1]https://www.bloomberg.com/news/articles/2016-08-25/uber-lose... (How can the company survive?)

[1]https://beta.companieshouse.gov.uk/search?q=uber (Closing and reopening with different names in the UK. Apparently 4? times so far... Hmm...)

[2]http://www.dailykos.com/story/2016/5/4/1523310/-UBER-s-Shari...

[3]https://www.thesun.co.uk/news/1805286/uber-accused-of-cashin...

[4]https://www.theguardian.com/technology/2015/oct/20/uber-pays...

There are several counterpoints to your opinion that Uber is a bastion of values and respect. Here are a few (excluding the many incidents involving drivers):

1. Your CEO refers to the impact of his company on his sex life as "Boober". https://pando.com/2014/02/27/we-call-that-boob-er-the-four-m... 2. Uber orders and then cancels thousands of rides of its biggest competitor, Lyft. http://money.cnn.com/2014/08/11/technology/uber-fake-ride-re... 3. Uber exec threatens a journalist Sarah Lacy with a smear campaign. https://pando.com/2016/05/04/npr-proves-once-again-uber-lyin... 4. God mode: Insiders tracked users personal movements and were fined 20k for misusing their access. http://www.theverge.com/2016/1/6/10726004/uber-god-mode-sett...

Your closing statement is spot on: it's not easy to believe "nothing nefarious is going on". For me, it's not even possible.

> but Uber as a company is very ethical

Even if you would believe Uber is an ethical company (there is good reason to believe for-profit companies generally are not and also good reason Uber especially is not), the underlying problem is that the data could fall into other hands. Three letter agencies can ask for that data, someone could leak the data, etc. I know the last one sounds unlikely but stuff like this happens all the time.

Ex-Uber employee here. Ethics and values were roughly 80% of the reason why I chose to walk away from what was ostensibly my dream job after only a few months.

Being clear, my experience never saw misuse of customer info, just some legal but shady-as-shit ways they chose to do business.

EDIT: Sorry, my point being that, while I don't anticipate they'll abuse customer location tracking in the large, I would vehemently dispute the parent poster's supposition that everyone at Uber is super ethical. Rank and file engineer? Yeah, probably fine. Management? I expect TK and his lieutenant bros and bro-ettes will do whatever he can get away with.

> There are thousands of engineers now working here and we would be the first ones who would stand up to management if we felt that something nefarious or even careless was being done with user's personal information. Many of the company values revolve around "toe stepping" and "principled confrontation" and this means even against our own management.

Then how come the "while using" option is not there ? the best way of not being careless with sensitive data is not having them in the first place.

Unfortunately, "We were told the reason to track...is for fraud", does not make me very confident what you believe to be true is really true. And makes me even less confident considering your assertion that "nothing nefarious is going on. If there was, we the engineers would be against it completely." If your knowledge of what ultimately happens with the data relies merely on what you are told, how can it be possible for you to know nothing nefarious is going on?

I was more hoping you'd try to answer the part that addressed the "While Using" option being removed. I'm guessing that one might also be too difficult to answer honestly in a public forum?

Calling bs on "uber as a company is very ethical" and "nothing nefarious is going on":

Spying on a journalist: http://www.businessinsider.com/ubers-new-york-manager-invest...

Tracking celebrities and sharing publicly: http://www.forbes.com/sites/kashmirhill/2014/10/03/god-view-...

I think if you have to explain yourself you have already lost. I always use Uber but uninstalled it 2 seconds after I discovered I couldn't change the location settings to my liking. Literally typing this from a Lyft haha

While Uber may be interested in the "fraud" aspects - and I think that's a harsh word for what is "walk 50m from drop location" - it really ought to be up to the user to decide what the drop pin should be. Especially when it comes to uber-pool rides, riders may not want to disclose their residence or other locations to random passengers. The only thing that should matter is whether the rider got off at the dropped pin, and not whether the rider walks to some other place.

Uber as a company is very ethical and takes the responsibility that we are entrusted with very seriously.

and at the same time plays dirty with city councils and hires a lot of lobbyists and slashes prices without advanced warning to drivers? all of those are unethical practices.

The problem is that you need only one employee without moral concerns but with the necessary data-access and the data you are collecting can be used to abuse your customers. At my former employer I had access to cell-phone usage data and for example I could have tracked the calls and geolocation of my girlfriend. Only becasue database grants were assigned automatically to everyone who required them.

The only secure way of collecting data is not collecting data at all.

> but Uber as a company is very ethical

You've got to understand how directly this clashes with the media coverage re: driver rights.

How would you even know if "something nefarious or even careless was being done"? If there are thousands of employees, wouldn't it just be difficult for everyone to know what everyone else is working on, other "secret initiatives management has sponsored", etc.? There could be so many things happening right now where the information is "above your pay grade". My point is that even if the CEO or CTO or anyone else makes these statements, it's easy to be skeptical considering Uber's history and ethics.

I know many companies that allow one to report issues much higher in the chain, have "no retaliation" policies, and so on, but it's really a stretch to ask employees to fully trust the system and worse, ask people outside the organization to trust the employees and the system.

If only need 5 mins after the trip, Uber is in strong position as large user to work with Apple on how to extend the existing background API to cover its use case.

> but Uber as a company is very ethical and takes the responsibility that we are entrusted with very seriously.

Look I'm sure you believe that but there's many many many many data points that show that that's just not the case.

> Uber as a company is very ethical

There are fairly substantial quantities of legal documentation that are evidence against this remarkable claim. They get covered here frequently.

This kind of fraud happened to me three days ago. I filed a complaint with Uber and they resolved the issue. I certainly think something should be done in the product to help with this, but there may be better options, including letting the user click a button to declare that the trip is over.

Thanks for providing your perspective. Did anyone question the decision to remove the option of only allowing Uber to use location while using the app? That would have been a reasonable way to gather data but allow people uncomfortable with background tracking to opt-out.

>trust a company with such personal information, and certainly I wouldn't either, but Uber as a company is very ethical and takes the responsibility that we are entrusted with very seriously.

HAHAHAHAHA Nice try!

> The ride-sharing company said that between July and December 2015, it had provided information on more than 12 million riders and drivers to various U.S. regulators and on 469 users to state and federal law agencies.

http://www.huffingtonpost.com/entry/uber-customer-data-priva...

>the company's blog titled "Rides of Glory." The company examined its rider data, sorting it for anyone who took an Uber between 10 p.m. and 4 a.m. on a Friday or Saturday night. Then it looked at how many of those same people took another ride about four to six hours later – from at or near the previous nights' drop-off point. (...) Uber has deleted the blog post

http://www.marketplace.org/2014/11/18/business/final-note/ub...

>Earlier this month Angie Bird woke up at her home in London to discover she had been billed for a series of minicab journeys she had allegedly made the previous evening … in the Mexican cities of Guadalajara and Aguascalientes, more than 5,500 miles away.

https://www.theguardian.com/money/2016/apr/22/uber-scam-hack...

>Uber is using GPS to punish drivers in China who get too close to protests

http://fusion.net/story/150389/uber-is-using-gps-to-punish-d...

>Study: Uber and Lyft have ‘pattern of discrimination’ against black passengers. Waiting times for black Seattle passengers were 35% longer, and Boston drivers cancelled rides for black passengers more than twice as frequently, study found

https://www.theguardian.com/technology/2016/oct/31/uber-lyft...

>According to internal Uber emails, the investigation began with a note from Uber’s general counsel, Sallie Yoo. The day that Schmidt filed the complaint against Kalanick, Yoo sent an email to Uber’s chief security officer, saying, "Could we find out a little more about this plaintiff?" The request was forwarded to the company’s head of Global Threat Intelligence, Mathew Henley.

http://www.theverge.com/2016/7/10/12127638/uber-ergo-investi...

>Uber as a company is very ethical and takes the responsibility that we are entrusted with very seriously

Please go with your bullshit somewhere else.

A simpler option would be to get the customer to also swipe to end the ride (as an option). This way you get two sources for the end of the ride?

I'm sorry but Uber has broken the law in how many different cities, and you have the gall to call Uber "ethical"? Um, no. Uber is not ethical. Uber willfully breaks laws they don't like when they think they can get away with it.

Why should I EVER trust Uber to obey the law or act ethnically towards me, when they already why as if laws are optional?

Uber can get fucked.

> but Uber as a company is very ethical

IPO, new management, all that data to sell. or (more likely) Bankruptcy, all that loss to recoup

Ethics of today don't mean a thing.

Then by all means, track the driver always but the passenger should have the option of "only while using"

> We were told the reason to track up to 5 mins after the trip is for fraud

Yes, sure. There is always some sort of "reason" to "justify" mass surveillance. F that.

It's just NOT acceptable. I'll never use Uber again.

So to paraphrase "I know we had problems in the past - but trust us, we're good guys!"

Put your money where your mouth is - explicitly state in your terms of service specific safeguards of my data and large monetary rewards for a beach of those terms on your part...you never do anything bad with our data right? This should be easy...

Remember: If you're not in the USA, then US law doesn't protect your privacy! And US privacy law is nothing like EU privacy law.

Has Uber considered reforming as a European company, under EU data protection law? That would a nice way to show that you take privacy very seriously.

idk if i'd trust anything uber tells me if i worked there.

same would go working at any sufficiently large org

Currently, I live in one of those large building complexes and have seen the related changes you bring up. The app has updated to show the different spots commonly used for pickup/drop off and I clicked on one of those instead of moving the pin every time like I used to.

Surely they can get the pick up points from the drivers data, can't they flag where the found the passenger? Why would they need it from the users side too?

That's nice you believe that, except for the fact that only a few years ago Uber tracked the location of a Buzzfeed journalist from God mode, and was accordingly fined for it.[1]

In 2014, senior executive Emil Michael suggested using their service to dig up dirt on reporters.[2]

They further tracked a Buzzfeed reporter when she was late to a meeting with one of their executives, without her permission.[3]

The Uber data science team once used sensitive customer data to find a correlation between their ride data and prostituion, which was highlighted when it was quietly taken down.[4] Lest you think this was a one-off blog, then I refer you to the one entitled "Rides of Glory" [5] that tracked the one-night stands of their riders (you just can't make this shit up).[6]

At Uber's Boston launch party they thought it would be hilarious to track 30 users in what they dubbed "Creepy Stalker View", and one executive, Chris Sims, was shown travelling around in a car - live - causing him to quit the service in outrage.[7]

1. https://www.google.com.au/amp/www.theverge.com/platform/amp/...

2. https://www.buzzfeed.com/bensmith/uber-executive-suggests-di...

3. https://www.buzzfeed.com/johanabhuiyan/uber-is-investigating...

4. https://www.google.com.au/amp/venturebeat.com/2014/11/24/ube...

5. https://web.archive.org/web/20141118192805/http://blog.uber....

6. http://www.marketplace.org/2014/11/18/business/final-note/ub...

7. http://www.forbes.com/sites/kashmirhill/2014/10/03/god-view-...

Can i email to dev for suggestions to eats@uber.com ?

as a fun exercise... I am going to find out how many employees Uber has. From there, who knows. Lol.

#username_might_check_out

Please send this message to management: "fuck off". Thank you.

> Uber as a company is very ethical

Nice try, Travis Kalanick.

A ha! This thread has reminded me to check whether Background App Refresh might block this. Apple's iOS Developer Docs seem to strongly imply that's the case [1]:

> Important: A user can explicitly disable background capabilities for any app. If a user disables Background App Refresh in the Settings app—either globally for all apps or for your app in particular—your app is prevented from using any location services in the background. You can determine whether your app can process location updates in the background by checking the value of the backgroundRefreshStatus property of the UIApplication class.

Time to go disable Background App Refresh for the Uber app and leave location as "Always".

Edit: Yep! Disabled Background App Refresh and verified after a bit that the little "Some app is using your location" icon went away. Spread the word (and please Uber Engineering, don't try to stop us...)

[1] https://developer.apple.com/library/content/documentation/Us...

Thanks for this workaround, the description and the link. As disturbing as it is that Uber is subjecting paying customers to such despicable treatment, I'm glad to know that there is an easier workaround (for iOS users) than turning on and off the location services permission before and after each ride to control this!

I don't have Background Refresh on at all (for any apps) since I find it draining the battery a lot for very little practical benefit for my usage.

Weird, this probably did/does not work for me. I had Background App Refresh for Uber and several other apps off for a long time, and I was presented with the notification that "Uber is using your location in background" yesterday. I did not use Uber yesterday.

I really wish that both Android and iOS had an option to outright prevent an app from doing anything in the background. No sensors, no location, no push notifications, no network access, no CPU time, URL protocols, no nothing. If I don't click the little app icon, the app shouldn't run, full stop.

I wish iOS forced all apps to offer "Always/While Using/Never" for location info. It's bullshit that Uber can refuse to offer the middle choice.

A thousand times this.

So...Uber has Always/Never functionality and you propose and change that makes the user choose Always/Never/Never?

You can install Greenify to do exactly this. It helped me kill some pernicious apps that I needed once in a while but that would run all the time, killing my battery (I'm looking at you, Mi Fit).

The only annoying and inexplicable thing is that some apps run their own background process for push notifications, rather than using GCM, so pushes stop coming in if you kill those.

I think it's ridiculous that you need an app to approximately control other background apps. Denying background access to the phone should be the default. Anything else should need a permission popup IMO.

iOS gets close to what you want. Apps have to ask for specific permission for specific reasons (location, background download, etc), otherwise it just get killed after a few minutes.

Security is always at odds with convenience. It's easy to require a pop up to ask for permission every time and have user getting so used to these pop ups that they just automatically tap "yes"

I agree. Apps shouldn't be able to just run background processes willy-nilly, and I hate how that drains my battery for no good reason.

> The only annoying and inexplicable thing is that some apps run their own background process for push notifications, rather than using GCM, so pushes stop coming in if you kill those.

There are valid reasons for this, e.g., if you want your app to work on Android devices without the proprietary Google applications.

I don't know which android distribution you're using but mine has that. Can recommend Cyanogenmod with privacy guard to everyone: it allows you to deny wake locks to applications. After doing this my battery chart is flat for 6 hours straight if I don't use my phone (I think that's the longest time I've tried).

Telegram is the only application with wake lock permissions left. I once even tried denying my lock screen the permission, which was a mistake... Took a while to turn the device back on.

I use CyanogenMod, and denying wake locks doesn't solve this problem. An application can register to receive any number of events that will wake it despite a lack of wake locks, like geofences, alarms, push notifications, waiting for another app to wake the device, etc.

It's the same reason that denying the permission to automatically run on boot is basically useless from a privacy perspective -- the application will just automatically run when some other event happens.

iOS gives you the option to disable Background App Refresh either for all apps, or for individual apps: Settings -> General -> Background App Refresh

so this will disable location and all other data for uber if its not in the foreground?

That's a separate option.

Settings -> Privacy -> Location Services -> Uber -> Never

I'm don't know why you were downvoted, background refresh has nothing to do with the location setting.

thanks!

It's tricky to get the ux of this right. Say you don't want to give Firefox background access because it should only be active while you are actively browsing. Then that one time when you are about to download a 4GB iso, you start the download and minimize the app or even close the phone, when you get back the download was cancelled after just 2%. :(

Not saying it can't be done, just that there are many corner cases that can easily "break the internet" for non tech users if not handled in a smart way.

I think that many of the corner cases (background downloads) are cornery enough to justify giving users the options. The UX is hard, totally, but it's worth it.

Android can do that if you enable developer tools. Not sure if it can be easily overridden by an app or not

If you kill an app on the iOS, it stays dead until you launch it again, iirc.

it stays dead until the system decides to reload it. It may decide to do this for various reasons such a entering a geofence, significant location update, or push notification. But turning off background app refresh should prevent all of these things from turning on your app I think.

Also low power mode can also be used as a sort of incognito mode because it stops all background activity to preserve battery.

And you can turn all of those items off in the app's settings. It might be annoying although because it wont work as you want. It would be nice if apple added a general 'turn off all background activity' permission switch.

Have you checked? I stumbled on it myself with background network, background upload requests get killed when the app is killed, and they don not resume even if you relaunch the app. I have a hunch all other background actitivity is the same way.

Geofence, significant location change, and push waking up the app don't happen on user forced shutdown. App urls though are a different matter. :)

I am not totally sure of geofencing.

>" It may decide to do this for various reasons such a entering a geofence..."

Can you elaborate on this? Whats the connection with relaunching and a geofence?

I haven't worked with goefences, but I'm guessing you can tell the OS you're interested in receiving particular geofence events such as when a user enters one. So the OS will relaunch apps which subscribed to those events so they can act on it.

Someone who has actually worked with geofences, please correct me if I'm wrong.

Geofencing notifies your app when its device enters or leaves geographical regions you set up. If the App is terminated iOS will relaunch it IF the user gave it "Always" authorization for sharing location.

To prevent data from being used by the Uber app on Android I enabled data server mode, and from there denied the Uber app from having unrestricted data access (settings > apps > special access > unrestricted data access). This allows me to still use the Uber app and request a ride, and I'll receive texts once the car is near.

Last week during Thanksgiving travel I received a advertisement from the Uber app (as a notification) when I arrived at the SFO airport, even though I did not use the app at all that day. That's when I decided it was time to take away the unrestricted data access. I do agree that it would be nice to have better privacy options for each app, but I thought I'd share this workaround for the time being.

I thought that Cyanogen had something like what you are describing. Can anyone confirm?

Confirmed. See my previous comment.

I'm pretty sure with most Android phones you can kill applications that are sent to the background immediately.

Would be nice. But, then only the carriers and the platform owners get to track you. That's not really fair, either.

I want effectively a phone that works like Sandstorm. :) If I want it to have a right outside itself, I'll grant it.

Turning off Background app refresh and removing the app from the recent apps list will accomplish this.

You can do that already with user exposed controls on iOS. Just force shut down the app.

Not even for messaging app?

I don't think they're suggesting a single toggle for the whole phone, just that it be a setting you can force for individual apps. You'd only do it to apps that have no business running in the background like Uber.

An option. Not a requirement for all apps.

iOS does that?

You can set location permission for App with "Never/While Using/Always".

You can disable Background App refresh for individual App. iOS App didn't even have ability to run in background in previous version.

You misunderstand. The App apparently can refuse to opt-in to the While Using option (Uber now only has Never/Always). This is ridiculous, and Apple's fault.

There is something very powerful you can do:

1. Stop using uber. Delete it. There is Lyft and Juno (in select markets).

2. Tell your friends about the dangers of using Uber.

You can make a profound change by voting with your pocket book. Lastly, believe it or not, a lot of your friends look to you for tech advice. Be vocal.

This is likely to work about as well as when a large number of tech people went around telling all their friends that Microsoft was evil in the 90s and early 2000s -- which is to say, not at all.

Empirically, very few people care much about their own privacy, and they seem to be entirely uninterested in hearing sermons on the topic. It'd be great if that worked, but it doesn't, so that won't solve this problem.

Windows, an OS, was not a commodity. Uber's service is.

When people ask why I use Lyft instead of Uber, I tell them about their sleazy actions a few years back (journalist intimidation, "god mode", etc.). I now have an up to date example to add.

Thanks, Uber!

Surprise. If you have an AT&T Samsung phone you can't uninstall it. The best you can do is go into Application Settings and Disable it. And then make sure you answer the two confirmation dialogs correctly for it to actually get disabled.

And guess what? It's already running. Even if you haven't used the app any time recently.

> Surprise. If you have an AT&T Samsung phone you can't uninstall it.

Can't you flash the ROM to reinstall Android (e.g., Cyanogen) without any built-ins of this kind?

Sure. If you're a techie that doesn't have a work provided phone with restrictions from doing so.

Tomorrow Uber competitors will start tracking people location too. One or several people that stopped using the app because of this doesn't mean anything because there are millions who continue to use it anyway.

"Tell your friends about the dangers of using Uber."

Please, honestly, tell me what I am in danger of. How could Uber tracking me for 5 minutes after arriving at my destination impact upon my life in any way?

There's nothing to stop the competition from doing the same.

The real issue is absolutely zero consequences for invasion of privacy.

I despise apps that do "Always" or "Never" for Location Tracking. It's really reflective of the larger issue of control of data, but this is particularly galling when the app hasn't given you an option nor a good reason for "Always" tracking. I'm always surprised when each iOS update continues _allowing the app to define available choices_ instead of giving the consumer the "While Using" option for any app requesting location.

Part of this is due to limitations in how iOS communicates this to users. "Always" can refer to either (1) always-on GPS, or (2) Bluetooth, which will ping app-owned beacons. The Bluetooth option is significantly narrower in scope, but uses the same dialog as the GPS.

I worked for a company that relied on Bluebooth beacons to provide a critical app experience (notifications before app itself is opened), so the app blocked the login screen until the Bluetooth-driven "Always" location authorization was granted. It was a headache explaining to users.

"Uber collects your location data from the time of trip request through five minutes after the trip ends, including when the app is in the background."

From source listed in the article: https://help.uber.com/h/ba9dd342-158d-421f-a9ea-0e6c7aaad726

The linked article mentions that you can select "Never" so as not to share your location with Uber.

However, on iOS at least, the latest version of the app is pretty much unusable when you do so. I did write to Uber regarding this a while back and the response was basically "Thank you. We'll forward it to the appropriate team." I suspect that they'd anything about it as the current functionality is by design more than anything else.

Well, so says Uber.

Unfortunately their history has proven to me that they're an utterly untrustworthy company and some lofty PR bullshit certainly won't change my opinion on them.

Counting down to the FBI NSL'ing [1] Uber for persistent, warrantless surveillance...

[1] https://www.eff.org/issues/national-security-letters

They don't need to, since they have the much better source of cell phone carriers with 24/7 location. And google android OS and apple to a certain extent.

Yes, people are like "oh NSL". Are they not paying attention to carrier access, stingray, general SIGINT? Like really this is HN at its most ridiculous.

Or in countries which have family registries it can be used to track people who fail to update the registry or move to a city illegally in places where intra-national movement is restricted.

"The website “https://help.uber.com” would like to use your current location."

I think its pretty relevant if someone is looking for uber help that they could use the location to help narrow down who should be dealing with the issue...

While their explanation is reasonable, I have little reason to trust a company that settled an investigation specifically about location tracking abuse.

I've pretty much dropped their app and switched to their mobile site, which is bound to my browser's location settings. Additionally I'll only use them if they're significantly cheaper than lyft from now on.

> While their explanation is reasonable

Their explanation is illogical:

> Previously, Uber only collected data from the user if the rider had the application open. Now, if a rider calls for an Uber and closes the app, Uber says it will continue to collect location data up until five minutes after the ride ends. That means Uber can see where you end up after you leave the car.

That's the change; the reasoning for this change?

> Uber hopes to eliminate the most frustrating part of the experience: the game of phone tag that both the rider and driver play when trying to coordinate the pickup spot.

That, of course, doesn't occur in the five minutes after I get out of the car. They of course mention more generically,

> "We do this to improve pickups, drop-offs, customer service, and to enhance safety," Uber says on its website.

But that's not really enlightening … and not a convincing reason for having it persist beyond the app being open.

> That, of course, doesn't occur in the five minutes after I get out of the car.

The logic is that it is likely that you will likely use Uber to go back as well. And they can't track your actual pickup spot unless they keep the tracking always on until you are picked up, which will be way more than 5 minutes.

> Uber hopes to eliminate the most frustrating part of the experience: the game of phone tag that both the rider and driver play when trying to coordinate the pickup spot.

This makes no sense to me. I tell them the pickup point so they don't need to know where I am since I already told them where I want to be picked up.

Conversely I found it very frustrating they didn't (used to?) take destination into account. Example: I want to go south. They should arguably prefer drivers that are north of me. Instead I'm just guessing they just ping all drivers within some range. Some of those drivers are south of me. In a city like SF that can end up adding 5-10 minutes to the wait because they may have to go 3-6 long blocks around to get north of me so they can go south AND so they can pick me up on the south bound side of the road.

It requires no GPS data from me to know that. It only requires that I enter where I want to be picked up and where I want to go.

I suppose it's possible I'm waiting on the north bound side even if I want to go south. Maybe they could ask "we'll pick you up on the south bound side. Ok?" or something to that effect.

I think there's a lot of variance between people, and it's largely a matter of preference. Some people are happy to walk a block or two in order to make the most efficient trip depending on where the driver is approaching from and where they're going, and some people just want to plop it down and not think about it and have the company/driver figure out how to come exactly to them and figure out which way to go.

I always feel like an oddball for calling my driver to make it more convenient for him (and faster for me) to pick me up. I usually Lyft line it though, so it's just a time boost (price is the same either way).

For Uber and UberEats I now manually manage these in Android (which I do for a few other apps I have lower trust for).

Which means I shut off all permissions between uses, and I block all notifications.

I grant Location, only as needed to get a driver or place an order.

Once I'm in the car, I turn airplane mode on, deny all permissions and notifications, and I reboot the phone.

Isn't it crazy that this is where we are now. Invasive tracking has become so normal that I have to manage the access an app has in such a tightly constrained way.

I'm starting to think a 2nd device that I leave turned off 99% of the time would be an easier way to sandbox apps I don't trust.

No taxis in your area? Maybe a central phone number you can call to hail one? Why Uber and all this trouble?

My guess is because Uber is subsidising the ride and providing convenient bill paying options.

I'm in London, and public transport is good enough for most journeys, and I loathe black cabs far more than I feel anything (except distrust) about Uber.

Uber works wherever I am in London, it's cheap enough (realistic compared to black cabs).

It's good enough, but not good enough that I'm fine with their various invasive activities. One not mentioned elsewhere is how they use both rider and driver mobiles as a kind of distributed cache/database. Which is the thing that started me off on "kill the background process", initially to spare my own data and battery.

Have you tested any automation apps for Android like Tasker [1] and Automate [2] for doing all this automagically?

[1] https://play.google.com/store/apps/details?id=net.dinglisch....

[2] https://play.google.com/store/apps/details?id=com.llamalab.a...

Both look nice, but it also looks like neither can manage app-level permissions (enable/disable Location) and preferences (block Notifications)

I think there are some plugins for doing that, for example

https://play.google.com/store/apps/details?id=com.intangible...

This requires the super-sensitive WRITE_SETTINGS permission, which must be granted manually.

That's basically what I do. I have a spare phone with a pay as you go number that I give out and use for other services that want my number. It's basically a dedicated spam phone/number.

Yeah, after being a "dozen rides a week" Uber user for the last year, I switched to Lyft. There is just no reason for this.

It doesn't change anything, but as the Uber engineer above lists, they have rational reasons for wanting it.

I just don't have any rational reason to want to give it to them, so I'll be disabling GPS entirely. But I've mostly stopped using them anyway - the scummy corporate behavior bugged me, but not enough to boycott. And then a driver nearly physically attacked me over, as best I can tell, mishearing something (although I'm not really sure). Those combined, along with a general dislike of the gig economy and I've already mostly ditched them - Uber feels somewhere between sketchy and icky to me. Used them once in the last ~6 months, when the Lyft app forgot my password and it was late.

How do you know Lyft doesn't do that? Any blogpost, article would be helpful. Thanks.

> How do you know Lyft doesn't do that?

They let me not let them. Lyft lets me tell iOS to share my location with it only "while using the app". Uber used to do this. But now that option has disappeared--it's only "always" or "never".

Waze doesn't allow "while using the app" either making it unusable unless you give it unfettered access to your location at all times.

As soon as they did that I stopped using Waze. My battery life also improved significantly as a result.

You don't know until someone investigates, obviously. But if you have to choose between an app that definitely does that and an app that might do it, it makes sense to use the one that might in the meantime.

There's an opportunity for Lyft to be "Uber, but for not scummy business practises" here, but I suppose most users don't really care. Austin would have been a good test of that, but Lyft withdrew along with Uber.

Lyft, sadly, doesn't seem to have the talent it needs to pull this off. Although they're still worth something, it just doesn't seem like Lyft will be able to eke it out unless something really game-changing happens to Uber.

I've been a longtime Lyft user because of the stories that surfaced a few years ago about Uber considering blackmailing reporters and politicians with their ride data, but the last time I had to use the app, Lyft for some reason just wasn't working - their auth service seemed to be broken. I ended up downloading Uber and signing up because I had to get somewhere in a hurry and didn't have the time to look up another rideshare service. Their text notifications about driver arrivals are also always off, on the order of up to a minute or two (I don't know if Uber is better, but I would assume it is.)

FWIW, I'd also sunk something like $300 into Lyft rides just two weeks before that for business travel, and I didn't experience a problem once.

Lyft engineer here, so bear in mind any bias, but we take account and data privacy very seriously, and have a data privacy team which focuses on these kind of issues.

From where I stand, we have great engineering and product talent. Perception is tricky - I see that we're very agile with (sometimes far) fewer resources, from the view I have.

I'd be glad to dig into the auth issues you ran into if you're able to ping privately with a few more details.

There's also the "god view" scandal which Uber definitely did get sued for (there haven't been similar lawsuits against Lyft) https://www.buzzfeed.com/johanabhuiyan/uber-settles-godview

On iOS at least - the (current versipon of the) Lytf app specifically asks " … to access you location while you use the app." Uber _used_ to have a "while using the app" location option, but the recent update took this away so you choice is either "Never" give it location info, or "Always".

It's hard to prove falses like that, but Lyft doesn't appear to have such verbiage in their TOS.

I'd hate to be proven wrong about that, but grateful if I was.

It's in the app permissions!

> Uber collects your location data from the time of trip request through five minutes after ends trip ends, including when the app is in the background. We do this to improve pickups, drop-offs, customer service, and to enhance safety.

Meh, sounds reasonable as long as they don't collect data outside this window (although they should not make it all-or-nothing, a third option of "While in use" would be better).

This is how the Overton Window shifts.

Trouble is, now I have to walk 5 minutes in the opposite direction before turning around and meeting my dealer / going to the brothel / whatever you don't want posted on paste bin.

Another issue arises when a "bug" records your location for 5 hours instead of 5 minutes.

Yup, which is a strong possibility for Uber. I had an Uber charge me for a ride that continued for 12 hours after I had been dropped off. Uber had no problem billing me >$300 for this. If they don't have safeguards in place for questionable fare collection, they surely don't have safeguards in place for questionable data collection.

I'm not saying that didn't happen but it makes zero sense. The user chooses a destination and the app tracks where the driver is so it's reasonable to assume if the driver got within 100 meters of the destination the ride ended within 1-2 minutes of that time. They should just pad by 1-2 minutes and then assume the ride ended.

In fact they could make it the exception not to end it by sending a "How was the ride" message to both driver and customer and they both have to pick "Not finished" for it to continue.

Can you manually Force Stop the Uber app to avoid this as a somewhat-awful workaround?

On a rooted Android I use Greenify for all apps that I don't want running while I'm not using.

Without root, you could force disable the app when not using, but you would have to re-enable it manually.

"While in use" is exactly what they used to do. It allowed the driver to see my location as long as I left the app open. Now the uber app is unreasonable. It demands permission to stalk me at any time, else I use a hobbled version of the app.

The problem is that there is no user-facing setting that can say, 5 minutes only. So going from 5 to 10 to always becomes a decision that can be taken without informing the user at all.

It's a very reasonable reason. It sounds like something that would be reasonable to expand the APIs on the OS to allow and enforce.

I ranted about this last weekend. No app, positively no app, gets "always" access to my location info. I don't care what their "privacy policy" says.

I'm annoyed Apple even allows this. It shouldn't even be an option.

Clearly iOS needs more fine tuned permissions. I can share my location with a friend for an hour. I'd Uber wants 5 minutes worth then they should be granted 5 minutes worth. Not infinite and unlimited.

Uber used to work just fine with "while running" permission. They're removal of that is extremely user hostile. I deleted the app and will use Lyft instead. I suggest everyone do the same.

Waze also made a similar change. Waze also got deleted. We must not accept this behavior.

One thing iOS shouldn't allow is for apps to pick this all or nothing user setting. Apps should be forced to deal with user changing the location setting from always to only while using. If its an option in the OS , app developers, especially big ones like Uber will build for that experience.

Agreed! You should be able to give access to GPS only when running the app, I really do not like the All or Nothing policy. After all, there is no reasonable reason to justify the use of any phone resources when not using the app. In my phone Waze keeps using the GPS even if I kill the app and even after a fresh restart! I obviously deleted Waze now, but not without regret. :-(

Agreed. I deleted Waze yesterday and set Uber to "Never" until they fix this.

This is the perfect example of development for the sake of development. The new user experience is terrible and provides the user with zero extra benefits.

I seriously can't see how a product manager signs off on these updates.

I live in NYC with a lot of one-way streets, including my home. I actually use two different addresses for my home depending on whether I'm being picked-up or dropped-off. Otherwise, when being dropped off, Uber has sent me on some really odd detours just to get me exactly in front of my house. Instead, I'd rather get dropped off at a corner and walk 200 feet.

In theory, by collecting the location data 5 minutes after, they can get a sense of this where and to whom this happens, and automatically correct for it. I don't know if it'll work, but if it does, it'll definitely be a benefit to me.

This is exactly the kind of application that the data is going to be used for.

Says Uber.

Unfortunately - based on their history - you're working for an utterly untrustworthy company, no matter the smiley face of nice they're trying to paint themselves nowadays.

This is not directed against you. I appreciate that you're hanging in here and participate in the discussion.

They don't care about stupid routing. Uber in Chicago routes through alleys ALL THE TIME, but trying to talk to Uber support about this is a dead end. My home address is a street address, but Uber moves the pin to the alley.

That's a fair point, and I've lived in NYC briefly to know that it is indeed annoying to see the driver do circling around in traffic to get exactly to the door.

You can use AI to solve it, or you can give the user power to tell the driver that he/she is willing to work a little bit. A simple button may have been suffice

But why wouldn't you just speak to the driver?

Generally, that's what I used to do, but a lot of drivers are now so dependent on the GPS that I have to give street-by-street instructions.

What about in a couple years, when there is no driver? Better getting this working now while there is still the fallback of human interaction...

The Product Manager's bonus probably depends on timely release of new features.

This isn't "development for the sake of development", no data collection is for that. This is to figure out where people are going. Addresses give you an idea, but they're not always precise. You may just give an intersection. Now, they're trying to figure out your actual destination.

They're going to use this for monetization somehow. It's always about monetization. '

It's about self driving cars. So they know where to drive you to; to actually get somewhere.

That doesn't make any sense. Think about it. How does a cab driver get you to your location? Well you explicitly tell him by giving an address, or the name of a POI, or drop a pin on a map. You're then taken to the location you specified. Now, as you approach the location, you make a choice to either finish the ride, or abort it early by telling the driver, "Hey, this close enough. Just let me out wherever." At this point, the cab driver doesn't care, as long as he gets paid and you're happy it's a successful transaction.

So what does following you do? Well it finds your actual final destination. Which restaurant. Which house. Which apartment. Which store. So that brings up two questions. First, how does this true final destination information give a better rider experience? Well it's not exactly clear, since the rider gave explicit destination information at the start of the transaction, or explicitly ended the ride when they became satisfied. So, what's in it for the driver? Well that's not clear at all either, since rider was already satisfied and the driver got paid.

So what doesn't it do for Uber? Well, now they have popularity of specific POIs. Which bar. Which restaurant. Which store. That's valuable information. You could use that to deduce rider profiles that include things such as taste preferences, and income level. Then you can use that information for differential pricing (e.g. "This dude has a bunch of disposable income, charge him an extra two bucks.")

I'm sure there's other things you can do with it, but my point is that it's not useful for navigation, at all, but does give economic information which could be squeezed, and attempts to squeeze all the money they can from essentially a car service on demand app, is Uber's MO.

In iOS, most apps request your location "Always", "While Using the App" or "Never". I had Uber set to the second; that option is now gone. It's always or never. Set it to never; this makes their app less usable, but that just nudges me to use Lyft, Juno, et cetera.

This makes the app flat out not work for me. I just get blank panes top and bottom.

https://s11.postimg.org/by249fhsz/IMG_1459.png

Yep, I've got exactly the same yesterday until Uber asked me to grant "Always" location tracking. Not only I dislike the forceful location grant but they had a bug that didn't prompt me for it until I rebooted the app twice :)

Can you set it to never, set it to always while using it, and set it to never when the ride ends?

Yes. And I've been doing this for the past week (Uber integrates better with Concur, which we use for expense reporting). I finally reinstalled Lyft, but I just don't take personal rides that often.

Putting aside all the other arguments regarding privacy, ethics, etc, I have a more acute issue: battery life. I allow almost no app "Always Using" privileges on location because of battery drain. I saw this update on Uber yesterday and now i've had to literally turn on and off Location services altogether when using/not-using Uber to prevent potential battery drain.

Over the weekend, now I need to run a test to see how Uber performs on the "24 hr Battery Usage" stats with Location always on. That is a lot of work for a retail device, but I'm also so dependent on Uber now (gave up having a car!)...

I can't say I'm heartbroken that Uber disabled my account after my card on file was replaced (thanks Home Depot!) and I didn't update it. This wasn't even tied to requesting a ride, I think I'd opened the app to see what coverage in a suburban area looked like.

IIRC the "get my account back" process was going to involve sending a copy of my drivers license and the dead card which had been cut up several months earlier, and it just wasn't worth the hassle of even following up.

And this was even before all the "all your ride of shame are belong to us" brouhaha - so now they want to track your walks of shame as well?

Why do we accept this intrusion into our lives?

I accept it because I don't really care if Uber knows where I am for a couple of minutes after they drop me off. Not everyone's cup of tea, but if you don't like it there's nothing stopping you from uninstalling the app.

Any you trust them (as a company) that they'll "only track you for 5 minutes after using the app", and you trust each of their staff members will have controlled/secured/audited access to only the 5 minutes location data after a trip, and you trust them to never deploy a production bug in their tracking code, and you trust every law enforcement or business partner request for that data including gag-order-backed-NSLs.

And that's OK - if you're good with that. Now go and ask some women you know whether they have all that trust? Or minorities. Or activists. If you were a Muslim or Mexican in the US right now - do you suppose you'd be happy leaving an Uber app with "Always" location tracking permission on your phone past Jan 20th? If you had a close friend legally and peacefully protesting the pipeline in North Dakota right now and you knew they used Uber - would you be checking that they know this?

I reject the position that because _you_ don't really care, that it's OK to "accept" this. Even though _you_ don't care, tell Uber you do not accept this because of what it means for your sister or friends or coworkers or neighbours or your allegedly "freedom loving" society...

>And that's OK - if you're good with that. Now go and ask some women you know whether they have all that trust? Or minorities. Or activists. If you were a Muslim or Mexican in the US right now - do you suppose you'd be happy leaving an Uber app with "Always" location tracking permission on your phone past Jan 20th?

The NSA already has the ability to track cellphones, regardless of what Uber does with their app.

Unless you are using open source phone with your own built chip, Apple and Google may be tracking you without you knowing right now.

How do you know your neighbor are not actually government agency spying on you?

I'm having a hard time reconciling what your problem with this actually is. Firstly you seem to be implying that Uber is going to track you indefinitely (because reasons), and that their dangerous mass-murdering drivers will use this to do something nefarious. Then it's "the guvmint" who you seem to think can't track you already using any of the 5 million other ways your smartphone advertises your exact location, and is now relying solely on a ride-sharing app to know your whereabouts.

And then what? Women, Muslims, and Mexicans are now being targetted? By who? Why? What's going to happen to them? This has been a thing since January, so presumably there's already been at least a dozen abductions?

I don't care about this because there I have no reason not to trust Uber with knowing my approximate location for a few minutes. So no I won't be educating my friends and family on stranger danger, nor will I be explaining to them how Uber is going to get them abducted by G-Men.

What I find funny are the people that accept it when it's a Western company doing it, but then freak out with it's a Chinese company doing it (especially when they don't even live in China).

It's worth noting that if Uber accidentally started collecting location data from every rider's phone in perpetuity while they're not on-trip, it would be a very big problem for Uber. That's an absolutely ridiculous amount of data and would easily overwhelm the service. You wouldn't have to worry about NSLs because the data centers would be a fiery mess of steel and silicon. Even if they weren't, the data is overwhelmingly not useful for anyone at Uber (how many hours of "sleeping at home" worth of data points could ever be used?), and it would be destroyed because it's a giant waste of resources.

Uber is big, but not that big. You're already volunteering your location for the service (by being in a car tracked by Uber), this simply adds a small margin of data at the end of the trip.

This mindset is exactly what is destroying democracy around the world.

I'm dumb, you're going to have to be a bit more explicit here and tell me how Uber knowing my rough location for a few minutes leads to election fraud, or whatever else it is you seem to think is undermining democracy here.

The issue then becomes Uber is doing it so all the other ride hailing apps start doing it.

This is how the Overton Window shifts, and how our right to privacy is rapidly eroded.

If you described 2016 to me in 2004, I'd call you a paranoid lunatic, yet here we are. I'm starting to realize that many of the "alarmist" voices [1] of that time were, in fact, optimistic.

Thinking about what's considered "alarmist" today makes me fear for the future.

[1] http://www.nytimes.com/2002/11/14/opinion/you-are-a-suspect....

This from the company who recently settled a fine with the A.G in New York for uasge of its "god view" tool:

"Uber and New York Attorney General Eric Schneiderman have reached a settlement over the company's "God View" tool, which allowed employees to access and track the location of Uber riders and customers without obtaining permission."

http://www.theverge.com/2016/1/6/10726004/uber-god-mode-sett...

Yeah REALLY obnoxious. I was just disabling this after another Uber ride. They do not provide the option to enable location services only when the app is running on screen. I think it might be nice if iOS presented this option regardless of what Uber wants.

> I think it might be nice if iOS presented this option regardless of what Uber wants.

I delete any application that requires all-or-nothing location privileges; if Uber acts this way now I'm done using Uber.

Being able to make it such that location services are an all-or-nothing proposition when there is clearly support for "only when using" in iOS annoys me to no end. The fact Apple doesn't do this is what is actually alarming, given their stance on "privacy".

>>I delete any application that requires all-or-nothing location privileges; if Uber acts this way now I'm done using Uber.

This is the calculated risk Uber is taking. Presumably they believe that they will only lose a tiny sliver of their user base over the all-or-nothing approach. Now that they're well past the "early adoption" phase in many markets this is a "smart" corporate play.

I am aware of the strategy behind Uber's move. My comment above is "count me out".

I doubt they'll lose even 1% of their installed userbase over this change.

On one hand I agree with you, but it wouldn't work as a unilateral policy. There are definitely apps (such as a weather widget, for one example) that lose major functionality if you don't allow location even when not technically in the app. Either way, I won't be using Uber anymore for this reason.

I denied permission to location as soon as this change happened with the intention of enabling and disabling before each ride.

It's now more convenient to use competitors apps, though, and i haven't actually used uber since the change.

I switched to Lyft because of this.

I wrote to Uber a week back or so regarding this and this how they responded:

  My name is Pratik from Uber support, I hope you doing well !
  Sorry to hear about about your experience.. I completely
  understand that this wasn't the experience you expect with
  Uber.
 
  We are constantly working to improve the Uber experience and
  your input is crucial to doing so.
 
  I’ll pass this along to the appropriate team.
 
  Thanks again!

----

There wasn't a response upon posting a comment to their blog regarding the same.

That's the bullshit response they give you to anything that isn't solvable with a ride credit.

Uber is somehow ridiculously bad with giving directions. Despite manually entering the address for a number of places, Uber insists on directing drivers into unmarked alleys instead of onto the street outside. You know, the actual street that's named in the freaking address. Instead of invading their customers' privacy they could start by just using the information they've been given.

How to delete your Uber account: https://help.uber.com/h/24010fe7-7a67-4ee5-9938-c734000b144a

I actually noticed this - iOS has this nice feature of giving warnings like "Uber has been tracking your location", which was a WTF moment for me because I haven't used Uber that day at all. So in response I've cut its location access completely.

I've also had a similar experience with Waze. WTF are these apps doing with my location while I'm not using them?

Btw, for all the badmouthing I've given Apple and iOS over the years, this is one feature of iOS that I like. But I would have preferred the option to force location tracking only while using the app.

I was going to say that you can choose to only allow access to your location while using the app, but then I checked in iOS. Some apps only have the choice between always and never. Is it up to the developer to remove/put in the option "While Using the App"?

Isn't it reasonable to want a taxi service that doesn't track its customers beyond 1 single ride? For example, a regular taxi paid with cash?

I'm fortunate enough to have a small taxi service that operates near me. I probably spend more but I like their API: call the phone number and get a ride.

What about using m.uber.com with a browser that sandboxes location data requests effectively?

"Uber collects your location data from the time of trip request through five minutes after the trip ends, including when the app is in the background" -- Uber.

Is this legally gray, or am I paranoid?

Not-scary Interpretation 1: Uber collects location data from t_0 to t_1 regardless of whether or not the app is in the background.

Scary Interpretation 2: Uber collects location data from t_0 to t_1 and when the app is in the background.

I'm surprised they didn't start doing this 4 years ago.

Location data is really fucking good data to have on people, which is why I would rather not be giving it away willynilly. Additionally, Uber's service is one of the few services where getting this data can be justified and seems less creepy.

The situation is getting serious in general. There are many many apps that people use daily. How can one find out what data is being collected per application? It would be really nice to a have a web site where the community (technical people who can inspect the apps) could maintain this information per application and a user could see a simple green/red bullets and decide whether the app is worth it or not. Really, really high level, designed for end-user (non-technical).

F-Droid shows a list of antifeatures[0] along with the description of each application. Here is one example with the "tracking antifeature": https://f-droid.org/repository/browse/?fdid=at.tomtasche.rea...

[0] https://f-droid.org/wiki/page/Antifeatures

I had to restore my iPhone from a week old backup in order to get the previous Uber version back. It's a shame there's no easier way to downgrade an app on iOS.

There is, but only if you update apps in iTunes on your computer instead of directly on your iPhone.

Basically, update the app in iTunes (which will send the old IPA package (which is still signed to your Apple ID) into the Trash / Recycle Bin, then connect your iPhone to your computer and sync to replace the old app with the new one. You’ll still have the old IPA package in your computer’s Trash / Recycle Bin, so if you ever need to downgrade to the older version of the app, just move it out of the Trash / Recycle Bin, delete the newer version of the app in iTunes, and then double-click on the old IPA package to have it open in iTunes. Then, you can just connect your iPhone to your computer and sync.

There is no chance whatsoever that I'm going to give Uber access to my location while not using the app, so this just makes it harder to me to be a customer.

Ethics. I'm not sure when ethics will matter again. We almost need a movement from startups that promise certain ethics. It would be a refreshing change.

There was an episode of the american version of the "modern Sherlock Holmes" TV series, "Elementary", where the plot revolved around a company akin to Uber (called Zooss in the show). It was particularly illustrative of how tempting it can be for internal employees to abuse that type of data. Among other things Sherlock was able to requisition a large fraction of the company GPS tracking data for his murder investigation. As a side effect he was able to figure out who was having an affair, who was going for an interview at a competitor's company, etc.

5 minutes after drop-off is quite enough to uncover where you meant to _really_ go if you gave a close-by address, in these scenarios.

That's pretty much what the OP meant with "So your secret rendezvous may not be so secret" but it's particularly poignant in a TV show.

I noticed this in the past two weeks - as a result, if I use Uber, I toggle it on, and afterwards I turn it off. This is pretty crappy, I don't need an app punishing my battery by default just so they can collect more data.

It really makes me think twice about sticking with Uber.

Uber also charges significantly different prices between users.

My friends and I did a test and each time, I keep getting charged at least $6 more.

https://www.youtube.com/watch?v=EMm4ehc7oCw

That's clever of them. Perhaps your elasticity of demand is lower.

I was a huge fan until now. I'm really disappointed that they pick and choose who they think should pay more for the same ride.

I'm not. It's called "price discrimination" and if you don't do that at your business, you should. Whenever you hear a fun story about enterprise pricing, that's what it's talking about. Mobile phones make it more specific.

Uber is really a scummy company. And given their track record with absuing user data, I don't trust them at all with this new expansive data collection effort. Let's review the company shall we?

The CEO, Travis Kalanick, has used God View to monitor people for entertainment.[0] The head of their NYC office also go into hot water over using God View inappropriately[1]. At other companies, these would be fireable offenses. No second chances. Deactivate the counts. Escort them to the door. Mail them their stuff. At Uber, it's totally cool brah.

There's the whole "you're not our employee, but we pay you, and tell you where to go, and how to act."

They explicitly target low income people to be their totally-not-employees, through direct mail, and their "urban" "Get your side hustle on!" commercials.

Their auto financing product is predatory.[2] It explicitly targets people bad credit to lease a car they can't pay for unless they're constantly totally-not-employed-with Uber. The interest rates are usury levels of 22.75% APR.

Then of course there's the whole, "Fuck the law!" aspect of the company.

[0] http://www.forbes.com/sites/kashmirhill/2014/10/03/god-view-...

[1] https://www.buzzfeed.com/johanabhuiyan/uber-is-investigating...

[2] http://www.marketplace.org/2015/05/13/tech/uber-drivers-stru...

I take issue with your summary. You forgot arrogant and douchy antics, documented in interviews, personal accounts, and other places.

When I visited them, I found the company was full of very young, very naïve, kool-aid drinkers.

In android you can prevent apps from sending mobile data to the cloud in the background. Go to Settings > Connections tab > Data Usage, and scroll down to the app. There's a 'restrict background data' checkbox.

So they'll just record the data in the background and send it when the app is in use.

I agree, quite possibly, although not all developers are as competent as you'd hope / fear

I'm not sharing my location with Uber anymore on my iPhone App. Pretty simple.

Devil's advocate:

I had an Uber driver drop me off in a sketchy alley three blocks from the location I specified, but because he barely spoke a lick of English I had trouble communicating that it wasn't my stop.

They already had the data showing where he dropped you off, what do you think they're going to do with the extra data?

See where guests are dropped off, and where they go right afterwards such as if they're cutting trips short or being dropped off too far.

How many stars did you give him?

You can choose to report that.

I think they are doing this also to stop riders/drivers who game Uber. Riders walking patterns post-ride can be also used for predicting return pickup locations for concerts etc.

Please forgive my ignorance, but do most hackers leave their phone's GPS antenna turned on most of the time?

And do most hackers update all their apps automatically? I generally do a "broad" update once or twice a year. And I update specific apps as needed (or desired). I would have assumed most hackers would do these kinds of things. It's like putting a tape "lid" over your webcam and only taking it off when you want to use it. Isn't it?

re: Uber's reasoning one thing to keep in mind: this is the last opt-in user privacy hurdle for Uber.

From here, any change Uber or an acquirer make doesn't alert or ask users. always-on location tracking is ring0 of personal privacy. They can remove that 5 minute monitoring window any time with an app update.

Question isn't 'do I trust what Uber say to justify this change', but 'will I trust Uber to protect my privacy and security forever'

I am asking myself, if this could mean, we can "kill" Uber in Germany for good. Our data protection laws state, that you are only allowed to track the necessary data to provide the service.

Tracking users after the use a service is imho not really encompassing the spirit of the law.

Surely Uber lawyers could state that this is necessary information for making the service better for the user - like always.

Non the less - one more reason not to ever use a service provided by this company.

Not just Germany, I'm pretty sure this is an EU wide directive. For sure it's the it works in Ireland (where thankfully Uber has not had any success).

So Uber must have some view on why this does not contravene that directive, I doubt they have not considered it.

Am I the only one who thinks this is actually a very small amount of additional data to give up, and don't mind doing it? I'm willing to accept there's a small chance it might make the service a little better for me.

They already know exactly where I came from and where I'm going, what could I possibly do in the 5 minutes after getting dropped off that would reveal significantly more information?

Great reason to use their Web app instead of the native one - same functionality, and no such worries.

PrivacyGuard and Orwall prevent applications from using the internet/GPS without your express authorization. Anyway if you want absolute privacy toss your smartphone in the trash can, cancel your contract with your ISP, commit social suicide and go live off the grid.

Imagine if the Founding Fathers decided to forgo western civilization and go live in the woods as nomadic hunter gatherers instead of standing up to British oppression... Or if all the blacks just listened to Marcus Garvey and went back to Africa instead of participating in the American Civil Rights Movement. This is basically what you're suggesting.

We have the technological means to ensure reasonable levels of privacy. There's no excuse for lemon technology that exposes every intimate detail of our lives.

... except Uber, Google, carriers, etc, are not oppressive.

The fact that nobody's used a nuclear weapon offensively since WWII doesn't mean nuclear proliferation is fine.

Similarly, the proliferation of extremely powerful information is obviously dangerous, regardless of whether it is causing active harm currently.

I am already slowly inching toward this, I removed Internet access from my home, and don't use any smartphone applications at all.

I have not seen any adverse effect on my life/productivity from doing this, people overestimate the amount that they actually need these services. In reality they mostly amount to useless appendages. Especially in an era with free wifi nearly everywhere, being on grid/off grid is as simple as whipping a laptop out of my bag and turning it on.

Persistent connectivity is not a need.

I am very irritated with this update, it is so unnecessary and iOS is complaining about the location access as well.

I dont see any possible use of tracking the location after the ride except tracking the users location and create a surge pricing out of it.

Just wondering, are there virtualization/sandboxing apps/solutions that would let me create full emulated mobile environments into my phone and control all the sensor data that the environment is seeing?

Another possibility is to keep a dedicated phone for Uber. Turn it on only when needed. Not sure how practical it would be, though.

Set to Never. Hum, I think I will give Lyft a try now. Never bothered to before.

Quick check on my iPhone shows that it allows for (and is set to) "While Using the App" for location access settings. Running latest iOS release.

Just uninstall the app after you get your ride, and reinstall it next time you need it.

And I'm switching to Lyft

Won't this drain the battery, with Uber's app running in background?

Just lost me as a customer.

Me as well. A step to far for my liking.

Privacy-by-design now is more important than ever, this is why we build on this with https://snips.ai

"Uber now discloses it does this"

I voted with my wallet and deleted Uber from my phone. My little contribution to the world.

And wrote a message to my friends that I did so, and why they should consider it.

According to the permissions request dialogue, "...We [want to collect your data even after you're dropped off] to improve pickups, drop-offs, customer service and to enhance safety..."

I don't buy any of it. Here's why:

IMPROVE DROP-OFFS: The most improved drop-off that Uber can deliver is the one I, the passenger, gives them, either verbally to the driver, via GPS by them noting the point where I was dropped off, or via GPS by me entering my destination location. Normally, I ask to be dropped off where it's most convenient for me, and the most convenient for me is the best drop-off experience possible. Even if after being dropped off, I go to a final destination for which Uber reckons a better drop-off point than the one I chose exists, it's not for Uber to say, based on where I am going, what my best drop off point is. That's for me, the customer, to say. Since when does a cab tell you where to drop you off? Unless I don't know where I am going, in which case Uber already knows what the best drop off point is, and has no need to further improve it.

IMPROVE PICKUPS. Presumably, the pickup will be improved based on historical location data, which tells them, this guy actually goes/lives/drinks/et here, something we know coz we tracked him last time he used Uber. Again, when I board a cab, I go to the point of most convenience for me. I'd probably have a cab come right to my bedroom door inside my house if it were possible, but since it's not, I choose the next best possible point, which is normally the same place they dropped me off at if they're the ones who brought me here. Same argument applies: unless I'm a stranger, my choice of pickup point is the best pickup point experience possible, and needs no further improvement. If based on where I'm coming from, Uber reckon there's a better pickup point, it's not for them to say. They're a cab. A cab comes get you where you want it to come get you, the location of your bedroom door and other laws and issues permitting.

CUSTOMER SERVICE: This sounds tenuous. Nothing that I can think of that can be termed as good customer service from a cab company would be improved by tracking my movement after the cab has dropped me off. Some good customer service issues have nothing to do with my location, and the two that do are the ones I've discussed above.

ENHANCE SAFETY. Again, tenuous without more explanation. How does knowing where I go after you drop me off enhance safety either for myself or the driver?

I've seen a comment from some who says they work at Uber saying that this helps to figure out where the pick up spots for each address are, that a large building may have multiple points where people get picked up or dropped off. Which sounds reasonable, until you realize that the point that I got dropped off is the best one for me, which is why I chose it, and you, Uber, already know that because you've just dropped me off. Tracking me AFTER dropping me off doesn't make your knowledge of my best drop off more accurate, it makes it less accurate since I'm moving further and further away from the best drop off point as you continue to track me.

> Normally, I ask to be dropped off where it's most convenient for me, and the most convenient for me is the best drop-off experience possible.

Big brother knows best, surrender now, you'll be assimilated.

Reply on news.ycombinator.com