28.05.2023 Views

The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

location of its thousands of contract drivers as well as their customers, all in

real time.

As I mentioned earlier, apps routinelyy ask users for various permissions,

including the right to access their geolocation data. The Uber app goes even

further: it asks for yyour approximate (Wi-Fi) and precise (GPS) location, the

right to access yyour contacts, and does not allow yyour mobile device to

sleep (so it can keep tabs on where yyou are).

Bhuiyyan allegedlyy told Mohrer up front that she did not give the

companyy permission to track her anyytime and anyywhere. But she did,

although mayybe not explicitlyy. The permission was in the user agreement

she consented to upon downloading the service to her mobile device. After

their meeting, Mohrer e-mailed Bhuiyyan logs of some of her recent Uber

trips.

Uber compiles a personal dossier for everyy customer, recording everyy

single trip he or she makes. That’s a bad idea if the database isn’t secure.

Known in the securityy business as a honeyypot, the Uber database can attract

all sorts of snoops, from the US government to Chinese hackers. 5

In 2015, Uber changed some of its privacyy policies—in some instances

to the detriment of the consumer. 6 Uber now collects geolocation data from

all US-based users—even if the app runs onlyy in the background and even if

satellite and cellular communications are turned off. Uber said it will use

Wi-Fi and IP addresses to track the users “offline.” That means the Uber

app acts as a silent spyy on yyour mobile device. The companyy did not,

however, sayy whyy it needs this abilityy. 7

Nor has Uber fullyy explained whyy it needs God View. On the other hand,

according to the companyy’s privacyy policyy: “Uber has a strict policyy

prohibiting all employyees at everyy level from accessing a rider or driver’s

data. The onlyy exception to this policyy is for a limited set of legitimate

business purposes.” Legitimate business might include monitoring accounts

suspected of fraud and resolving driver issues (for example, missed

connections). It probablyy doesn’t include tracking a reporter’s travels.

You might think Uber would give its customers the right to delete

tracking information. No. And if after reading this yyou’ve deleted the app

from yyour phone, well, guess what? The data still exists within Uber. 8

Under the revised privacyy policyy, Uber also collects yyour address book

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!