Former employees say Lyft staffers spied on passengers
Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz:- all inbound API requests first go to our API proxy in the secure layer.- the API proxy encrypts all PII using the encryption service in the secure layer- then API proxy sends the request on to the appropriate service, having swapped all PII for tokens.- all services in the general layer are not able to talk to the encryption service to decrypt data.- thus all data that would normally be considered very sensitive (e.g. credit reports) can be stored or passed around the services because values like SSN and others are tokenized.- our services with UI's like our CRM, wherein the customer service rep needs so see the data unencrypted, works perfectly bc the response from the API proxy outbound decrypts the data, but selectively so based on the person's permissions through our abstracted auth layer.Thus in the Lyft example, the majority of employees could have access to "God view" but with all the PII encrypted (so they couldn't search their friend's account by email, for example) but they can still look at rides and transactions, while just those who need to see the decrypted PII could be given those permissions.Of course, this assumes that the encrypted PII is sufficient for anonymization. If you can look for all rides within a block of an address in their God view, then you could quickly figure out which person was your friend by narrowing down to rides originating from his house and his work. But again that comes down to properly limiting certain search capabilities in the UI.I don't get why more companies don't follow our approach. I've seen way too much personally sensitive data in plaintext in databases over the years.