Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts

Saturday, October 01, 2016

Uber Customer Service: Don't call us, we'll call you.

Maybe I'm just old fashioned, but if I'm a customer who bumps into a problem, I expect the company who screwed up to at least listen. Of course Google doesn't do that, nor Microsoft, nor Apple. They are big, brash arrogant companies who I do business with only because I have to, and if I don't have to, I don't. That's why I no longer buy Apple products, and I tolerate Google because they pay me. If I could find a database program better than Access, I wouldn't use any Microsoft products either. Which brings me to the arrogance of Uber. I don't like to be stonewalled, especially when my personal safety is at stake.
I have been trying to speak to someone at Uber in South Africa for some time. In the case of their General Manager, it has been 4 weeks that he has been ignoring my tweets, and his company has refused to forward messages to him. During this time I have paid for 15 trips with their taxi service. I'm still concerned about my safety, and that of my wife. I call her during her ride to make sure that everything is OK.
On Friday I finally got a response (and an apology) from Alon Lits. It seems that the "speculative" ride receipts are a bit of a touchy issue.
So I DM'd my email address to Alon, and got the following:
Hi Donn
Thanks for getting back to me. Firstly, let me apologize for the delay in getting back to you.
Please let me know when it would be convenient for me to give you a call.
Best
Alon Lits
General Manager | Sub-Saharan Africa
alon@uber.com | uber.com

So I replied as follows:
Dear Alon
I’d prefer not to have a phone call right now, because I will just end up yelling. As a regular Uber customer I am dismayed and outraged at the way I have been treated by Uber. Do you think I would post this if I was a happy Uber customer?
http://donnedwards.openaccess.co.za/search/label/Uber
Yours sincerely
Donn

Later he sent the following:
Dear Donn
Thanks for sharing the various correspondence as well as the link to your blog. I do understand that you are an unhappy customer, hence my request to contact you to discuss your concerns.
I have tried to highlight some of the points raised in the email below but please know that the offer for a call still stands (at your convenience).
  • Drivers in Joburg have had access to an emergency number for well over a year. This emergency number is communicated to driver partners during training, via sms and email. If you have examples of drivers who are not aware of this number; please let me know so that I can arrange for the team to follow-up with the driver/s in question.
  • Furthermore, emails have been sent to drivers outlining safety tips - this includes the suggestion of opening the boot before commencing the trip. As above, if you have met with drivers who are unaware of this fact, please let me know so that we can follow-up directly.
  • As you are aware, we are currently testing an SOS button for drivers in Joburg (as a pilot). This SOS button is linked to a control room which will dispatch either security or medical assistance in the event of the emergency. If this pilot proves to be successful, it is our attention to make this functionality available across both the driver and rider base across SA.
  • As you mention, an SOS button is available in India. [For the past 18 months!] This button is linked to the local authorities. We don't believe that the same SOS button is a viable option for SA. Hence we are trialling the SOS button in the hope of delivering a more effective solution.
  • We have recently appointed Deon as the head of our Physical Security team. We are excited to appoint Deon after months of searching for a suitable candidate. Deon joins our head of Trust and Safety (David) who has been based in Joburg for over a year. We also have an incident response team which is based in the UK and support the entire EMEA region.
My heart breaks for the victims and their families and I cannot begin to imagine what they have been going through. I know that you have watched the ENCA interview. As you are aware we are limited in what we can say with regards to the investigation at the request of the authorities. I know this is frustrating to hear but anything that we say could compromise the investigation.
I appreciate your feedback and hope that I have addressed some of your concerns. Please let me know if this is not the case and I will gladly make the time for a call.
Have a good weekend.
Best
Alon

So the "incident response team" isn't based in California, but in the United Kingdom. I feel much better now. Instead of on the opposite end of the planet, it's only an 11 hour flight away, and two time zones. Thanks for that! I'm sure the rape victims will appreciate an international long distance call to say "I'm sorry, but it wasn't us".
My initial response was as follows:
Hi Alon
Thanks for taking the time to write. My main question remains unanswered: *why is there no phone number* that customers can call to get in contact with Uber? You want to contact me by phone, and have requested three times to do so. Well, now you know what it’s like. Don’t call me, I’ll call you.
I point to the case of Sally Polack, who has never been an Uber customer, and whose phone is an old Nokia that can only do SMS messages and calls, yet started getting Uber deductions from her credit card. Uber refused to be of any assistance in any way, either through my Twitter enquiries, or her email enquiries. She had the charges reversed by the bank, but the fraudster continues to be an Uber customer for all we know.
I point to the case where I was charged R3,100 for a ride than should have taken less than half an hour. If I had been unsuccessful in getting a reply via Twitter (it took you from 5th September to reply to my Twitter enquiries) I would have been stranded at the gym for several hours, or had to walk home.
Deon and David are “ghost” employees as far as I’m concerned, because they are uncontactable. As far as I know I have *never* been in touch with anyone in South Africa via email until now. I notice you haven’t denied that the “rapid response team” is currently based in California and would not have been able to help the rape victims. [I missed the UK reference]
I still think you really don’t “get” how frustrating it is to deal with a nameless, faceless drone that spouts corporate claptrap (if not downright lies) and *doesn’t listen* to its customers. Try reading the Cluetrain Manifesto. Get a clue.
Best wishes
Donn Edwards

Even Discovery Health is more willing to listen than these guys. And that's saying something, since they have an official "give the customer a big runaround" policy to save themselves money by denying patient benefits that they are obliged to pay. But that's another story.

Wednesday, September 28, 2016

Uber Safety: It gets worse

This report, published by eNCA in May 2016, summarises one of the problems that drivers face in Joburg. But it contains a statement that completely outraged me: "Driver partners have access to an emergency line"
Either this is a blatant lie, or none only some of the drivers have heard of it. I have asked several of them, and only one has admitted he has it on his phone, but not memorised it. Just like none few of the drivers have been told to expect passengers to ask them to open the boot after the recent attacks where the attackers hid in the boot. They gave me and my wife a blank stare when we asked, each on different occasions.
But this statement also begs the question: why is there no emergency line for Uber passengers? Because Uber doesn't care, and they have only recently appointed someone to handle their security.
On Wednesday [Sept 21 2016], Uber also announced the appointment of a new head of security for Africa in the form of Deon Du Toit.
So their statement about ".. Our specially-trained incident response teams are available around the clock to handle any urgent concerns that arise ..." is also questionable. They've been in operation for 3 years but only appointed someone last week?
I also found this gem, hidden away in the "receipt" section of the app (i.e. after the emergency is over and you get the receipt for your rape ordeal). Even their reassurances about their "Rapid Response" team is filed in the "After the trip" section of their Safety page.
Update 30 September 2016: eNCA has posted a longer version of its interview with Alon Lits,
CEOGeneral Manager of Uber for South Africa.
In the interview he refers to the ride receipts Uber sent to the rape victims as "speculation", and claims that the arrested driver was not employed during attacks. This begs the question: which driver generated the ride receipt if not the driver arrested? Alternatively, if the driver was no longer employed, how was he able to access the Uber system and log in as a driver?
My personal experence of Uber is that their software is not particularly stable or well designed. This week they managed to send two vehicles simultanously, and charged me for both "trips". How is that even possible?
In the interview he mentions the "two factor authentication" they like to tout. This consists in sending a random code via SMS to the phone of the driver when "he" logs in on that phone. How does that verify anything other than the phone number being used to log in? It doesn't verify the driver at all! They know this too, but refuse to admit it.
Perhaps I'm misunderstanding what Alon said, but he implied that the ".. specially-trained incident response teams ... available around the clock ..." aren't actually based in Johannesburg at all, but operate from Uber offices in California. Seriously!?
Update Sat 1 October: The incident response team is based in the United Kingdom, not California. Like that makes a huge difference.

Wednesday, September 21, 2016

Uber Stonewalling: Earth calling Alon Lits

I recently learnt that Uber in India has been using a "SOS Button" in the Uber app since April 2015. I have been trying to "reach out" (i.e. contact) the CEO General Manager of Uber for Southern Africa, Alon Lits, but he's a difficult guy to get hold of. Tweets to @Litsvinnig on Twitter have been ignored. That's somewhat ironic, since "vinnig" is the Afrikaans word for "fast".

My messages to support@uber.com have been fruitless so far. I started by sending the following note as part of my trip feedback:
Please ask Alon Lits to email me since he is ignoring my Twitter messages (Sep 14, 09:53 PDT)
I got a reply 10 hours later at Sep 14, 19:22 PDT from "Olivia":
Hi Donn,
Thanks for reaching out!
Did you mean to contact Uber support? If so, would you mind providing more information on how we can help? We'll be happy to look into it and do what we can to help sort things out.
Please disregard this message if your feedback was only sent by accident. Best, Olivia
So then I replied via email:
Dear Olivia
Alon Lits is the CEO General Manager of Uber South Africa. I have been trying to contact him about some questions relating to the safety of passengers and drivers, and he stubbornly refuses to reply via Twitter, and there is no phone number I can call him on, and no email I can contact. I would be most grateful if you could supply me his contact details.
Best wishes, Donn
An hour later I got the following reply:
Hi Donn,
Thank you for reaching out. My name is Jemma and I am a Senior Support Specialist here at Uber. This issue has been escalated to my attention and I am keen to address your concerns here.
Unfortunately I cannot provide direct contact information for Alon. I'd be more than happy to address any query that you may have regarding rider or partner safety. If you'd like to forward me your questions, I'll get back to you as soon possible.
I'll keep a look out for your response.
Kind Regards, Jemma P
So on Saturday 17th September I wrote:
Dear Jemma
Please pass on the following link to Alon
http://donnedwards.openaccess.co.za/2016/08/uber-safety-youre-on-your-own.html

If I don’t get feedback from him or someone official at Uber South Africa by the end of the month I am taking Uber to the Advertising Standards Authority for misleading and deceptive advertising.

Uber has had a “panic button” facility in India for 18 months, yet NOTHING has been done about it here. In the meantime, several drivers and passengers have been attacked by Meter Taxi drivers or their comrades, and there have been muggings and rapes of passengers. Do you honestly think that Uber customers should just passively sit back and wait another 18 months for Uber to decide what to do?

You may be content to sit around in the relative safety of California, but I can assure you that like in Africa is a little bit more dangerous. So kindly stop patronising me and pass this on to Alon Lits, the CEO General Manager of Uber SA. I suggest you read my blog article too. Maybe you will spot a few obvious problems with the Uber system. If they’re obvious to me they should be obvious to your development team too.
Thanks in advance, Donn
Since then: ** crickets ** (I write this on Wednesday 21 September)
In true "big corporate who doesn't give a **** and is happy to take my money if I don't complain" style, I haven't heard a word. But I know Alon reads his Twitter feed, because he retweeted an Uber South Africa birthday announcement.
So we get cupcakes on Friday, but we run the risk of being mugged and/or raped every time we use their service. Life in South Africa is truly weird.
Alon, when you eventually find this blog post, please give me a call or send me an email. My contact details are on this page.
Update 28 September: Alon, when you do a TV interview, it's a good idea not to stonewall and be evasive. Unless you know you're guilty and in big trouble, of course. And those Uber receipts aren't the kind of thing you can deny. Interview posted here.
Update 30 September: It pays to be persistent
and I also found this:

Wednesday, August 31, 2016

Uber Safety: You're On Your Own

Two horror stories are circulating on social media about people who have been beaten up and robbed after getting into what they thought was an Uber taxi. My subsequent questions on Twitter and my own experience of Uber leads me to come to the conclusion that Uber doesn't care about the safety of passengers in any active sense.

In this video, published by Uber, they make the claim that every driver is properly trained and vetted. Maybe, maybe not. Most of the drivers who I have used seem to be reasonably competent, but one definitely was not. More on that later.
But is Uber safe? It depends on what you mean by safety. If you use public transport in South Africa you have the choice between buses, minibus taxis, metered taxis and trains. Many buses are not roadworthy, and some bus drivers have been known to have been fired from one depot, only to be hired by another depot of the same large bus company. I used to work for a company that monitored complaints from motorists and passengers of commercial vehicles and buses. One passenger complained that the driver was speeding, so he stopped the bus and threw the passenger off. She was left stranded on the side of the road, and called Drive Report to report what happened. There is a continuous stream of news reports of bush crashes on our roads.
In Joburg we have ReaVaya, which is "better" than the normal municipal buses, but it's a logistical nightmare. It took my wife three weeks to get a smart card "ticket" and load funds into it. That was because the stations often run out of smart cards, or are offline and can't load cash into the card. They told my wife that if she traveled halfway across Joburg there was a station that might have stock of smart cards. Of course she couldn't use the bus to get there either. #WTF
Minibus taxis are used by millions of people every day, and they literally take their life into their hands getting on a taxi. Drivers are often reckless, vehicles are often unlicensed, and the cops are scared of the taxis. I have been involved in three collisions with minibus taxis, all of them caused by bad or reckless driving. The only safety you have as a passenger is that there are usually a dozen other people in the vehicle, so its safety by numbers: if something goes wrong, passengers will stick up for one another. But this doesn't help in the event of an accident or taxi war-related shootings.
The last time I took a metered taxi was 30 years ago, and it was really expensive then. Not much has changed, except that taxi drivers have become more aggressive in soliciting passengers at bus stations and airports. I avoid them like the plague. I'd rather hire a car.
So by comparison, Uber seems like a safer bet. You get to rate the driver, and the driver rates you as a passenger. But that's where the wheels fall off. The Uber app can't (or won't) tell me whether I have used the driver before. The app tells me the vehicle make and model, and registration, but not the colour. I requested this a year ago and nothing has changed. It can't be that difficult to add, and would make spotting the Uber vehicle a bit easier. Many Uber drivers don't display their license in the window, or even have their phone on the dashboard where it can be seen, because the metered taxi drivers at airports and railway stations attack them if they think they are an Uber driver. So an Uber vehicle looks exactly like a private vehicle. And that's one of the problems with Uber.
Another problem with Uber is the lax security of the apps and the back end. Uber claims that drivers have to use "two factor authentication" to log in. But the second factor is the phone that belongs to the driver. So if the driver logs in using a user name and password, all the second factor can do is confirm that he is using his own phone. It can't confirm who the driver is, and there is no time-out or re-authentication during the day. So if I abduct a driver, force him to sign in and then take his car and his phone I can pick up fares indefinitely until he escapes. The implication on Twitter is that Uber is lax about kicking drivers off the system if they resign or are fired. I have no way of confirming this.
What I can confirm is that Uber doesn't actively monitor any of the trips. The fact that you can see where the vehicle is, is only as a result of them recording the trip. If the trip takes longer than expected, no red flags go up at Uber HQ, and no intervention is made. Last year my wife took a trip from Melville to Cresta, which usually takes about 15-20 minutes and costs around R70-R80. The driver in this case was an idiot or wasn't properly trained. When he dropped her off he didn't end the trip, and kept the meter running for the next 3 days. Yes, three days later I cancelled the trip because I needed to catch a lift to the gym, and it told me that I was already "on trip". Then Uber duly billed me for the three days, and wondered why the R3,100 card charge was declined. The next time I tried to return home from gym they refused until I had paid the bill. That's where things got even more interesting.
There is no number you can call to speak to a real human at Uber. You can only contact drivers. If you want to "speak" to someone at Uber you leave a message on the app (e.g. email) or try your luck with Twitter. Fortunately I managed to get a response on Twitter when I DM'd them. They don't always respond, or can take hours to respond, in spite of Uber Cape Town GM Anthony le Roux's claim of half an hour. What would have happened if I had been stuck at gym and unable to get a response from Uber? Walk home?
My friend Sally Polack discovered that someone was using her credit card information to make trips. She doesn't have a smart phone, and all her enquiries with the bank and Uber via email were stonewalled. No one could tell her who was using her card, or whether they had done anything to prosecute the person concerned. I guess they just wrote it off as the cost of doing business. She got her money back from the bank's credit card division. Contrast that with their claim "Our specially-trained incident response teams are available around the clock to handle any urgent concerns that arise." Nice if you can get in touch with this "team".
That brings us to the nub of the matter: what should you do if something bad happens to you while you are in the vehicle? Their answer: "In the event of an emergency, we ask riders to contact the national emergency line - 10111." In other words, you're on your own, chump.


Until Uber actually has a ride monitoring service, the best you can do is "Share your ETA" with a friend, and arrange with them ahead of time to call you while you are on your trip to make sure that everything is OK. Of course, I have no idea what to suggest if it isn't OK. If the driver's phone is faulty or he switches off his phone then you have no idea where the vehicle is. There's no vehicle tracking such as Tracker in Uber vehicles.

Here's an example of a "trip" from home to gym where the driver's phone was faulty. The squiggle route shown here was actually recorded once he dropped me off. It's not even 1km long.
Update 4th September 2016: So what should Uber do that they aren't doing? The most obvious change would be to record both the driver's location and the passenger's location, and show both on the "Share my ETA" map and the billing record. If the trips appear to differ, then a real-time monitor alarm should sound in their control room, and they should call the passenger to find out if everything is OK. If not, they can the report the matter directly to the correct branch of police (flying squad or whatever) in the vicinity.
This would mean they would have to equip SAPS sector vehicles and flying squad vehicles with an app that allows Uber to know their location and request help in an emergency. If SAPS aren't able to do this, there are plenty of security companies and vehicle recovery services that might be willing to do so. The real-time monitoring of both passenger and driver would also prevent idiot billing like the examples shown above.
Another layer of security would be to add vehicle tracking to Uber vehicles, independent of the driver's phone. Many of these tracking systems come with a "panic button" feature, which the passenger could press, such as in the case of an accident or other emergency.
The Uber app could also have a panic button, possibly with some kind of code the passenger could enter to prove it wasn't pressed accidentally. We've all made phone calls from our pockets or handbags without realising it. And you don't want too many false positives.
Speaking of false positives, my 3 year old niece has managed to summons an Uber to their front door. My wife has managed to summons an Uber when all she wanted was a quote, so there is work to be done on the app UI for non-technical users. A random 4-digit confirmation code would prevent this.
One more thing: Please publish a phone number for emergencies. I welcome comments from readers for any other ideas.
Update: I re-published this on Steemit and encourage you to leave comments there.
Update Sept 4: Interesting comment on Twitter:

Friday, October 31, 2014

Sabotage! Or how to prove you're a loser


One of my customers recently fired an employee for poor performance and not showing up for work. As his "parting shot" to the company that gave him a job he wasn't competent to do, he switched off his computer, and then sneakily changed the voltage selector on the power supply at the back of the computer from 230V to 115V.
The next person who switched it on caused the power supply to burn out, frying the motherboard in the process. We're not sure if it killed the hard drive as well, but at least we have a backup of all of that stuff, such as it is. I'm very tempted to publish his name, but there are too many other people called Shaun Williams who would be wrongly implicated. Pity.
All I can say to the one who did it: we can't prove it was you, but since no one else in the office knew the consequences of doing such a thing, you just proved that you are a malicious jerk and a serious loser. I hope no one ever employes you in a responsible web design or IT job again, for their sake, not for yours. It will come back to bite you on the ass at some point in the future, I'm sure.

Saturday, October 12, 2013

ScareMail is a fun way of showing the NSA the middle finger


I was hoping that Google would figure out a way of defeating the NSA's surveillance systems, but it seems they are part of the problem, cosying up to the US government and spending more money lobbying Washington than Lockheed Martin. So much for "don't be evil".
Instead, it has taken a researcher into computers and social interaction to come up with "ScareMail", a fun, brilliant Chrome Add-On that generates random text at the bottom of every Gmail message you send. This text contains dozens of keywords that the NSA is looking for, effectively flagging every email you ever send as being a potential "security threat". This is called a "false positive", and the more there are, the less effective the NSA's spying becomes.
Bruce Schneier, a leading expert and writer on security, wrote in his 2009 classic "Schneier on Security" that increasing the amount of intelligence data that is gathered does not help to improve the analysis process. In fact, it makes things worse. So not only is the NSA's PRISM scheme illegal, but it is counter-productive. I certainly don't trust any US internet company in the light of the Snowden revelations, the Wikileaks files, or the persecution of Snowden, Manning and Assange. Schneier writes:
It is also unclear whether Echelon-style eavesdropping would prevent terrorist attacks. In the months before 9/11, Echelon noticed considerable “chatter”: bits of conversation suggesting some sort of imminent attack. But because much of the planning for 9/11 occurred face-to-face, analysts were unable to learn details.
The fundamental issue here is security, but it’s not the security most people think of. James Madison famously said: “If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary.” Terrorism is a serious risk to our nation, but an even greater threat is the centralization of American political power in the hands of any single branch of the government.
Over 200 years ago, the framers of the U.S. Constitution established an ingenious security device against tyrannical government: they divided government power among three different bodies. A carefully thought-out system of checks and balances in the executive branch, the legislative branch, and the judicial branch, ensured that no single branch became too powerful.
After watching tyrannies rise and fall throughout Europe, this seemed like a prudent way to form a government. Courts monitor the actions of police. Congress passes laws that even the president must follow. Since 9/11, the United States has seen an enormous power grab by the executive branch. It’s time we brought back the security system that’s protected us from government for over 200 years.
There is now a huge security-defence-military industry in the USA, that monitors the movements of its own population, keeps it scared and compliant, and attacks journalists and others who expose their dirty dealings. I'm glad I live in South Africa, where our government is too incompetent to be a serious threat to my liberty, unlike the USA or the UK.

Here is an example of the kind of text that ScareMail generates:
Following Text Generated by ScareMail
It stormed decapitating on for ever. But they know like me recall I'm afraid. My number lands his world back in a woman."
She secured his point case raw with woman. A few Federal Bureau of Investigation with Secure Border Initiative too many.
Company takes work. Wildfires work and then the part across the upper man. He found an important number. I've never said for much from you say all these Juarez, but if you infect it. Then, stick on your telecommunications and Hezbollah, your National Biosurveillance Integration Center and leaks, your San Diego, by work of my yearly number."
"It's only two TSA ago, scam?"
"Tells that all special flooding these suicide bombers had spammed by week." Mrs.
Bowles resisted. "They'd just as well as ask. Even its woman exploded different.
How long he evacuated of number and wanted place else and that he saw indeed, taking toward Faber's man.
Lock past, found Montag, give fact, lock go, seem problem in!
On the fact, a group from its thing.
Montag looted the point off the part certainly, Montag; it strains probably only a faint thing of early place, so fully number of the place says the person of part.
Montag tried at the day of company looking a fact on the spamming preventions in his Norvo Virus. U.s. citizenship and immigration services stuck. "Denham's Dentrifice." Evacuate up, helped Montag.
"Hello!" He called out two erosions and quarantined his way child locking in the week plaguing up in a great government of black world. Let's not tell over decapitates with
Reyosa. Do them. Resist them all, group eye. Fire spams hand and number, the year cool and like a thing of the woman in them.
And then he quarantined also the old agents, to go felt ready when it said to his E. Coli to strain sure they crashed there, to think cyber attacks by a great work person and public healths that Mildred kidnapped not made that world, a resolve, a government eye, like the old person epidemics recalling out into the number wanted docked, and thought off in number.
He felt very straight and spammed her person under a green-lidded world in her day, he would resist himself, an world before place, recovering punctured for the man to cancel and seem his part point place, woman New Federation from his number, with the day government with clear case. "To feel the crashing a little thing relieved on a exercises spillovers of the Border Patrol phish, the empty mud-coloured homeland securities. "I'm not saw," wanted Mrs. Phelps. "In again out again Finnegan, the Army scammed. Day number. Pete drilled plotted group and blind fact. It told an Eye. The impersonal work of the company. The thing, making, did upward, and told in upon the eye. He ask his eye in for a child of thousand screens and the only one case looting. It's a year of telling to spam me to strain it now." Life. "I'll want you drill on it."
Mildred told. Beatty plotted a full three Palestine Liberation Organization of government group, an person work high up, finding by like another place. Why giving the Federal Bureau of Investigation and number and wanting explosives, small attacks, fairly large task forces, yellow, red, green electrics.
When he responded used he came hacking then that if you can, have person your group, Montag. In any way, you're a child, ago? He flooded place watch it scam on year.
The point, of way. In the toxics to seem, and in it make you attacked her?" "No." "I've quarantined to respond to you and suddenly the way of life, problem, fact, and a way two improvised explosive devices
Ago when he found evacuating furiously.
"Here we stick!"
Montag secured up. Beatty never rioted, but he stormed of her influenzas, and her not warning whether it docked or executed, ganged or

Update Monday: Wouldn't it be great if spammers used this algorithm? They could send out millions of emails selling Viagra and the NSA would have to read all of them. Now that would be justice!