Ask HN: How to contact Uber about a rider safety exploit being used in the wild?
How to assault/rob your passengers and not get caught:
1. Accept the ride
2. Meet the passenger and lock then in your car.
3. Do not start the ride, but instead assault, extort, etc... Your passenger.
4. Decline the ride when they flee the car.
5. Ride is now routed to the next driver.
6. Profit!!! Because you car and name will never appear in the riders history. The rider safety hotline does not have the ability to see driver canceled rides. You cannot open a help case in the app because driver cancelled rides do not appear. Uber support (if you can get them to respond) do not have the ability to see driver canceled rides. There is no way to escalate this issue. There's no human to talk to about this issue. You are totally safe to do this with impunity as a driver.
For all the tech magic, anything that deviates outside what they have considered as possible leads to a black hole. How do we contact Uber about this massive exploit before it blows up and tanks their already floundering stock price?
75 comments
[ 13.0 ms ] story [ 2163 ms ] threadQuite literally with this information any driver who wishes to assault or extort someone can pretty much do it with impunity with this knowledge. And there is no way to contact Uber about it or even get Uber to acknowledge that it exists.
I suspect that the number of rideshare assaults is greatly underreported based upon this simple exploit. Because quite literally Uber is entirely ignoring my pleas and not even acknowledging this as a possibility.
Sorry to hear this happened to you, sounds a bit scary and traumatic. Good luck.
The fact that Uber hides driver canceled rides but not customer cancelled rides allows for this possibly to even happen. You would think they would want to address this quietly. If it's happened to me, then it will happen to someone with a million Twitter followers and it will blowup in their face.
Having an actual human on the other side of uber that understands the seriousness of this driver exploit would be the easiest way to get it corrected.
Or Uber needs to publish complete ride history including driver cancellations.
Either way, yeah, your problem is the police, not Uber, and you need someone who knows the law.
Saying my problem is with the police and not Uber is typical Uber apologist behavior that acts as if these big data companies can do no wrong. Simply displaying the same driver canceled ride data as they do for passenger canceled ride data this would be a non-issue. Having their safety hotline Representatives be able to view driver canceled rides again would make this a non-issue but they cannot see them.
The only way to contact Uber is in regards to a passenger canceled ride or in regards to a completed ride. So my problem is with Uber because they allow this exploit to exist and it's being used I just hope it is not ever used against you.
If you're trying to rile up the masses so that someone goes to court and sues Uber for this, then sure, go ahead. But it'll take significantly longer than dealing with one driver.
https://krebsonsecurity.com/about/
It could even be a local newspaper/channel. I think you should do it. I recently felt uncomfortable with a Lyft driver and decided to check my ride history logs. All of the time stamps were completely wrong. That was a little unnerving but it’s something I never did anything about. If I needed to prove I was somewhere at so and so time, Lyft wouldn’t be a reliable source of information.
Something actually happened to you, so I encourage you to follow through. That could happen to anyone and it’s not funny it’s being shrugged off.
The only thing I can think about for now is taking screenshot of accepted rides as a record.
It's insane that Uber even hides driver canceled rides. Because I guess no on would ever need to report a problem with a driver cancelled ride.
Going to the police, they might have access to security cameras in that neighborhood to check the car's plate.
If they touched your belongings and you still have them, it might be worth giving them to the police to run finger print tracing.
I did contact the airport (which is where it happened). They are looking at camera footage but haven't gotten back to me yet. Driver was bold, just didn't care. I've traveled the world and never seen someone so bold right in the middle of so many people. Must have done it many times to know he could get away with it.
If I were you and had time, I'd create another account and keep requesting for an Uber around the same area where that driver showed up until I see the same driver again. From what you describe, chances are he's still out there doing it.
On a more similar note, my girlfriend last year called an Uber, and after 30 minutes of waiting for it to arrive, the person simply canceled the ride claiming she wasn't wearing a mask (they never even came close to my girlfriend, and she was definitely wearing a mask). We tried contacting support to at the very least refund us the ridiculous fee, but nothing was ever done.
Avoid Uber like the plague.
A person with a uterus, who thinks of themselves as a man, had one of their eggs inseminated.
More specifically: a person who is biologically female but self-identifies as a man -- and who has not had certain types of sex reassignment surgery -- either (1) had penetrative sex with a biological man, or else (2) was artificially inseminated.
> Without surgery they are female with female parts but identify as male so dressing up as a male
Your (totally reasonable) confusion on this point is mostly definitional: "transgender" does not imply sex reassignment surgery. In fact, sex reassignment surgery is still very uncommon among transgender people [1].
(Fun history lesson: In the 60s it would have been a contradiction of terms to say that a transgender person wanted a sex reassignment surgery! The term was originally coined to refer specifically to people who didn't want such surgeries, with terms like "transsexual" or "transvestite" referring to those who did want surgery/hormone therapy. Today, the latter terms are out-moded and the term "transgender" has become a catch-all. But if we want to get puritanical about the meanings of words, which I think is a bit silly of course, we would actually go the opposite direction of the one you assumed -- it would be definitionally contradictory to use the term "transgender" to refer to someone who has received a sex reassignment surgery. This is all unimportant trivia, and today "transgender" implies nothing about surgery/hormone therapy preference, but hopefully this was an interesting history lesson for word nerds.)
> How does someone identify as a male but still want a baby.
Well, first, OP mentioned Brazil, which makes the "want" part perhaps presumptuous since abortion is illegal in Brazil.
Aside from that, drop any pre-conceptions you have about trans people and just read the sentence back to yourself. I.e., consider the sentence: "How does a man still want to have a baby?"
Lots of men want to have babies that are biologically "theirs". You've correctly identified that this desire can be a bit more complicated/disorienting for trans men, but the desire for a biological child is pretty universal among all life forms on earth. Trans homo sapiens aren't an exception.
[1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6626314/
This isn't the case. You don't need to make any kind of surgery to be a trans person.
How are people supposed to understand if the approach taken by the educated ones is of censorship and taboo?
I extremely appreciate @throwawaygh below answering the question clearly and teaching OP a valuable point of view of the matter, without prejudice or indignation of someone else's ignorance.
Shame on those who just preferred to censor the question. This is not how we build an inclusive society. I expect better of this site.
That said, thank you for reviving their comment as I personally don't think there was anything wrong with it specifically. Just trying to shed some light on why some people might have interpreted it differently.
It's true. "I'm just asking questions" is definitely a routine used to harass trans people. It's probably the most common routine now that overt transphobia is less socially acceptable. I doubt there's a single trans person in the US -- outside of very cloistered bubbles -- who hasn't been harassed by a troll who was pretending to "jut ask questions".
My MIL is one of those people -- she's even gone through the same line of questions on the same exact person (1+ year apart, forgot she already met the person). Which is why she's no longer welcome in polite company. The point: I'm not saying that removing people from some social contexts is never the answer. Sometimes that's the best course of action.
But here's the thing. "Just Asking Questions" trolling is a particularly insidious and ingenious routine. Sure, it's mean and petty with plausible deniability. But that's not why it's so genius. Using this routine en masse is a genius move by anti-trans hate groups because it actively shuts down education, which is ultimately the best way we know to increase public acceptance of transgender people.
We can't do anything about recalcitrant assholes except cut them out of some parts of our lives. But we can disallow them the pleasure of shutting down education and thereby reinforcing their own ignorance in the broader population.
Anyways, that's a long-winded way of saying "kill them with kindness". If they were genuinely curious then your kindness just won trans people an ally. If they were trolling then the only way to cut past the plausible deniability bullshit is to avoid direct anger and beat them at their own "pastor's wife bless-your-heart" game. And anyways, there's something viscerally pleasing about a midwesterner who didn't know you're a midwest transplant slowing realize they're being out-midwested... much more pleasing than having to deal with an asshole accusing you of being mean to them when they were "just asking questions" ;-)
But the main point is, it doesn't matter if they're trolling or genuine! In both cases, responding with direct anger to questions in the moment is a losing strategy. The troll gets to play victim and the genuinely uneducated are put on the defensive.
(And, yes, it's unreasonable that trans people are so often de facto representatives of all trans people in every daily interaction. I'm just describing the micro-political strategy and not trying to imply there's anything wrong with being a normal human instead of a political operative.)
https://news.ycombinator.com/newsguidelines.html
Anti-trans hate groups know that most people will respond with understanding rather than hate when hearing answers to certain types of questions. They know that, like the racists and homophobes before them, they are on the losing side of a rational and polite discourse.
The only hope for trans hate groups is to shut down that rational and polite discourse. One strategy for doing so is to identify questions that people have and then prime trans people/trans allies to respond emotionally to those questions.
The goal of the "just asking questions" routine is (1) make trans people uncomfortable but also (2) make sure that people who actually do have questions always feel attacked by the trans community instead of empathetic with the trans community. It's a strategy.
By shutting down possibilities for education we play directly into their hand.
I wrote more in a sibling comment: https://news.ycombinator.com/item?id=29267480
It doesn't work. Words are being changed to mean different things, and new words and terms are being invented to win arguments. "Newspeak".
Overall, I agree with the assessment here. It doesn’t matter which country you’re in, Uber doesn’t care much for customers and its customer service is abysmal (standard copy paste non-answers or ignoring you). The Uber customer support team will do everything possible to snatch money from you and avoid compensating you even for their fault.
I thought Uber may be a better company after its previous CEO (Travis Kalanick) and his coterie were ousted or left. But the reality on the ground is still the same as what it was some years ago.
Reverse scenario:
- Rider requests a ride
- Rider meets driver
- Rider assaults and extorts driver
- Rider cancels the ride.
Thus your reverse scenario and your forward scenario do not match. Because in your reverse scenario both driver and Rider have a history of it in your forward scenario neither driver or Rider have a history to refer to.
This is the Crux of the exploit. Without this information showing up in the trip history of the rider drivers are free to exploit them with impunity. Perhaps if you find a very zealous law enforcement officer in the USA who's willing to pursue this you might get somewhere. Even then if you cannot show that you actually had a ride they may drop the investigation entirely as well.
Without getting into specifics they absolutely do have a way to track down the driver regardless of the state of the trip / who cancelled.
Pretty much this driver exploit can be executed with impunity and Uber does not care and there is no way for customers to report it.
Obviously they can only hack their own app but then once successful they could publish how they did it so you can repeat it for yourself.
Also try this https://help.uber.com/riders/article/request-a-copy-of-your-... and see what they send.
A long shot perhaps.
Another long shot - was there any nest cams in the near vicinity? Do your own police work, but a silver platter, and hand it all over to the police.
If Uber PR has to deal with a growing news story being put in front of potential customers, they'll do something about it.
That is the Crux of the exploit that drivers can use against passengers. When you're panicked and running away from someone assaulting you you don't have time to memorize a plate number or take a picture of it. Uber conveniently route you to the next available driver completely of allowing this initial driver to vanish from your ride history.
You're then left with zero information to go back on and Uber support has no way for you to contact them about this ride. You're left with zero information to give the police for them to follow up on. What you have is drivers that can exploit passengers with impunity and no recourse and no evidence.
And well I am exploring other aspects of dealing with this the core problem in here is that Uber has a massive exploit that is being used in the wild against people and there is zero way to get assistance with or from Uber on this. Specifically Uber's contact methods and reporting methods do not allow you to have any way to know who this person was or even to open a support case with Uber. So the real exploit here that we're talking about is with and against Uber.
Looks useful to make a screenshot and have it uploaded to the cloud in case such a driver steals your phone on top of harassing you.
Hope you are safe now.
One possible safety precaution for the future might be to make it a personal habit to always photograph the car with plate and driver when they show up, if possible, before you get in. This isn’t the “right” fix for the problem, but it’s potentially something you can do to at least create the theory of consequences/evidence, in hopes that it’ll be enough of a deterrent.
Two other things come to mind, though I don’t know how feasible they’d be outside the US. Still, might be worth a shot:
1. Contract an attorney and see if you can file a private suit against Uber in court, or maybe even against local law enforcement. That MIGHT open up the possibility of forcing Uber to turn over data to comply with a subpoena depending on how the law might work there. Not great, I know, but it might be enough to get their attention at least.
This next one requires faith in humanity, and I fully recognize that fact damn near kills it at the outset, but here goes…
2. ASK OTHER UBER DRIVERS AND PASSENGERS TO FILE SUPPORT REQUESTS ABOUT THE ISSUE. If enough people raise enough hell about it, maybe someone capable of independent thought, someone who can do more than copy and paste canned responses, will become aware of this and have “the feels” as they DAMN WELL SHOULD. And maybe then something can get done.
Like I said, requires faith in humanity so it’s probably the longest of long shots. But right now it sounds like a long shot might be the only shot ya got.
Good luck to you, and stay safe out there!
PS - Fellow hackers o’ the news, if you can do this without major consequences, maybe voice some concern for your fellow (hu)man, over Twitter, or whatever. Not much we can do individually by ourselves, but with enough voices, maybe we can form a chorus loud enough to help. It’s a small ask, IMO, and we can hopefully save future victims from harm.
The fact that Uber does not have any method at all to contact them in regards to this kind of incident is ridiculous. The fact that people believe that this is a defensible behavior by Uber is even more insane. I just hope nothing happens to them where they feel powerless. Currently Uber just repeatedly closes my issue with no response at all.
Surely somebody at Uber reads hacker News and can reach out about this exploit. But that does not seem to be the case for how Ubers modus operandi is. They typically just ignore passenger assaults until it rises to the level that they have to get embarrassed into action.
- City Council Representative
- State Department of Transportation or Public Safety (In my case this would be Texas DPS)
- County level law enforcement, not city; (so not El Paso, TX police dept. in my case but El Paso County Sherrif)
- State level law enforcement (Not Texas Rangers in this case, as I think that's for other stuff, but something adjacent if it exists? Just my guess as to an example, may not have even a remote analogue in Brazil)
- Federal law enforcement (FBI in the US for example; filing a report/complaint won't get them mad at you unless you really abuse the hell out of it)
- Mayor's office for your city
- Metro transit authority if you have one
- State House of Representatives and/or Senate (your legislative representatives, if you have those)
- National House and/or Senate representatives (I'm in El Paso, TX so in my case Veronica Escobar - House - Ted Cruz (*shudder*) and John Cornyn in the Senate)
- Federal Trade Commission (oversees trade issues, privacy in the US)
- State Attorney General's office (Texas AG in this case)
- Maybe the equivalent of your state governor if appropriate/possible (for example in my case, Gregg Abbott)
- Consumer Financial Protection Bureau (in the US this is a federal agency, but no idea what the equivalent would be elsewhere or if you even have one)
- Federal Communications Commission (The FCC overseas telecommunications systems and law in the US; equivalent may or may not even exist)
Now you're probably thinking "most of those don't deal with criminal exploitation/violent crime/theft!" and you're right. The goal is to make enough noise about it in hopes that somebody in some agency somewhere will just give a damn and hopefully at least make a phone call to a buddy who knows the CEO or something, or draft a letter, or just do something, nearly anything, to poke Uber in the ribs and give 'em a little pain. Sometimes all you need is the attention of just one person in the right position to get others on board, so more complaints = higher probability somebody will do something.
In the US there's an organization called the "Better Business Bureau", or the "BBB", that maintains ratings of merchants and small/mid-sized businesses and tries to mediate disputes. I don't know much about them or if that would be appropriate in this case if it were in the US, but see if an equivalent exists in Brazil or just your local area. You might be surprised at what you find.
Another possibility: take your story to local taxi drivers/companies that COMPETE with Uber. They might be willing to put advertising dollars behind your story to help create a sense of distrust among the public, getting them a bit "scared" to use Uber so that folks use them instead. A slimy tactic, sure, but if your government won't protect you and your fellow citizens, the "slimeball" factor rests on their shoulders, not yours, because they forced you into a corner by not doing the most fundamental job of any government: providing basic safety by enforcing the law.
---
You could also, as others have mentioned, try getting the local (or maybe even national) news media to do a story on this too. Just be aware that being in the public spotlight like that might not be the safest thing for you - retaliation from whomever is doing the extorting could be a serious concern or risk. I doubt Uber themselves would bother you, even through a "proxy" or hired/other "agent", especially as far away as Brazil, so I wouldn't worry about them. The individuals using ...
While my incident involved assault, there are other incidents that do not. For example, I've had several drivers message me before they picked me up asking for additional money or my destination. This is explicitly against the driver's terms of service to be an Uber contractor. Just uses the same exploit mechanism of when the driver cancels the ride you can no longer report inappropriate driver behavior. The driver failing to pick you up is annoying behavior but still is the exact same exploit mechanism.
I believe now that Uber has the information to validate that this exploit is going on currently. It may not be used in the US as I've never seen it there but it is definitely happening in the Dominican Republic.
For everyone who's insisting this is 100% of police matter I think you're missing the greater point here. You need to get outside of your local bubble and deal with police and other countries and other locales they do not operate on the same set of ideals and principles as they do in most of the United States. Also that argumentation ignores Uber's responsibility in this matter which is to provide an efficient mechanism to report bad drivers. That mechanism was completely missing here and is cause for the exploit that I was trying to report here on hacker News. It's important that this exploit be made known and that Uber finds a way to address it because if it can happen to me it will happen to other people and it has happened to other people. It may just be the annoyance of canceled rides so far for others but at least in one instance it did rise to the level of assault.
Uber should have a vested interest in ensuring that their drivers are of the highest caliber. Since I had at least three rides where the driver accepted and then canceled after a message where I refused to pay them additional I would think it would be trivial for Uber to use monitoring on messages between riders and drivers and detect this kind of thing. After all detecting a driver demanding a tip prior to pick up or requesting a destination prior to pick up is a much easier prospect than a self-driving car.
I wish it didn't take 3 days to get to this point but I'm currently very satisfied with how Uber is handling this now.
In 2017, a policy change meant that when a rider reported a driver, the driver rating stayed. Prior to that, things were being handled. Afterwards, a five year five star account dropped to 2.6 in two months.
The only solution was to stop using Uber.
I've been gone for four years.
What I learned is that Uber is needed in tiny towns, but in every decent sized city, I have better experiences with lyft and flywheel anyway.
What originally brought me to Uber was faster, lower hassle rides with fewer scams.
No loss, it turns out