LinkedIn dark patterns, or why your friends keep spamming you to sign up for it | Hacker News Reader

LinkedIn dark patterns, or why your friends keep spamming you to sign up for it

medium.com

211 pointswfunction69 comments

Here's a question to HN: if we were to design an alternative to linkedin (for IT/technical folks), what would be the features you'd want?

I'll start: 1) The ability to go no-opportunities. When you're not looking for work, you turn this on, and you will not turn up on any search result. 2) Simple export API, with a guarantee of you having complete say over your data. You may export as a json anytime, and import into another service. 3) Non-profit is possible. A resume directory can be run by a few people with a small revenue. Trying to make a unicorn is what leads to linked-in level shit.

Others?

Not doing 'creepy' things with your data (http://www.interactually.com/linkedin-creepiest-social-netwo...)

It's hard to convert this to technical requirement -- this is largely a moral requirement on someone running the service. That's the second best option -- first would be this being technicall not possible.

The only way I can think of to deter this is cost per action. So accounts start with some virtual (or real) currency which spends on actions like connecting or adding to the graph. This will at-least minimize if not stop the behavior.

Any other ways of implementing non-creepiness?

I don't think a basic social network starts out creepy, and quite a lot of effort goes in to implementing the features that enable it to become creepy. Non-creepiness is not a requirement, it is a constraint, such as 'no retroactive default boundary-weakening' and 'do not send email that dishonestly misrepresents the intentions and views of your members, and particularly not of specific members by name.' It is not that hard.

> It's hard to convert this to technical requirement -- this is largely a moral requirement on someone running the service. That's the second best option -- first would be this being technicall not possible.

It's hard to imagine this idea getting traction, but one way to implement this would be to require new features to be approved by (say) a majority of active users. This could act as a brake on roll-out of creepy features (if people read before approving …), but it might also slow or retard genuine advancements (although "no to constant interface re-design" is a feature in my book).

This entire notion of a professional social network I believe is flawed in that it is built upon the notion that it would be better to hire someone who has a smaller degree of separation from you, which makes no sense. I do a fair amount of interviewing of programmers, and not a single person I work with could give a damn about anyone's linkedin profile; it's meaningless. I just find the whole idea to be very shallow, vein, and obtrusive.

Linkedin profiles are one way for you to get feedback from people that actually worked with someone.

You might find the guy who seemed awkward and nervous in the interview was always very helpful to the rest of his teammates. You might learn that the guy who seemed to know your entire tech stack is actually notoriously slow in delivering working code.

Should it instead be only a directory of people currently looking for opportunities. People who find work, take themselves off the directory, and people who want work add themselves in?

I think you'll end up with primarily new grads in the site with this policy.

If you're employed and discreetly looking for new work and you 'activate' your profile, now everyone in the office knows you're looking to switch jobs.

Yep, turn on your "I'm looking" flag, or even go and spruce up your profile and you're outed.

has anyone yet found a job on linkedin by flipping some flag? just curious. my experience is that linkedin is a source of spam targets for agencies, but i haven't heard of a single case when people were found/contacted by potential employer directly.

Don't.

The target group of LinkedIn is mid-level managers of any kind plus the people who want to join that group. Individual contributors such as programmers will not get any value of such a network - no job to be done.

GitHub is way better suited, but won't capture the purely professional programmer who never works on public stuff.

Leaves StackOverflow, maybe expand the user profiles into a full profile (maybe already done, not using SO myself as I am said mid-level mgr).

Basically - you need a hook. Something useful on top of the networking aspect to attract ICs.

Career-focused people are on LI and use it, no matter what. Very hard to beat them by now, similar issue with FB - to compete you'd need at least equivalent data. And yes, LI built their dataset with very slimey tactics.

I think I'd prefer a very generic connection network.

Simply, a directory of connections where I can define my relationship with another individual. Something that people won't hesitate to connect on after even a brief meeting. Additionally, I want to control individually what contact information they have access to.

There might be some room to tailor it with options which control the visibility of that connection by your other connections. (e.g. I don't want to show that I'm closely connected with Bill Gates. But I will let people see I'm connected with Arnold Schwarzenegger and I feel comfortable offering introductions)

You're describing G+

>if we were to design an alternative to linkedin (for IT/technical folks), what would be the features you'd want?

The ability to confidently wipe all data you've ever fracked from me as part of deleting the account if/when I chose to leave your service.

Please plan the delete operations as a core part of your architecture, rather than an addon you can't properly support because you didn't think about deleting data when you designed the system.

Well, whatever we build is archive-able at anytime, so it's hard to technically disallow backup of data if Eve is bent on spidering all of the data.

Instead how about no contact-data (email/phone) be made publically available at all. And all friends request, messages or recruiter contacts goto a public box for that contact? So we can recycle old PO boxes after set intervals, and you only listen to the latest one. Anyone trying to reach you has to be OKed by you.

There's also another negative PO, and you try to keep that empty. Bad player that spam you get a a megative PO message, and those that get too many such are lowered on some scale.

Or of course, charge per action, so it'll be cheaper for someone to contact a dozen people, but too expensive to mass spam.

>Anyone trying to reach you has to be OKed by you.

It's got nothing to do with other people. When your company goes under, and historically speaking most do, someone will buy your DB. With all your debts, you won't be in a position to refuse. Who will the buyer be? What countries laws will they operate under? Will /they/ be willing to protect my contact data? Or will they sell it to telemarketers for a quick buck?

Sorry, but if you can't find a way to let me wipe my data, even if it takes 6 months while your backups cycle, I'm not interested and never will be.

Oh, I'm with you on data-wiping. I'm just trying to think of a solution that does not involve you trusting me to wipe your data.

LinkedIn is ostensibly about "business networking" as well as job hunting/offering. If I wanted to join your suggested service, I might not be looking for work, but I might want to get an introduction to an interesting colleague through friend-of-a-friend style introductions.

Perhaps that could be added to your wish list, again as opt-in/-out functionality.

Generally I'd be reluctant to trust any free service in exchange for my data. LinkedIn is even worse than that because even I pay they constantly overstep and gradually tear down any external APIs (until total user lock-in which is the current state of affair). I can no longer export my own connections, ... or query the interface for basic BI (e.g. which companies in Paris are working on BigData technologies etc).

Further there is a huge problem with companies being shit when it comes to providing feedback to candidates (which to be fair this problem LinkedIn never offered to solve). An issue that Glassdoor initially because they positioned themselves as some kind of review platform. But unfortunately glassdoor did a u-turn and now copy/paste LinkedIn's subscription/recruitment model 1:1 and even spams me more often than LinkedIn asking me to buy their job-posting packages.

The problem is that there is no way of holding companies accountable to their recruitment practices. If you apply for a job you have no idea why you get no feedback or what happened with your data that you supplied. How many other applicants have also never heard again or been left waiting for 3 months without an answer from the company. One of my companies is in recruitment so I know a thing or 2 about how recruiters often are stuck in the middle if the client doesn't provide proper feedback of why a candidate gets rejected.

Pushing for transparency here would be a killer service. Though I'm totally disillusioned with another walled garden where I have to take some founders word for it. I want to see something anonymous that does not put the candidate at risk if they give bad feedback about an employer. Also it should be decentralized and without a possibility to be killed (e.g. no censorship or EU data protection law or "right to be forgotten" should allow an employer to remove a bad review/comment from the web). I think the blockchain would lend itself to such a concept.

Blockchain would also help with the issue in the sibling comment worried about creepiness, where I suggested that actions be paid for.

Is it possible for the value of a node in a blockchain to grow with time, and cardinality. Because that would be killer. No one may create spam nodes, and a pgp like trust develops over time.

You can't delete information from blockchains, which makes them problematic from a data protection or simple error point of view.

> 1)

Linked-in actually has this but I still get messages from recruiters. I'm not sure if the Linked-in flag affects search results but I can think of ways to circumvent "search ghosting." For example, I could be found without search by looking at the company profile or the connections of people in my company.

I'm sure there are ways to fix this but the only one I can think of involves penalizing the recruiter and at the end of the day these people are just trying to do their job.

LinkedIn formerly had a very handy link to export the contact details in vCard format. This allowed me to easily add those details to my personal address book, which I carefully curate. They removed this presumably to keep one in the walled garden of using LinkedIn as the address book.

This page? https://www.linkedin.com/people/export-settings

No, that exports the whole address book. LinkedIn formerly had a link on each contact page that allowed you to download the vCard for that person. This was handy when trying to ensure you have the latest information for a particular person. If I use the export page you pointed to, I'd have to resolve conflicts for every entry at once.

I've got much better opportunities through here and StackOverflow.

for 1) you generally don't want to advertise that you are looking for work while still employed. Showing-up in results is the equivalent of painting a target on your back.

multiple professions.

Another "dark pattern" I recently noticed:

One page (member homepage perhaps) displays a list with the standard "add these people to your network" and in an absent-minded moment I clicked a few. Too late, I realised it was a mixed list of LinkedIn members and non-members extracted from my address book. Existing members, fine, they get an invite to connect. But non-members no doubt receive a message "from austinjp".

I texted one friend a pre-emptive apology and logged out. I very rarely bother with LinkedIn, and this is another reason they leave me cold.

> extracted from my address book

This is why nothing like linked-in gets anywhere near my address book, and therefore nowhere near my portable devices because the only way to install the phone app is to agree to that permission and the site itself is terrible on mobile.

If you let an app install that asks for permission to read your address book assume it will one day it will spam everyone in it and if someone in your address book also uses the app assume that the linking information will be used for profiling purposes (which means more advertising by one of many means).

And any who gives a web app their email address & password to access their mail account to look for contacts (seriously, I know people who have done this and damn well should know better) they need a good smack up the back of the head with the security clue stick.

I agree with you and this is a reminder of how critical it is to use a different password for these accounts and for your email address. Because LinkedIn put what is essentially a fishing screen in front of you where they ask you for your email address and password. Now you can very easily have used your email address to log in to LinkedIn and therefore you can easily assume this is linked in asking you to relogin. What you don't realize is you're giving up your email address and email password if they have a good match what you think you're typing in to login to LinkedIn

I fell for this years ago. It's super creepy. I only recently figured out where to go to delete that data, but I still get creepy suggestions.

Where do you go? I've hunted around a lot - it's really uncomfortable that they tell you "nothing is connected" and then recommend people you've dated...

Indeed. I don't recall uploading data to LinkedIn, but it's possible I gave it permission to access my email at some point. If I did so, it would have been years ago. Problematically, that data has now been stored on LI servers, so I can't revoke access.

It may not be directly from your address book: if you know enough people who have linked-in accounts, are linked to you, and have fallen for one of the access routes, then a lot can no doubt be inferred about you from them.

Why do people keep using linkedin? They are the biggest spammers around and have no shame. All email providers should filter their emails as spam automatically. I periodically receive linkedin invitations from people that wrote to my dev email account looking for technical support, which just goes to show that they just don't go after your 'friends' but just about anyone you have ever contacted via email.

A couple of people have pointed out my phrase "non-members extracted from my address book"... Perhaps this should more accurately have been "possibly" extracted from my address book.

I'm a friend of Tom, Jerry, and Spike. We all have each others' email addresses in our address books.

We're all LinkedIn members apart from Spike. Tom and Jerry both upload their address books to LinkedIn, but I don't.

LinkedIn doesn't require a wizard to work out that austinjp may know non-member Spike. They simply have to display Spike in a mixed-list of members and non-members and wait for me to click him.

They even differentiate non-members from members, but too subtly, and all it takes is one mistaken click.

Yeah linkedin suggested I add my deceased grandfather using this method the other day. Obnoxious feature.

"and non-members extracted from my address book"

There, we have a winner!

Here's another: Trying to browse slideshare while you are cookied on linkedin.com will create a public slideshare profile in your name without you ever signing on for that, and with no UI to remove the profile. I had to mail customer support (which got back to me a few days later and removed the unwanted auto-profile).

Last night I applied for a job, and there was a link that you can click to allow the website to access your LinkedIn information. I clicked on this. I usually breeze through this because all these applications just want to access your basic information. I entered my password and hit enter when I looked at the screen and realized that I agreed to the following:

iCIMS would like to access some of your LinkedIn info:

YOUR PROFILE OVERVIEW

YOUR FULL PROFILE

YOUR EMAIL ADDRESS

YOUR CONNECTIONS

YOUR CONTACT INFO

NETWORK UPDATES

GROUP DISCUSSIONS

INVITATIONS AND MESSAGES

So I looked up what this meant :

Network Updates - Retrieves and posts updates as you.

Group Discussions - Retrieves and posts group discussions as you.

Invitations and Messages - Sends messages and invitations to connect as you.

So it seems I gave them access to pretty much every feature except the ability to close my account and/or change the password (which I promptly did.) Woops.

This is a category of dark patterns: have the user click on something that has been benign the last 20 times they've seen something similar, but this time isn't.

> This is a category of dark patterns: have the user click on something that has been benign the last 20 times they've seen something similar, but this time isn't.

This is the nature of OAuth, in which the scopes can be different for many different clients. Not that this makes it any better, you just need to be aware of it. Slideshare do the same thing when you click download - if you verify using linkedin they want access to everything on your linked in profile just so you can download the slides. Ridiculous (even if they're essentially the same company).

Changing your password here is no good, you need to go to linkedin and then your account settings, then third party apps and delete whatever it was you allowed to connect. Despite all the failings of OAuth that's one of the good features about it, you can actually control the access.

Tip: if you're logging in using OAuth (generally when you get redirected to another site to confirm) always check the requested scopes and always remove all the scopes but those essential to the functioning of the calling app/site, which is usually just access to your e-mail address.If you can't disallow certain scopes then try logging in using something else, github, facebook, whatever, and rinse and repeat. If you're still not happy then just signup with a throw away email.

Thanks. I had quite a few apps in there.

They tricked me too, despite being very careful on the desktop, one wrong click on mobile and boom. They're not the only ones either.

Does anyone remember how FB ensured growth? "Import your yahoo/google contacts to see who is on FB". What they didn't mention is that they would hold on to the email addresses to notify anyone who signed up that they had friends already, and exporting your contacts was disabled soon. Despite being officially dismissed, the "shadow profiles" claim rang true to me too.

Before FB, MySpace was built on spamming the bejesus out of people [1].

[1] http://gawker.com/199924/myspace-the-business-of-spam-20-exh...

LinkedIn: what happens to when you build product by growth hacking everything.

I can just picture hundreds of engineers deploying experiments, looking at data and concluding all things that move numbers up are a success... Regardless of how deceiving or confusing the UX might be.

Engineers or Managers? The engineer are probably only looking at the data to confirm to the MANAGERS that the numbers are moving up.

I read this article, which was very enlightening by the way, and the first thing I did was go to check and see if I had fallen prey to the dark patterns of LinkedIn. The first thing I see when I log on is that they're asking, "Add an extra layer of security to your profile, add your phone number"

Really?? This made me even more uneasy than before. Why would that add additional security to my profile? Has anyone else seen this on their home page yet?

Do you really have to ask why 2-factor authentication would add security to your profile? (If so, http://lmgtfy.com/?q=2+Factor+Authentication+)

Im all for jumping on the bash LinkedIn train, but let's be reasonable here.

Adding a phone number to your account and enabling two factor auth aren't the same thing in my mind. It might be that I'm paranoid about giving LinkedIn my info plus bad copy on the prompt, but I had the same reaction as the grandparent.

Until someone clicks the "Add people you know from your contacts" feature that most of these viral products end up implementing. At which point they have an extra dimension to help their social graph or whatever they want to call they set of marketing information they sell.

I realize what 2 factor authentication is, and perhaps I jumped too soon before considering it, but with everything else happening I can't help but think they would want my number for more than just my added security.

It makes it feel as though they're terrible desperate to get more people using the thing. Is there actually anything at all positive to using LinkedIn?

It led me to 3 different jobs. All three started through LinkedIn communication. During the resume portion of the processes I used LinkedIn Labs to generate a resume from my profile (laziness). In some unfortunate happenstance, it seems the Labs were killed off just yesterday [1].

So, positives are there for me so far.

[1] http://techcabal.com/2016/02/08/linkedin-has-quietly-killed-...

Here is where you go when in doubt:

https://security.google.com/settings/security/permissions

I don't like the term "dark patterns" because it's not something that non-technical users will recognize. Especially in conjunction with user interfaces, dark pattern sounds like a graphic design term. Something like "deceptive user interface" is clearer and actually expresses the sliminess of the intended design. Is there catchy name for "deceptive user interface"?

Also, who are the sociopaths designing and coding these deceptive user interfaces? Have they no empathy for their users?

It took half a dozen or so emails to every possible email address I could find on linkedin's site, but I managed to finally have my personal email address added to some global do-not-contact list. I have since stopped receiving any invitations from friends to join. It's really disgusting that they have such functionality, but do not allow people to be added to such a list on their own.

Fully agree with the article. Got caught out by the same nasty trick.

Unfortunately, LinkedIn serves a niche in the market for keeping in touch with ex work colleagues who you don't necessarily know well enough to connect with on Facebook. And to be fair, it's also a good way of getting a job nowadays.

If someone built a better intentioned, less spammy alternative, I think it would stand a good chance of succeeding.

There was a good discussion on this as part of the LinkedIn stock price 40% drop: https://news.ycombinator.com/item?id=11042278#up_11042899 Many of the comments for the article discussed LinkedIn's dark patterns.

If you want to skip directly to removing your address back integrations from LinkedIn, you can do so at this page: https://www.linkedin.com/contacts/manage_sources/

Linked In asks for your email account's password, but I wouldn't be surprised if they secretly attempt to log into your email account using your linkedin.com password, hoping you reuse the same password.

If you're already logged into e.g. Gmail, it doesn't even matter if you don't use the same password, because Google will still pop up a dialog box asking you to allow permission.

How isn't this blatantly illegal?

It was hypothetical

LinkedIn has become such a joke now, even literally with comedians making fun of all these LinkedIn invites. Plenty of people who don't know the phrase 'dark pattern' have experienced it and know they've experienced something truly messed up. I have no doubt this has been reflected in their recent stock price--rightfully so. I hope this is a lesson to other purveyors of dark patterns, but I doubt it.

It seems like there's a lot of momentum towards people wanting a "replacement" for linkedin... kind of makes me think of the transition from SourceForge (has always been a spammy hole) to github.

LinkedIn is so nice to tell me what idiots of my connections gave them their mail password to spam me. Can't believe it sometimes.

if you are so smart, do not keep idiots in your connections.

He quit Linked In but not Facebook because of UI, email messaging, and privacy.... seriously? I quit Facebook years ago and haven't missed a thing, while on the other hand my past 3 jobs have all come from (at least indirectly) Linked In.

Reply on news.ycombinator.com