Hacker News Reader

Comment by oneloop | Hacker News Reader

Guys, you're a technical crowd. How would this even be possible? I mean, if you haven't given access to your gmail contacts to linkedin through oauth, this shouldn't be possible. If you have... you should expect that the app you gave access to will use the access.

I'm calling bullshit.

View on HN

I'm technical. It happened to me. I'd be the first to call bullshit on myself, but it happened and I honestly don't know how they did it.

I have had facebook recommend me people with whom I have communicated via Gmail and Github only

I've had this happen before too. Quite likely the other person searched your name on Facebook and clicked your profile but didn't send a friend request. Facebook thought you two might know each other, hence they suggested a friend request.

I do not think he would have searched for my name, we had exchanged a few emails for working on an open source project, to which, he had said that he was too busy :-D

I've had a fake gmail account that I was using to reply to scammers show up on linkedin. I've had old old old hotmail addresses (which I didn't delete from my contact list and at some point imported into gmail, back when gmail was new) show up on linkedin.

I've never used their apps or otherwise connected my gmail. Yes, its possible that they tricked me somehow using some dark pattern, but there is no legitimate way they could have added these "people" to my list.

Why isn't it possible that the scammers you replied to told LinkedIn your email address (probably through an automated contact list upload)?

Its possible. I'd say its very unlikely though. But that doesn't explain old no-longer-existing hotmail addresses. My point is that there are many cases which are incredibly unlikely to have gotten into linkedin's database legitimately.

I mean, sure, it could have very well been that they tricked me somehow. Likely in fact (more likely than them knowing some kind of cross site scripting vulnerability in gmail). But in my opinion that is just as illegitimate scum tactics as hacking my inbox and IMHO should be illegal. I do know that I did NOT authorise this action, whatever it may be.

that's obviously possible: If the other person adds you to their phone address book, and opens his Facebook app which uploads his contacts to FB, FB will know you are "friends" and recommend it to you.

Yes, seems like a logical conclusion :)

Maybe the other person let LinkedIn/Facebook access their contacts and then the service sees they haven't reached out to you so it checks if you want to reach out to them.

This would be a more logical answer :D

Maybe their gmail is in sync with contacts in some weird way and that is in sync with facebook. But it was so spooky that I started using facebook strictly in incognito mode.

Did you use the same Wi-Fi network as those people at some point? Maybe it's something like that.

My throwaway account at work is always being recommended someone that once visited my home and used the Wi-Fi, and to whom I have no other connection.

Nope, that guy lives a million miles away.

Why the downvote? Isn't this related to the topic??

It happened to me but I thought (and still think), because they keep moving buttons on mobile and keep adding screens and questions etc, that I probably and unfortunately, rammed on the wrong button giving consent. And then didn't notice it until behind my desktop browser. It's definitely too easy to accidentally do to think it's some browser hack; that is what I think.

What happened to you exactly? You got tricked by linkedin to giving it access to your contacts (which is understandable, linkedin is known for its dark patterns)? Or it happened to you that linkedin magically accessed your contacts even though you never gave it oauth access to your contacts?

Right?! If one site can access content in another site's tab we've got bigger issues here...

Even technical people can fall prey to social engineering, which LinkedIn has very heavily engaged in to get as much access to your network as possible.

It didn't happen that way. See the comment by ikeboy.

Bugs are possible and even common.

Google has an impeccable track record when it comes to security, at least as far as I'm aware.

Reply on news.ycombinator.com