Hacker News Reader

Comment by axaxs | Hacker News Reader

If anyone cares, there are a nontrivial amount of companies who have your 'private' LinkedIn info. I don't know if they make fake accounts to friend you, recruiter profiles, or buy it from LinkedIn. I asked one to please remove my info, and they sent me a CCPA form. I told them I didn't live in California, and an agent acted confused and told me to just fill it out, it's the only way to remove it. In short, don't trust LinkedIn.

View on HN

LinkedIn is pure cancer. They actively tempt you to message your contacts in a way where you think that the recepient would welcome your message right now but it's an opposite situation. This at best creates a communication gap and is at worst rude and might break up communication.

I'm shocked that Microsoft which is primarily bases on trust as far as corporate stuff is concerned went for linkedin. I hope they sell them or just burn them.

Nothing good can ever come out of linkedin they have less ethics than facebook and twitter.

I'm always surprised at the number of people in infosec or _really interesting_ defense positions who have linkedin profiles.

It's the lowest rung of where nation states target and you've just handed it to them on a platter.

As horrible as it sounds you all sort of deserve it for selling your soul to such a horrendous platform hellbent on fucking with its users. For some reason we're all worried about tiktok now though.

It suspect the Facebook DBA+backup teams are the most diverse team in the planet. They surely have representatives from every worthy intelligence service on earth working in perfect harmony.

On that note, what's interesting is nobody on earth ever notes that Snowden was cia before nsa. Nsa and cia jostle for power all the time.

People describe their company's entire tech stack, in detail on LinkedIn.

And the little shot of dopamine they get from being LinkedIn popular would probably make them happy to answer any questions you have about things they left out.

There's a difference between knowing all the pieces that go into a working machine, and knowing how, in what order, to what end, and all the little interactions and knock-on effects in the form of of unwritten knowledge that keep a company cranking along.

Go ahead and set yourself up a Tomcat cluster, an internal Tomcat cluster, some Oracle databases, and even go so far as to reverse-engineer a UI and maybe a data model if we're being extra ambitious.

A business, you still will not have.

I'm not talking about a business perspective, I mean they're laying out their specific attack surface, zero social engineering required.

Thinking about it, it obviously makes sense. These are people who want to be approached by anyone and everyone and will sell to the highest bidder.

Even worse, the official LinkedIn support team are Community Volunteers.

eg not paid employees, any anyone who "volunteers" to help out.

The many failure scenarios for that combined with peoples (sensitive) private information are mind boggling.

Sounds like Google

IDK. A decade ago, I made a love connection. I apologized for misusing the medium. She said "Not necessary. I'm glad LinkedIn is good for something." We lasted about 6 months.

I’ve realized a long long time ago that any interaction with linked-in is a bad idea.

You might think facebook behaves pathologically but linked-in takes it to a new level!

Linkedin does let you use the same GDPR mechanisms built for compliance even if you live in the US. I work there, not in these systems, but a bunch of development effort goes into maintaining meta-data. This is so systems can accurately auto-purge information when people close accounts or power the ability to export your data and make it as easy as possible.

Download your data. https://www.linkedin.com/help/linkedin/answer/50191/download...

Close your account. https://www.linkedin.com/help/linkedin/answer/63

Do you have any examples of that kind of behaviour by LinkedIn?

Well there was the well publicised man-in-the-middle attack by Linkedin.

They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining.

That seems like a pretty dark pattern to me. To my knowledge no one got fired for unethical behaviour over that.

The company seems to have a “don’t get caught” attitude to privacy.

Okay, I didn't actually know about (or remember) that one.

Regardless of their intentions, I don't understand how anyone could have thought that was a good idea.

>Well there was the well publicised man-in-the-middle attack by Linkedin.

>They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining.

Isn't that technically not mitm? That would imply the user was using linkedin as a mail client/proxy or something. This is closer to fraud or phishing.

Yeah, that's the 3rd time today I've seen someone use that word wrong on here.

Two years ago, I got a real 'welcome to LinkedIn' email on my relatively new company email address with my real name that couldn't have been extracted from the address. Password reset did not work, no account existed.

Best guess is someone there messed up when they merged some internal email lists.

LinkedIn used to (maybe still does) push users to "see who's on LinkedIn" by connecting your contacts.

They then maintained this connection indefinitely without telling the user and also used it to spam people under your name.

They used this system to send my ex-girlfriend an invite to join me on LinkedIn. Absolutely repulsive and infuriating.

You left out the most important name: Microsoft. LinkedIn is Microsoft and has been for years.

Don't trust Microsoft.

Now the question is: Do they keep a track of these CCPA forms? Is there a data collection of people asking to remove their info.

This is an interesting question. I was technical lead for CCPA and GDPR implementation at my company. We keep hashes of email addresses that have asked to be forgotten and we compare new email signups with the hash list to make sure we never collect their information. Both laws allow companies to keep lists of requests but we like to be extra secure.

crunchbase is one such place. they harvested everything from my LinkedIn, I asked them to remove my profile they say it's not possible unless I also send them additional data (scan of my passport). they say it's impossible to remove my info because it is "crowd sourced" which may be the case today but from the data they have on me it is from when they had no users yet and when they scraped sh!t from linkedin:

Hello,

To comply with various privacy laws, we require the completion of this form to remove the person profile you have mentioned. If you would like to delete your personal profile page, please complete this form here.

Best, Erika

----

Dear Erika,

thank you for the information.

I have never signed up to this site and therefore do _not_ consent to any information about me being stored on your systems and I do not care who creates these profiles. It is your responsibility under GDPR not to store information about me without my explicit consent and I therefore kindly ask for information about me to be deleted, further I expect any future profiles about me to be blocked from getting created and such info not to be stored also in the future.

In case information is not deleted within 30 days I will hand over this matter to my lawyer and also file a report with my data protection commissioner in the EU.

best regards,

----

dear <...>,

Thank you for contacting Crunchbase!

Please note, if you have an active trial or subscription we recommend that you cancel first before moving forward. Instructions on how to cancel your trial here. And instructions on how to cancel your subscription here.

If you would like to download or permanently delete your user account information, please complete this form here.

If you would like to delete your personal profile page, please complete this form here.

If you would like to deactivate your user account, please reply to this email to deactivate your account. You can contact support@crunchbase.com if you wish to reactivate your account at a later date.

Keep in mind, your user account is the private information that you can use to control your billing, login information, and alerts. A profile page is what displays externally on Crunchbase - these are completely separate. Because Crunchbase is a crowdsourced platform, any registered user can add or edit any profile page - profiles are not explicitly linked to any user.

Please feel free to reach out if you have any additional questions - we'll be happy to help!

Best,

Erika

Yep, same shit. Just checked my email, the last one in question was 'Apollo'. The form in question makes you attest you are a resident of California, which began the back and forth.

APOLLO

Dear Alex,

On behalf of Apollo, we are pleased to assist you in exercising your access rights under GDPR and/or CCPA. You may exercise your access rights as follows.

If you wish to remove the personal information that we have that is tied to your email address, then please respond to this communication by submitting the attached Identify Verification Form. We will then respond to your access request upon further email verification.

Why we require this: We require the above because GDPR and CCPA asks that we verify your identity to a reasonable degree of certainty before providing information: this is important, to avoid providing personal information to someone “spoofing” an identity. We believe this process provides that reasonable certainty while avoiding having consumers send us personal government IDs, which contain sensitive information and which we prefer not to receive. (And, unlike companies that deal directly with you, it’s not possible for us to verify you based on our prior relationship – like, by having you list your last movies watched, clothes purchased, or trips booked.)

If you prefer to avoid the above process, you can learn detailed information about the categories of personal information that Apollo collects, and how we source it, sell it, and use it for business purposes, by reviewing our Privacy Policy (available at: https://www.apollo.io/privacy). That Privacy Policy also will tell you how to easily opt out of our marketing databases.

Thank you for your interest in our business and data practices.

This is such a shitshow. They never took "reasonable degree of certainty" before storing private data either - it makes no sense to then ask that for deletion requests.

It does if you want to feign compliance while making it hard to delete data.

Deadlines help a lot. Has it elapsed, and what was the followup?

yes it elapsed and the "profile" is still up. my only choice now is to complain to my "data protection commissioner" but considering GDPR has no teeth I'm not confident it will impress anyone.

It has teeth, but it's not very hungry right now. Still, if you complain and CC crunchbase in, then it's them who have to do this calculation, and in context of risk. It may just be enough to get them to remove the data about you.

Was the "I will hand over this matter to my lawyer" piece a bluff? :(

Good question. 99.999999% of the time when some internet rando says he'll contact his lawyer, the reality is that he has no lawyer and no lawyer would ever take his case.

Threatening to tattle to an imaginary lawyer just gets you written off as an angry whack job.

"It is your responsibility under GDPR not to store information about me without my explicit consent..."

Not commenting on the particulars of this case (you might be right in this particular instance), as a general statement this is not true. Consent is only one of several possible legal grounds for processing personal data. Generally, data controllers want to avoid it if possible in lieu of more convenient grounds. Nitpicking more, explicit consent is mentioned only as a processing ground for so called special category data, i.e. certain sensitive data, e.g. health data, requiring an additional legal ground.

I mean is their point of view completely wrong? If they are displaying a profile based on public information that’s journalism.

Lists of people who invested in companies, culled from public disclosures, or names of corporate board members and such, aren’t the same thing as private PII.

Reply on news.ycombinator.com