Hacker News Reader

Comment by throwaway4good | Hacker News Reader

They will suggest people who have looked at your profile. And I have noticed, if you have shared an IP address with - ie if you have used the wifi at your doctor’s office. I don’t think they can access your gmail - how would they do that?

View on HN

Wouldn’t the more reasonable explanation be that either OP’s (to their own admission) or the doctor’s contact list got extracted and the “match” was established that way?

I don’t believe that visiting someone’s profile automatically makes you a suggestion, but I may be wrong.

It is part of the suggestion algorithm. It's not "automatic" in the sense that it won't instantly and consistently trigger a recommendation without any other signals, but it can, especially if there aren't enough other strong signals to find sugestions on the person's account. A person who barely uses LinkedIn is more likely to get these very lightly associated suggestions because there is so little other signal for them.

In years gone by social media sites would try to login to your email provider using the social media password to scrape your contacts. This often worked because people reuse passwords.

More recently, they were explicit about what they were doing and offered it is a convenience feature.

Have they stopped this now?

That’s a serious statement! Do you have direct knowledge of this, or is it just gossip?

This was a well known fact during the years 2012 - 2015. It's not like it was hidden. LinkedIn asked you to enter your GMail password in a form on their website. It didn't require any sleuthing – you just had to log into LinkedIn and you could see for yourself.

The reason they implemented it that way is because Google did not yet provide APIs to facilitate contact import. As Google adopted more secure standards like OAuth, LinkedIn started using the official GMail API features like "import contacts," rather than logging into your account on your behalf.

People underestimate just how far privacy/security have come since 2013 (pre-Snowden), when even major websites still used HTTP on their payment portals. Someone could sit in a coffeeshop with FireSheep and alter your Amazon order. Privacy enhancing features like OAuth, TLS, and 2FA have only become widespread in the last 7-8 years.

Having the user enter their password for connecting to Gmail is very different to having the service try the passwords themselves. The service shouldn't even have the password in clear text to begin with.

Until OP provides proof I doubt this claim from such a big service like LinkedIn.

What you're describing is them asking you to give them the password explicitly so they could log in and get your contact list. GP suggested they did this behind the scenes by trying the password you use with their service. That's a pretty big claim.

Oh, yeah I see what you're saying. They didn't "guess" your GMail password as far as I know (although I wouldn't put it past them, especially back then).

Giving them your password so they can login on your behalf is just as egregious, IMO. Then again, Plaid did the same thing with your bank account and created a multi-billion dollar business out of it.

> LinkedIn asked you to enter your GMail password in a form on their website.

That is entirely different than what was claimed. The claim was platforms were running "credential stuffing" attacks against their own users by attempting logins to other platforms by guessing that they use the same email address and password for both.

Haven't heard about LinkedIn trying to login using social media, but LinkedIn has a feature that does contact import.

LinkedIn asks me to sync my contact/address book information from another source. After the import runs they show you connections that match your contacts sometimes in the connections tab.