LinkedIn breach reportedly exposes data of 92% of users, inferred salaries | Hacker News Reader

LinkedIn breach reportedly exposes data of 92% of users, inferred salaries

9to5mac.com

140 pointsaburan2879 comments

duplicate: - https://news.ycombinator.com/item?id=27675648 - https://news.ycombinator.com/item?id=27674393

Meanwhile, in Norway...

Norway: The country where no salaries are secret https://www.bbc.com/news/magazine-40669239

Removing anonymity of searching made a significant difference as did letting you know who looked you up. This is a form of social pressure that seems to balance out their need for transparency versus the "peeping tom" aspect of open salary data.

There are some less than good social impacts but I'd say on balance the overall result is positive.

I actually think any job ad without a salary indication should be seen with suspicion and mistrust. Its basically false or deceptive advertising. Its like going to a shop to buy some fruit but them being sheepish about the price. Negotiations then ensue and you give them an offer and they say "that isn’t realistic". But you easily counter with "well you should have listed the price". The ensuing negotiation includes sich phrases as "you should know the market" and all sorts of "competitive market" slogans.

In the end they simply want to clamp the price down and take advantage of ignorance rather than any kind of ethical stance. We tolerate this unethical behavior because "that's how it is".

You all don't have an issue with sites reselling the salary data in an anonymized fashion to those "Peeping Tom" types?

Yes and no - up until a few years ago, this kind of snooping was anonymous, but that changed, and right now you can see who's been looking/snooping through your profile. Some people figured that they can charged a couple of bucks to do that for you, but I wouldn't say that it is any large or serious business.

The level of population control in some of these smaller European countries like Norway and The Netherlands is insane.

They always try to project a progressive and relaxed image, but you better do not try to deviate from the norm. The norm is: Work for a low salary, buy a tiny overpriced house from the ruling classes, eat sandwiches with peanut butter and celebrate Queen's day.

Surveillance levels are high but covert, extrajudicial punishment is enshrined in the law.

What?

Also only Americans eat peanut butter in significant quantity no?

From my experience in Europe decades ago the Dutch eat peanut butter. It's pretty much unknown in the rest of Europe.

> It's pretty much unknown in the rest of Europe.

Maybe you meant the EU (genuinely, not a dig), in which case you could be right. In Europe however we in the UK have a big fondness for peanut butter too.

I'm certainly not well versed in the literature but I do remember reading a study that showed Norway's open salary data led to people being less happy overall no matter how well compensated they were relative to their peers.

Balancing transparency with an individual's right to privacy is a tricky subject.

Conversely I've read many articles from organisations that have switched to an open book salary policy leading to an increase in employee happiness.

From my anecdotal experience and studies, this seems to not be the case:

https://www.wsj.com/articles/the-downside-of-full-pay-transp...

Also, defining the problem by first principles, this effect kind of makes sense. 80% of people think their performance is above average, which collides head-on with reality.

Add the effects of Group Bias and you have a recipe for constant infighting, jealousy and misery.

It gives you a rough estimate of income, but should not really be trusted if your goal is to negotiate your salary because you've been checking out your co-workers income.

The salary shown in our skattelisten (tax list) is what's called the general income. That is: All taxable income, minus deductions. This means that the income you see in our tax list is going to be lower, than what it is in reality.

It could also appear much higher, if you've sold something which counts as taxable income, done consulting/side gigs, etc.

Yea, got hit up by a recruiter for a full-time position in the US. I always respond "what is expected salary". I get back "we are a small company and not comfortable discussing that due to our current financial status."

I didn't reply back. But, the recruiter told me much more than she think she did with that statement.

Privacy is trendy, but imagine if everyone had access to salary data.

You find your coworker makes more money, you ask for more.

Or if all medical data was public, we'd have a medical revolution in understanding.

Or if your Facebook likes were public, other competing websites could generate a network easier.

Sure there are downsides to open information, but I can't help to think that privacy benefits the few, openess benefits the masses.

(Obligatory- doesn't apply to keys or whistleblowers, but I imagine they should be taking far greater precautions than using Apple who continuously bends to China and the US government)

>Or if all medical data was public, we'd have a medical revolution in understanding.

US medical billing data (which include who, where, what, why and when) is fairly easy to access (ie: 100+ million patients anonymized) and hasn't helped patients much from what I can tell. And many many companies have tried.

>Or if your Facebook likes were public, other competing websites could generate a network easier.

And oppressive governments can hunt down dissidents, hate groups can hunt down minorities, parents can disown their gay kids earlier, etc. Once you add up all the groups that make up "the few" you get rather a lot of people.

It’s probably not good enough to guess patient outcomes. It’s not like you could look up a surgeon and find how often the patient has a problem and then correct that against the risk pool of the patients

I mean you literally can. Billing data included the doctor, the procedures performed, the diagnosis given, patient demographics (age, gender, zip code, etc.). Plus a whole bunch more. Very well structured data actually although there's biases in it. My last company literally did what you said using the data. Not enough money in it so it all goes nowhere and all the big players in the space don't really care.

edit: You also have full medical billing history for each patient in the data set so you can build a historical risk profiles for patients.

That sounds like it would be a trivial to de-anonymize.

Also I’d be curious how good medical experts actually think the data is. In my field i find that data that looks legit is often actually bad enough to the point of near uselessness because the incentives aren’t aligned with collecting accurate data

The incentives are with collecting data that insurance companies will not reject your payments over. If an insurance company noticed you're mis-billing then you lose money. They may request full medical records of patients to verify. Which incentives generally clean data although there are biases such as up billing and spurious diagnosis to get medication covered. Medical records themselves are a mess often but billing data is better since a lot of money is on the line.

>That sounds like it would be a trivial to de-anonymize.

In theory yes if you joined to other identified data sets but in practice doing so makes it a massive HIPAA violation with very large government enforce penalties. There's also enough contractual sanity checking and costs that no one who gets access would bother.

I'd like to add that anonymized billing data has helped a lot of companies make a lot money. That however is separate from helping patients. Helping pharma companies better market medications to doctors makes a lot of money but is arguably a negative for patients.

> Or if all medical data was public, we'd have a medical revolution in understanding.

No, your insurance premium would go up. That's it

Why? It could also go down.

Because there's no incentive for them to reduce prices.

There are many competing managed care organizations (health insurers).

Healthcare cost increases slowed down after ACA:

https://www.cbpp.org/blog/more-evidence-of-post-aca-slowdown...

https://www.npr.org/2019/12/23/790687286/examining-health-ca...

I believe the research, but I doubt the ACA slowed down increases due to competition. The studies you linked don't show evidence of it either.

Most people do not get to shop for insurance. Individual market plans are all similarly and eye-wateringly expensive (last I checked). And people getting health coverage through work are lucky if they have even two insurers to choose between.

Therefore I don't see any reason why insurance companies would uniformly lower their "baseline" premiums when given access to more information. If they were all competing for your business like car insurance, homeowner insurance, etc. things would be very different.

My claim is that the rate of increase in healthcare costs decreasing is evidence that there is incentive to offer the lowest price possible (and health insurance premiums are a function of healthcare costs). If there was no incentive to offer lower pricing, then it does not make sense that healthcare costs would have slowed down when the number of people receiving healthcare greatly increased after ACA.

Also, health insurance is not like other insurance, and it is barely insurance at all. Over a lifetime, almost everyone will need healthcare, unlike car insurance and home insurance. Due to ACA's various rules around how health insurance can be priced and who it has to be offered to (everyone), health insurance company is actually a misnomer.

I prefer to use the industry term managed care organization (MCO), as it more accurately encompasses the function of what is colloquially known as a health insurance company. The price for individual market plans (which I assume you mean those on healthcare.gov) and the price for employer sponsored ones where the insurer is the one insuring the risk are all priced similarly, and they are eye wateringly expensive because healthcare is expensive.

Employers also shop around for premiums with various MCOs, they don't just choose one. The self insured employers (who pay for the healthcare themselves and just pay the MCO for access to pricing and administration of the health plan itself. I have never heard of anyone choosing between different MCOs at work, that would defeat the whole purpose and really complicate the non discrimination testing requirements.

Either way, MCOs certainly do have to compete with each other for business, if they're selling insurance plus managed care services or just managed care services. And so they cannot just lower or raise premiums at their whim. Bottom line is they do have an incentive to offer competitive pricing, it is not a high margin business to begin with.

In the US, health insurance premiums are (by law) based on age, location, and smoking status only. Highest premiums (age 64) are capped at 3x the premium of ages 21 to 24.

The 3x cap is not universal, and what it ultimately does is raise the price of insurance for younger and healthier groups. Smaller groups are exempt from that requirement.

Since my company skews younger/healthier than the average company (hey we are a startup after all, new to this) - we are able to join a state commerce association and get rates calculated on our actual risk, which saves us roughly half over the national pool. I think it also takes full medical history into account, to again give us lower rates.

But of course the global effect of this, is as younger and healthier groups leave the national pool - those left gets even HIGHER rates, as the super profitable healthy young people are gone. And the more the global pool rates go up, the more people pull out. Until the national pool is only sick and old groups, with insane rates.

Yes, that was one of the unfortunate compromises that had to be made to get ACA passed. We could not get taxpayer funded healthcare passed, so they tried to dump everyone on the insurance market. Then the people that work at healthy, younger white collar firms balked at subsidizing others, so they were left out.

We Americans are quite good at making systems that benefit others just enough to create plausible deniability, but with enough loopholes to evade helping shoulder the burden, if you are playing with the right cards.

Yah it's just a silly system.

We need full universal healthcare. These other things are just a mess.

Conceptually, I think the MCO (managed care organization) system works as well. In a taxpayer funded system, the MCO activities are performed by government employees directly. In an MCO system, there is some extra overhead, but MCO profit margins are 5% or less, so it is not terrible. It is just that everyone needs to be forced to go through healthcare.gov, and I don’t see why Medicare or Medicaid should even be a thing. The hodge podge of systems is the worst of all worlds.

Of course, I know why it is a hodge podge, and that is because increasing the amount of healthcare available to everyone would increase costs and hence taxes and/or premiums.

Maybe. But the current system means a lot of people never get care until things get real bad, and it's the ER. I am not sure the total price goes up with a full universal healthcare... but, a lot of large companies (blue cross, etc) are obsolete.

Is the coverage also mandated? How about the adjudication process? How about the amount of effort to successfully file a claim?

As a hypothetical, consider a process requiring each claim to be submitted in person, 9-10am on Mondays, down an alleyway in Toledo, 4 week turnaround, and then resubmitted 6 times before it's approved. It's not quite this bad, but everybody has a horror story and (unlike auto and home owner's insurance), I've heard nobody say anything nice about their health insurance company.

(I'm working on a winning team fixing this at national scale, DM if interested)

Yes, health insurers have to cover anyone. There is an appeal process where a third party is required to arbitrate if you feel the insurer is not approving payment for something inappropriately. I have not experienced it, nor do I know anyone who has, so I do not know what that experience is like.

I do not know what nobody saying anything nice about health insurance companies means. Although, I do know from experience, that most people are not knowledgeable about many businesses, but they do like to opine on how things should be. Insurance in general is bound to have unhappy customers, whether or not justified. People interact with health insurance more than any other, so I would expect a lot more complaints.

I do not doubt that managed care organizations (health insurance companies) have screwed over people. But that probably applies to any large organization. I have not seen evidence that they do so on a systemic basis, however.

Note that they are often administering rules made by others, such as private employers or governments (Medicare/Medicaid). In these cases, I think part of their role is to serve as a third party who the decision maker (private employer or politicians) can point at when people get mad.

> (I'm working on a winning team fixing this at national scale, DM if interested)

One thing for sure is there are many improvements that can be made. Best of luck!

I am an interested rando, where do I DM you? Is this another feature of hn that I haven't unlocked yet?

It means click on their username and email them or go to whatever link is in their profile.

My insurance company gets me lower costs than the hospital would otherwise provide.

It's a guarantee that I don't pay more than 8000$/yr for healthcare.

Without the insurance company, I might be in debt after a hospital visit. If the medical cartels weren't so corrupt and I could get a price, I probably wouldn't use insurance.

> Privacy is trendy, but imagine if everyone had access to salary data.

Already true in Norway. https://www.bbc.com/news/magazine-40669239

Less true now than it used to be, they implemented a limitation after that article was published.

Nowadays, if you try to check someone's salary, there is a big box on the website saying "The person you want to check the salary of will be notified that you checked. Do you want to proceed?" where I believe most people go "Nope, cancel that."

Or you just find someone as a proxy and run all of your queries through them. Like, my grandma in the other end of the country. The other party can't do anything with this information.

Privacy benefits the few, openness benefits the masses = openness allows the masses to ferret out and punish deviance.

Actually, privacy benefits the minority. This distinction is critical to remember.

Exactly. “Benefits the few” is just a negative / populist spin on “protects minorities.”

At a place where I used to work, we noticed that the new project management and time tracking software, that had been rolled out to much fanfare, would let you check the salary of anyone in the company simply by editing the URL in the browser and reading the XML file it sent back. I've never seen IT fix anything that quickly.

In a utopian world where everything is public, I can see how transparency can benefit the masses.

However, realistically, the powerful will fight tooth and nail to retain secrecy, and those who open up first become vulnerable due to informational disadvantage.

So, let's start by publishing the salaries of the rich, and then work down from that ;)

"imagine if everyone had access to salary data..."

This is exactly why employers dont want this.

> You find your coworker makes more money, you ask for more.

I used to believe this when I was younger. Many, many years ago I used to work for research team a state university. In most states all public employee salaries are public data and there are watch dog groups that collect this and post it online. Right now if you have a friend (or enemy) working at a state university you can probably find their salary.

While working there, there was an IT/tech staff that was pretty incompetent who most people gave a really hard time. This person didn't have much formal education and didn't understand anything about their role, but I and some others always felt that "hey, they get paid next to nothing so don't give them such a hard time."

Then someone looked up their salary and found they made more than most of the junior faculty in that department. The result wasn't a wide spread demand for more equitable pay, but universal anger that this kind but lazy employee was making more than the majority of the department. As much as I hated it, I myself immediately lost all pity I had for this person.

End result was that nobody got paid more, and if we could have voted we probably would have argued that this person should have either been fired or paid less. Even if in theory workers should stick together, and even in an academic dept where most people understand this theory, we're still trained to turn against each other.

In my experience the best way to share salary data is anonymously. https://www.levels.fyi/ radically changed my salary requirements, and it's incredible how many young people working in tech have no clue how much they could be asking for. Whenever I end up mentoring a junior tech worker I always make sure they understand how tech compensation works and what the upper bound really is. Most react at first with anger that they get paid little, but nearly all negotiate much harder when applying for their next job.

Information is essential to increasing worker pay, but personal information can only result in pettiness and strife in my experience.

> we probably would have argued that this person should have either been fired or paid less.

Does not sound like a healthy conclusion to me. Actually, a pretty shitty one. Not only they were bullied by most of their work colleagues, but they would conspire to lower their salary. The problem is not that salaries are public but that your work environment was really toxic. I hope they found a better place.

At my current employer, everyone's salaries (and the number of options they've been awarded) are in a Google spreadsheet that's viewable by everyone in the company. It's actually kinda cool to have such transparency and has forced standardization of things, and I have to imagine it has reduced biases and made things fairer.

Every company I've seen that has one of those pays jokingly low salaries compared to competitive companies. Rather than it being used as a tool to ensure fairness, it seems more used as a shield against negotiation. "We can't pay you <competitive salary>, that'd be $50k more than someone more senior than you! You wouldn't want to be unfairly paid more than your colleague, would you!?"

I worked at a hedge fund that had open salary data available to everyone and paid comparably to the hedge funds/prop desks I worked at that didn’t.

I try to look on the bright side these days. Can't wait to find out all the weird stuff LinkedIn knows or has completely wild-ass guessed about me!

And by the way, recently YouTube has been serving me exclusively Spanish-language ads. I am probably 0% Hispanic ethnically and have no knowledge of Spanish. Would be cool to get a data leak that shows what's up with that!

Looks like this data has been collected through the official API, so you could just query yourself in there.

I'm too lazy, that's why I appreciate these hackers who go to all the trouble on my behalf for free!

> recently YouTube has been serving me exclusively Spanish-language ads

This has been happening to me, but on Twitter! I know a very basic amount of Spanish, but am a non-hispanic dude in semi-rural Texas.

> semi-rural Texas

Pattern matched.

I started having a similar issue with Spotify a couple years ago. Eventually I discovered that someone else was using my (free) account to listen to bunch of Spanish-language music that I'd never heard of. I don't think my Spotify recommendations ever recovered.

LOL, w-a-y b-a-c-k when it was only your name and address that was sold to marketers and the spam was snail mail, friends and I would sing up for things, order catalogs etc. using a different name each time. Then when the junk mail came you knew who sold you out.

Is LinkedIn actually an important thing to have?

I made one years ago and used to occasionally go in and update it, but with my most recent job I didn't even take the time to add it. The past few years I've really re-evaluated what should be public, easily-accessible information for anyone who knows my name.

And all I get from having an account is recruiter spam, and emails for connection requests that are oddly written in first-person and have the person's name as the sender which seems weird.

You get out what you put in. If you have a languishing account and don’t use it then you’ll get what you describe. If you are active then it gives you opportunities to network and meet people with similar interests.

I got a job at a very good company through LinkedIn

A guy had posted about opening in the company. I sent profile, he referred me and I joined a few months ago.

It was a blind referral. I didn't know the guy or that they had an opening!

I find it quite valuable to get information about companies.

I did get a job through LinkedIn once, so I think so.

It’s certainly more valuable than Facebook.

I got my current job because a recruiter found me on LinkedIn. I participated in a “hiring day” that greatly increased my odds of getting an offer. Doubled my salary and it was an invaluable step for my career. I spent maybe 15 minutes setting up the profile after a few years of rolling my eyes at the platform. It’s worth it; much easier to get an interview than sending an application into the void.

That's good to know. And it seems like there's a good handful of other people with similar experiences (though that could be bias of the type of people who would be in a thread about linkedin)

Maybe I won't discount it. The dark patterns of the site are just such a turn-off, it really doesn't make a great case for itself in the UX.

Totally agree on the UI, and I’m by no means “active” on the site (I don’t post, comment, or really network at all). It’s just a copy of my resume that shows up in search results, essentially. And recruiters definitely abuse this (looking at you, Amazon). Pros and cons :(

What's a hiring day? A quick search found nothing.. Is it a LI initiative?

Even if you aren’t looking for a job it can be useful to control your public profile as you meet interact with new people. As I work across groups, I definitely see people who I’m meeting for the first time check out my LinkedIn profile. It’s hardly every time, but enough that I’m glad I’m controlling the messaging.

Were those phone numbers collected using "We need your phone number to increase your security" (or similar) or just added by users to their linkedin profiles?

> "We need your phone number to increase your security"

Lies and liability.

Any website already up to check if you were in that breach?

“Breached” seems like a strong word: “ LinkedIn tells Bloomberg in a statement that it looked into the matter and found that the data was web scraped public information from its site and other platforms.”

So they scraped a bunch of websites including LinkedIn and created a joint dataset?

You should shut down your linkedin if you are not actively looking for a job. It's a public resume which is a security concern at best.

Just reminded me that I still have a linked in profile. I never use the service, so I’m going to delete this profile.

Data within deleted accounts has a tendency to just disappear from access rather than actually get destroyed because companies like to be "helpful" in case you change your mind.

Consider scrambling the data in the account first. Wait a few weeks then delete the profile. Consider also setting a canary email address before you delete the account so that when the final account data later resurfaces you at least know.

This is the best advice!

"Deleting" an account has to be a systematic user-side process. We don't talk enough about that.

Need a right to be forgotten 2.0 legislation in the US.

"There is no cloud, just someone else's computer"

Probably my favorite sticker/meme.

Reply on news.ycombinator.com