Battle with bots prompts purge of Amazon, Apple employee accounts on LinkedIn
krebsonsecurity.com
krebsonsecurity.com
The company is in my home, in New York.
I reported the fake profile, but it's still there, listed as an employee of mine.
[UPDATE] Actually, belay that. They seem to finally be gone.
I would suggest you encourage a large volume of contacts to report the profile. Funny that you have to game the system to achieve a perfectly legitimate result.
Of course a giant faceless low-margin corporation is going to do a bad job of moderation. I wish it weren't such a big deal when they fail at it
Site builders like SquareSpace, Wix, and WordPress are also close, but they're mostly designed and marketed as professional tools rather than personal spaces.
Most people don't ever want to hear words like "DNS record" or "PHP version", but they do want to express themselves, and they can figure out a markdown or markup language in pursuit of that.
Tbh I think most people just don't need to even be posting on a blog, myself included. It's nice to think you have something important to say but we mostly don't. How did our self-worth get tied up in this mess?
Of course if you want to start a blog you should. Maybe you do have something interesting, thoughtful, or worthwhile to say. Maybe you just want to keep a diary of sorts or post for a few friends or family members. But moving from social media platforms to self-hosted blogs misses the key step that most people just need to get the hell of the Internet instead of starting a blog or posting on social media.
I disagree in that I think that a lot more people should be doing this. The problem is that it is a lot harder to do this than to speak to the entire world. Private networks have been discouraged, not facilitated. Or more accurately, people were pulled into social networking with the promise of small private networks, and these companies wait until they reach a particular size to start a constant push towards opening up the networks and hiding the statistics about them.
Myspace was entirely a bunch of interlinked small private networks of friends. Everybody presented themselves as they liked to people that they knew (maybe barely knew, if you were an extrovert.) This was compromised by the networks deciding to automatically broadcast unrequested information, obviously like Facebook Beacon, but also "Bill just joined the group Guys Who Like Beer" and resetting/redesigning everyone's privacy settings every time they added a new beacon.
It was a very short step to exercising full editorial control over everyone's presence, which is the product. So they manipulate User A's presence to motivate User B whose presence they're manipulating to motivate User A. All in the service of increasing time browsing and the amount of information shared, hopefully maximizing the value of selling a few inches of the screen during that time browsing.
There will never be a significant incentive to stop intentionally alienating User A from User B. It would take away the primary tool that they use to maintain and grow the business and be a phase change in profitability. These are not companies providing real value, they are companies that hope to disrupt the production of real value and extract it. They only work as protected monopolies or trusts, because if there were commodity services that did what they do as a dumb pipe, their sites would be wastelands.
> most people just need to get the hell of the Internet instead of starting a blog or posting on social media.
No, people need a quiet, secure, consistent presence on the internet that does what they want and no more, doesn't try to hurt or confuse them for money, and doesn't need to be constantly futzed with to combat incursions by the host.
If I put a poster on the wall, I just have to dust it once or twice a year, and it will never decide to start associating my medical information to my Amazon purchases. That poster will tell my friends the types of paintings I like, without trying to tell its clients who my friends are (i.e. who would be friends with people who like the kinds of paintings I like), or even testing that poster for misinformation and removing it from the wall without telling me (or waiting to remove it and counting how many people put it up on their own wall as a result.)
People deserve a place to be safe on the internet. Instead, the motivations seem to be to make everything on the internet dangerous and constantly in flux so it a) constantly has to be engaged with, which serves eyeballs, and b) incursions of companies into your private life and your pockets can be successful.
Self-hosted blogs are a bad solution because they are hard to create, secure and maintain. Getting off the internet is a bad solution because it's a request to drop the cheapest, most comprehensive communications system imaginable because if you're a normal person you have nothing worth saying. My grandmother disagrees.
How does the automated bot know the perfectly legitimate to the wholly being scammed?
May as well leverage the weakness for good when we can.
This is part of setting up ID thefts, or scams.
I know of several (directly, not just one secondhand anecdote) people that had a huge mess, when someone used their identities for criminal behavior.
If someone claims to work for me, and then goes and causes havoc, using that connection, guess who they'll come after?
Taking thirty seconds to send out a quick report is not "wasting time." Why on Earth would you think of it as such?
People have:
* Tried to sell our product to others, despite not being affiliated with us
* Acted as recruiters for our company
* Tried to get jobs at other companies pretending to have an employment history with us
It's frustrating that we cannot do anything other than report it to LinkedIn, who may or may not take it down eventually.
The next time you are answering a LinkedIn DM, remember that anyone is allowed to write anything on there. None of it is verified.
https://www.edenpress.com/productcart/pc/viewPrd.asp?idprodu...
Now, in 2022, people are just using the mismatches between various Big Tech walled gardens to do the same.
Plus ça change, plus c'est la même chose
There's a strong case for arguing the content negatively affects the brand value, etc., of your organisation and in some circumstances could be considered libel.
I reported them multiple times and each time got an email from linked in saying they were legit content.
LinkedIn is purposefully ignorant in the hopes of driving fake engagement.
From Upton Sinclair Quotes:
It is difficult to get a man to understand something when his salary depends upon his not understanding it.
Actually, does anyone know a more appropriate latin phrase?
I report them all as fake when they add me but they never get erased.
(I'm also Asian so not discriminating.)
If you would not be Asian it also would not be a discrimination.
Don't use LinkedIn. People who use LinkedIn are negatively signaled in hiring.
1: https://www.statista.com/statistics/273439/number-of-employe...
https://stripe.com/identity (only as an example, many vendors offering this service)
LinkedIn allows you to change your name and profile content as often as you wish, and doesn't keep or publicly expose any of a profile's past info.
No? I guess not. Funny to imagine though — the numbers of accounts on said platforms would collapse like the birth of a black hole. I'll bet it would be a lot more of a pleasant place to hang out though.
My last employer got hit by that, and had report the listing to LinkedIn support and wait for them to remove it. Meanwhile the scammer could use to job listing to collect information from targets.
We busted one guy who claimed to work somewhere 20 years ago that a colleague and I worked at. We thought he was a a former colleague - basically there was a guy named “John Smith” that was this guy. It was too long ago to disqualify the guy, so we validated his LinkedIn history items carefully and they were mostly bogus.
Everything looked legit in the surface. It was like a spy movie or something.
Don't ever set hiring goals. Hire individuals, not numbers. Your company probably doesn't need to hire a hundred people in a month.
Also, the content created by (seemingly) real people is sometimes worse than if it would be automatically generated. I run a couple jobs board groups on LinkedIn and the amount of sheer amount of low quality spam that people are trying to push in is incredible.
Despite all that, I still find LinkedIn useful.
In order for that number to mean anything, they'd have to know what the total is. It would be more accurate to say that 96% of those who are caught at all are caught by LinkedIn themselves (presumably the rest by third parties) but that says nothing about how many are still in the system ... and that still seems to be a lot.
But you certainly can get a good assessment without knowing the total population.
They don't need to know what the total is, if they knew the problem would be solved.
96% represents the probability of a correct prediction, not a fraction of the total.
You don't know that. If I was premature in making a guess, you were equally premature in contradicting it. What's your interpretation? That they meant 96% of the total? I might enjoy seeing you explain how that could be true while still leaving 600K Amazon/Apple profiles to be cleaned up in a special campaign responding to media exposure. Do you think it's 96% of what they could have caught by manually examining every profile? That's no more supportable than the theory you summarily rejected. Your own guesses or assumptions are no better than anyone else's.
By contrast, I've had less than 5 companies reach out from Hired and Triplebyte (and none that were offering competitive pay), even though I got top 10% scores on the platform's stupid quizzes. If there's a new platform I should be using instead, please let me know, because having to respond pleasantly to 19/20 recruiters who are wasting my time is a bit draining.
Unfortunately, I didn't major in CS and have only worked at two companies, neither of which normally pay well, so my network is pretty limited.
I strictly separate work from personal stuff. Work stuff gets my work email. Personal stuff gets my personal email.
Traveling for work and need to book a hotel? Work email. Apple Id for work laptop? Work email. New account per employer. Gets disassociated and closed before I hand in my laptop. Electronic pay slips? Personal email. Health insurance account? Personal email. Apple Id for personal laptop? Personal email.
There are things I need or want access to without being dependent on my employer.
LinkedIn has nothing to do with my work. It's personal. It's about me. I list information about me. It's like a CV. No I should not have to update my CV through my work email account where my employer has access to information they shouldn't and where I can't update it if I no longer work there.
That (changing your account to use your work email for sign-in) is not what they're suggesting; they're suggesting binding the email address as secondary information to your account (by sending it a magic-link email you have to click) — like a Keybase verification that you "own" a profile.
They already know your corporate email address. They — and anyone else who sees the public profile they display for you(!) — has all the information required to deduce it. (And privately, they have all the info required to not even have to brute-force it — i.e. they already know some of your coworkers' corporate email addresses, and so the format of the username-part of yours.)
The only thing they don't know, is whether you — the person who claims to have worked for company X, but might not actually — can access that email address.
Is there something scary about them having that information, over-and-above what's scary about them being able to do what they can do with the information you explicitly did choose to give them?
I don't update my LinkedIn right away for example when I change jobs. I usually wait about a year until I put the new employer. Why would I accept getting forced, as one of the first actions at my new employer, to list where I work?
IMHO, of the two options, the email is the more convenient and less invasive one — at the expense of not always being reachable by the time you need it.
The more I think about it, the more corner cases I see that make this problematic.
I think you may just have to accept that if you want to verify an employee, you'll need to call their previous employers. This is the way it's always been done.
You're talking about "they" as in the people reading the CV. Which works fine for the scale individual employers operate at.
But the point of this conversation, is what the services themselves, dealing with fake profiles at scale, should do. LinkedIn themselves don't make hiring decisions; they make money off of how reliable their listings are. Their incentive is entirely different than the employer's incentive.
By analogy: it's fine to talk about how a given person should carry pepper spray with them if they want to avoid getting mugged. But what should a city government do to make a city a place people want to move to, where people generally don't want to move to cities where they might have a high chance of getting mugged?
> Linkedin will never require proof of income. That's much more intrusive.
You seem to think we're talking about this being done for every company automatically. But my understanding is that bots are always trying to impersonate the same top companies — so this requirement would either be for a certain whitelist of important employers, or (more likely) would be an org setting that the LinkedIn org admin for a given company would set (when they're having trouble with bots), to require LinkedIn to do extended verification for people claiming to specifically be employees of that company. Very much like how Cloudflare has an "I'm under attack" toggle that forces visitors through CAPTCHAs. If your previous employer sets that flag... well, that's their fault. Same as it's their fault if they aren't willing to give you a reference for petty reasons.
Yes sure it is less invasive than the other option you gave. I mean income tax statement to show I worked somewhere, are you kidding me? To LinkedIn? Showing exactly how much I made? Your suggestions are not getting better. Less invasive doesn't mean it's a good idea.
Making the president dictator for 20 years is less bad than making him dictator for life. I still like democracy better, even if it's not perfect.
In other words, in a perfect world, the government requires LinkedIn and similar services to put users through KYC (i.e. demand proof-of-identity+income for sign-up)... and poof! These services cease to exist, because nobody's going to give them that for only the small amount of value LinkedIn provides people.
The single HR email seems like the best option since they would be able to retroactively confirm employment even if you've left.
We have a dozen or more fake employees on our page, plus ex-employees who never updated their linkedin, and there's no way for me to say, as a person who owns the business, "This person does not work here."
Ridiculous.
This is also an ongoing issue for Facebook, except the fake accounts use the same profile photo and name as real people. It's a vector for fraud and causes untold headaches for millions. It's been going on for years.
LinkedIn never did much of consequence for me, and I've been enjoying no longer receiving recruiter spam.
A long time ago I did once find a job through LinkedIn ads, but beyond that it's been a complete waste of time and energy.
At this point, social media, especially of the "professional" variety, seems like more trouble than it's worth.
"Wow, according to LinkedIn, over 8 billion people work at FacAmAppNeGoog! That company must be doing very well to be able to pay all those employees; let me update my important financial model based on this non-audited number. Nevermind that only 100,000 worked there a few months ago, this is fastest growing company in history! Here are 5 ways to replicate their success from the comfort of your broom closet:"
I imagine LinkedIn has no benefit from doing this. It would only serve to show how few real employees they have and devalue the platform to recruiters.
Ah good, they're finally cutting down on Chinese vendors with random company names and fifty unrelated products, soon I'll be able to trust a company's reputation again
"employee accounts on LinkedIn"
Aw.
You can rest assured they’re still handing out our information.
I'm independent as well and some of my biggest projects have been from former people i've worked with reaching out.
1. LinkedIn gave us Kafka
2. Netflix gave us Hystrix
3. Greatest of all, Facebook, who gave us everything: React, PyTorch, Jest
Anyways it’s a hot take, you’re totally right.
That said, it's been a couple of weeks since I have heard from Amazon. There truly must be a hiring freeze going on
I got to 4 people on my list before the emails stopped coming.
I just be as polite as I can, but I hold them to their word.