LinkedIn forcing me to disclose my phone number to log in? No thanks | Hacker News Reader

LinkedIn forcing me to disclose my phone number to log in? No thanks

156 pointswillmadden92 comments

I've used Linkedin for over two decades. Now I'm being forced to disclose my mobile number in order to log in.

Given their track record of being hacked, I'm reluctant to share it with them.

Moreover, I'm already inundated with spam phone calls, and I'm not looking for another source. This is a thinly veiled attempt to harvest my data so they can hide it in a page with six dozen toggles which will periodically make my phone number visible to people who buy it if I am not logging into check what they've changed every day. Have you seen how difficult it is to opt-out of email notifications using their website?

If they were actually concerned about my security, they would give me other 2FA options that are more secure, like a Yubikey or authenticator application.

No thanks. I'm done with Linkedin.

View on HN

I hear you. I just got officially banned permanently yesterday. I do not use their app except the web. Last month I was kicked off because they claimed that I am using an automation tool, which I don’t. The second time they kicked me out, they asked me to confirm that I do not use an automation all. I said I don’t. Yesterday, I got kicked out and was told to upload a government id such as a driving license. Shortly after, I got a message “ We've deemed the activity in your account is in violation of the LinkedIn User Agreement and Professional Community Policies. Your appeal has been denied and your account has been restricted permanently.

Please see our User Agreement and Professional Community Policies for more information.”

I am not able to talk or ask anyone at LinkedIn why I have been banned. Is it because I don’t use their app? I don’t know.

Are you using Chrome? Do you have any extensions?

Nothing. I only use safari to access LinkedIn via iOS and Mac OS.

Right? Dude, please provide some additional context around your web browser stack because something you’re using is triggering their system. That or you’re click house neighbours are using your wifi.

I have private relay enabled via iOS iCloud. I have no extensions installed. Preload top hit is enabled on safari by default. (Not sure if this is could be a factor). I only use safari across my devices. 2FA is enabled for LinkedIn and save password. That is it. I access LinkedIn frequently throughout the day.

> I have private relay enabled via iOS iCloud

I can see that might be it - because it means LinkedIn would be seeing you logging-in from different IP addresses in different geolocations every time (though Apple doesn't let you virtually change-country, I understand in the US it does make it look like you've moved-state).

Good point. I checked my private relay settings in iOS iCloud. It is set as “maintain general location” along with a description “ Maintain your general location to receive localized content, or enhance your privacy by using a broader IP address based on your country and time zone. Safari Private Browsing always uses an IP location from your country and time zone.”

I also use iCloud Private Relay and LinkedIn seems happy in my case. There has to be more to it and I wish they’d make these kinds of guards more transparent. You can’t just ban people because some crappy algo thinks you’re a bot.

Thank you. I recently dropped my full time job to start a consulting job. I needed LinkedIn for the crucial networking during my early stages. Now I am completely banned without knowing why

Why do you assume LinkedIn is correct? I've seen multiple social networks pull the scam where they claim you've violated their ToS only to demand your phone number and other personal information for "verification", and then after they've slurped your data, they don't seem to care about the so-called "violations" anymore.

Twitter pulled that stunt on me: within minutes after creating an account, having done precisely nothing with it yet, they locked me out with some vague complaint about security and suspicious behavior, demanding a phone number. I refused to comply, and several weeks of daily complaints to customer support eventually got the account unlocked, with no explanation; they are clearly just harvesting numbers for the sake of it.

Good point - hijacked Chrome extensions are a huge, huge security risk, especially because auto-update is on by-default. It's entirely possible every time you login to LinkedIn some dodgy code in your browser is harvesting your cookies to pass to some bots who then scrape LinkedIn.

Auto-updating extensions, and software in general, is a huge risk that people still seem unconcerned about: popular extension authors get approached by scummy ads/data/"analytics" companies all the time to inject spyware or adware into their software (even me: I have a couple of Chrome extensions with only about 20k regular users and I get an email to Chrome Developer Dashboard address every couple of months, asking me to add a small bit of JS which in-turn loads in other arbitrary JS which could be doing anything to my users' browsers - I'm proud to say that I reply to each and every of those e-mails with feigned interest, as the only morally correct course of action here is to waste their time.

It's a standard measure to increase the cost of fake identities to decrease spam and Sybil attacks.

If you exclusively belong to communities that don't have such measures, you will be dominated by third parties who create mass accounts instead of the platform.

Choose your poison I guess.

if the guy has had the account for 20 years without being banned then he's probably not a bot

its a data harvesting exercise

You would think that, but you’d be wrong. Old inactive accounts get purchased and sold to bot networks all the time.

Aged accounts have very high value to hackers as well: https://www.vox.com/technology/2023/9/28/23892964/facebook-a...

Not to defend Linkedin, but it is always possible that new measures (filters) are devised by people who don't consider all the possible parameters.

In other words, some less-thinking Linkedin employee decides to do a thing without adequate consideration of all the information available (such as length of time of membership). Maybe Linkedin let some moron apply rules, or Linkedin is grabbing data for marketing/sales purposes, or there's an explanation we haven't realized yet.

Aged Reddit accounts have a decent market. LinkedIn could easily be the same.

Yep. I've seen plenty of cryptoscam posts with "Elon is giving away crypto!" and a screenshot that they pretend comes from Elon's X account.

Looking at the Reddit account they can be ten years old but with no activity at all in the last five or so years, then a sudden wave of these scam posts.

I'm embarrassed to admit this but I created a fake LinkedIn account of a woman I used to rope in men for sales calls. I "friended" probably 200 odd linked in open networkers over the course of a week and then would flirt with guys using my catfish account.

Those guys would enevitably get sappy and I would rope them onto a sales call with me as a bait and switch. I hated doing sales as well as myself and got out of it in a year.

Making a fake burner linked in was trivial.

What were you selling, and was your flirting via the LI app?

Based on my messages in LinkedIn, he was probably a LinkedIn employee selling Premium.

you know what they say: any app is a dating app if you are brave enough.

You jest, but harassment against women is rapamt on LinkedIn. Ask any of your woman colleagues the sort of messages men send them.

I still have my fake lady account and this is true. The thirst is real.

Regardless, I use it to troll people on LinkedIn now. Especially CEOs who post nonsense.

Agree? (See what i did there)

Shitty analytics software for cpg companies.

If you don’t need LinkedIn, don’t use it, I can’t think of any other “social media” platform that’s so cringy and weird like LinkedIn, there’s something off putting about it that no matter how I promise myself to be active there, I stop after one day. If you need it however, just get a burner phone, that’s what I do, I have a second number for all these kind of stuff, my personal never shared in any online service.

It's indeed sickening how seemingly sane people constantly repeat the company PR line like brainless little corporate drones. Or post stupid jokes or "investment opportunities". I immediately unfollow everyone on my feed when I see them do that. I have very few people still on it.

LinkedIn brings out the worst in people but in a really weird corporate PR packaging. Or some people really believe in their own marketing. I can't decide what's worse.

Ps I also hate all the sales people using LinkedIn to find my details and offer commercial services, usually totally irrelevant to my job. I block them and their companies immediately. But I wish I could report them to spamhaus or something. Microsoft 365 does nothing with the reports because most spammers are also their customers.

LinkedIn is hot nuclear garbage. Most of the job listings are ghost jobs and the rest are ones I'd not want anyway.

I'm adding "hot nuclear garbage" to my maledictionary and will use it proudly (with attribution.)

I had an account in 2013 for about a month. I was old back then and quickly got sick of entry level jobs in unrelated fields "recommended" to me along with the gagworthy "Boosters-Pep!" corporate religion articles.

It's easy to distinguish which jobs are fake and which are legit. At least in IT I can do that. Linkedin is crap, but it's one of the places in which you can get to know which companies are out there.

Unfortunately all social media has become hot garbage. I re-activated my LinkedIn account because my job is at risk right now and I have no other way to contact former co-workers.

Twitter used to be my way to keep in touch. Alas.

I won't be the one defending Linkedin, but:

- I got all my jobs via Linkedin (e.g., either a recruiter reaches to me, or I reach a recruiter working for company X, or I search through their job ads, etc.)

- I do not use Linkedin for anything other than job search. So one can easily not look at their timeline nor stupid social posts (linkedin notifications are off, and I do not receive any notification via email)

So, yeah, it sucks if they start asking for phone numbers.

It gives me Cyberpunk vibes.

I created a linkedin account once, didn't even post any resume, and it somehow found and connected me to coworkers from many years ago, whom I absolutely didn't want to know where I work and what I'm doing. Beyond creepy. I deleted account immediately and won't touch linkedin with a ten foot pole.

I have a friend who is a lawyer and has access to LexisNexis. When I found out what is in there for sale (and it's like a 30 year old service!), I kinda wanted to give up. It all feels like "Privacy Theater". Why would I worry about linked in when people can buy my most private info from so many places that I didn't even know existed?

Are we just kidding ourselves? (I live in the USA.)

It does seem like they have a lot. I’m on mobile, so I just glanced at the site.

https://supportcenter.lexisnexis.com/app/answers/answer_view...

My approach has been, gradually, to put everything into LLCs and trusts. Mailing address is one of the storefront vendors. Two real phone numbers and a couple VOIP numbers. I mostly use Signal for people I want to speak with.

I don't yet have a good screen of the address on my driver license, as I get some perks where I live and want to keep that for now. I am using passport more domestically for ID because it does not have an address.

Basically, don't put any property or services in your name, and all mail uses the storefront address. I suppose rich folks have wealth management person at bank who recommends an attorney for these schemes. It wouldn't scale at reasonable price point to make a service for this, though I have considered it. Most people "don't have anything to hide" so they will not see value in such a service. If people won't opt out of TSA's voluntary full body scans, they won't be interested in privacy.

You can't screen everything overnight without help, so start small like put a car in a trust or LLC with address somewhere else.

The downside, or upside?, is that on paper you will have nothing. Definite upside is keeping controlling paperwork straight and replicated to people I trust.

Note that if you are in the US, you will have to report yourself as beneficial owner of these LLCs to FinCEN starting Jan 1 2024[0]. The government super duper promises not to leak the info[1].

[0] https://www.fincen.gov/beneficial-ownership-information-repo...

[1] https://www.federalregister.gov/documents/2022/12/16/2022-27...

I’m sure there’s nothing to worry about. The first time was unprecedented. The people responsible for the second leak were probably really very clever, and it was a different time back when the third leak happened:

https://news.bloomberglaw.com/bloomberg-law-analysis/analysi...

Also, that article from when the third leak happened points out they had three leaks in three years. It doesn’t mention anything after the 2020 leak. It’s definitely fine now.

"Beyond the direct benefits to law enforcement and other authorized users ...".

They are going to squeeze us through banking, which they already have full visibility into.

It's amazing the power they have to make up new "rules" this broad without a vote by elected officials.

In the US we need to abolish the income tax, corporate tax, and all of the other federal taxes, and add a VAT that scales higher for luxury items like houses over certain values and luxury items.

This would end up being far more progressive that the shit show we have today with the tax code. It would also lower stress levels 10x.

We also need to revoke the bank secrecy act and patriot acts. We can put in a streamlined subpoena process if law enforcement needs access to financial records for a legitimate investigation. We're not living in the 1970's anymore. The rules are archaic and overreaching and allow for total financial surveillance without a warrant. That's just too easy to abuse if you have access to these systems.

The first thing I would do if I was an evil person is put plants in government who have access these systems. The power they wield is enormous.

A sales tax is always regressive, no matter how you tier it. Poor people spend 100% of their income/net worth monthly. The ultra wealth spend something like 0.00000000000001%.

That's why we should have a progressive VAT. Food, household items, and basic durable goods would have low-to-no tax. A luxury mansion or supercar would be taxed at the highest bracket. The ultra wealthy own transnational corporations that don't pay tax, and the ultra wealthy aren't paying tax when they sell shares, unless they are a public officer of said corporations anyway. They have family and multi-family offices that handle all of this.

We've got to be more pragmatic about taxation, adhere to the KISS principle.

lol, this inspired me to try to opt-out of LN and I got this beautiful and intimidating warning.

https://consumer.risk.lexisnexis.com/img/State_Use_of_Indivi...

That's a nice business you got there. Shame if something were to happen to it...

You can freeze or opt-out to protect your privacy.

https://consumer.risk.lexisnexis.com/freeze

https://optout.lexisnexis.com/

And they have the cheek to ask you your SSN on your way out. Nice!

Thanks! I filled it out and it said "Your request to have information suppressed from publicly facing public records products has been received and is in process."

So that sounds like a big-F-me. "public facing"? So private is still OK? Bah! I don't know what I'm doing. :)

It is infuriating how many websites require you to give out your phone number in order to sign up or log in these days.

I would like to see a better alternative way to discourage both bot-accounts and, to a lesser extent, human-farmed accounts.

Well, we do, and it’s Device Attestation, but that’s just as bad, if not worse, honestly - at least with a phone-number we can use our own hardware.

Scanning your eyeballs?

From a user standpoint, I'd take privacy over not actually secure "security" practice any day.

There is no better unique identifier around. perfect for mapping this website's data to Every Advertisers Data Ever.

The best solution I have to fixing this is somewhat complicated but worth it.

First get a prepaid phone number and the card for it using some backup phone you have.

Then port that number to Google voice or some voip text service.

For some reason, when you sign up with google voice or a voip service using their number allocation tool, services know that it's a voip number.

But when you port it, they never seem to find out. I think because the profile tag for the number on the exchange side doesn't change. Someone who knows how phone infrastructure works could probably explain how the backend works.

This is how I get around 2fa using Google voice if the service doesn't want me using a voip line.

I might try this. There's no way I'm giving linkedin my phone number.

Demanding a phone number will not help stop the fraud.

HR execs advertising for nonexistent positions have drawers full of burner phones.

I wish fraudulent job advertisements were prosecuted as felonies. The value is typically in the hundreds of thousands of dollars, but there are no prosecutions.

What is the motivation for HR execs to flood the site with nonexistent positions, and does LinkedIn do anything to stop abuse like that?

Yeah, I'm at a loss for the value of that exercise. That being said I'm sure there's some super domain specific and esoteric reasoning.

Common reasons for posting bogus listings include posting very specific requirements in order to “look for cadidates” other than a very specific person, or to claim there are no local candidates in order to hire cheaper H1-B visas. Another common reason for job postings is to make it look like you’re hiring to signal to people in the organization with certain KPI. Also, some people in the hiring process like to attempt to keep pipelines full of “good” candidates for when they might hire in the future.

Cost used to be super high to advertise jobs, so you didn’t bother when you had no openings. Now, ads are relatively cheap, so more more goofy behavior to waste people’s time.

I think there’s a pattern to increase follower count when people apply for jobs. There’s a check box automatically checked asking to follow, that means when you apply most likely you will follow the company.

Looks like big tech, chasing those +25% YoY, is progressing from data theft to data extortion: "hey, you've got a nice decade old profile with us, with lots of valuable connections, it would be sad to have it gone! you have 24 hours to give us more data, otherwise we can't guarantee safety of your profile. have a wonderful day!"

I've been receiving sales calls lately from companies offering services in my industry. Very annoying ones as well, the kind where they will call multiple times even if I tell them I am not interested. The only source I can think of that they got my number from is LinkedIn. This prompted me to check if I have it publicly available but turns out I didn't. Being unable to confirm the source from the sales people themselves unfortunately means I cannot take any action to protect my data privacy. Therefore I would advice against giving your personal phone number to LinkedIn.

They're selling your Microsoft Teams number (which they only could have acquired from Microsoft), so I have no doubt.

Linked in used to get me cold calls by using my phone verification input. So they can fuck right off.

Have 2 numbers. One for the government and one for yourself.

Anything in the stock market is government.

Absolutely agree, why are we using SMS as a de-facto 2FA method. So many good options these days like TOTP and passkeys

Because it is not just 2FA, it is human verification.

I would prefer to give up my ID (with mailing address censored, of course) because at least then they cannot use it to contact me.

So would I. An identify/human verification API provided by USPS would be awesome.

It takes 3-5 business days for a letter to get from one desk to mine, that won't work when you want to sign-up for your next impulsive Reddit link click-through.

There is id.me though (a non-governmental company, but effectively endorsed by the US federal gov), but because I highly value pseudonymity I don't want to use my on real, government-linked, identity for frivolous things - and I'm not aware of anyone like id.me nor any other identity-providers offering a "human-attestation-only" service that wouldn't share any actual PII like my real-name.

It's a shame that web-of-trust schemes never took-off (and I can't see how they could, honestly), I gather some schemes had a mode where a group of known people (in good standing) could collectively vouch for an anonymous person/node, but that system could be easily gamed too. Is this an intractible problem?

The identify / human verification API can be instantaneous, like pretty much all others (after you have verified your identity to the USPS and received a mechanism to verify yourself).

And it also does not have to reveal identity, just whether or not you exist in USPS’s database as a real person.

> I'm not aware of anyone like id.me nor any other identity-providers offering a "human-attestation-only" service that wouldn't share any actual PII like my real-name.

Because if anyone ever offered such a service, suddenly people would no longer be incentivized not to share their account with other people. Right now, the threat of PII exposure is what keeps people accountable and selling less of their accounts to the highest bidder.

Update: no one will likely see this, but I'm the OP and workaround turned out to be simple and not involve burner phones.

I deleted my linkedin cookies, waited a few days, changed my IP address, and was able to log in without handing over my phone number. They lock this nasty screen in using cookies or possibly your IP address. I'm guessing it's to harass VPN users.

I have come to believe (after grilling spam callers on how they got my work Teams number) that Microsoft is selling corporate Microsoft Teams phone numbers via LinkedIn.

I see a whole lot of LinkedIn profiles who have identified/verified themselves with a "Government ID." Imagine that.

I have an old phone with a pre-paid SIM for such ridiculous moves, it's in the drawer and only turned on when required.

Come on, give to msft (linkedin) your entire professional networks, they need this for their prospect... be nice to them...

Am going to provide the opposite take - you're receiving several spam calls per day now. Presumably you have a solution in place where you aren't being bothered by them. So LinkedIn wants to add more spams calls to the set you're already ignoring? Who cares?

A lot of apps require phone numbers, especially the ones that like to vacuum up your personal data such as dating apps.

Me asking HN: Would it make sense to file a complaint to any specific organization like the FCC/FTC/BBB?

I haven't been asked for this bullshit but I probably won't either. Or take a burner or something.

This is also the reason I stopped using dating apps. Every single one wants my phone number.

Tell HN:

Remind me plz why do we need phone numbers?

this is interesting to me, I've not had them ask for my phone number yet... unless I already gave it to them and I don't recall...

similarly, Are you hiring prompt is quite annoying.

Just use a Google voice number?

meh just get a google voice number. need one for all sorts of services.

GV numbers commonly don’t work. Somehow they are identified as a sort of virtual (VIOP) number.

while true in some cases, I've been pleasantly surprised at how often GV/etc are accepted.

another alternative (also minutes) is to use eSim, e.g. Google Fi - minutes to setup and many late model phones support multiple esims.

Reply on news.ycombinator.com