Hacker News Reader

Facebook also asks for permission to import your email contacts from other providers. For GMX, Skype, mail.ru and "other email service", you need to provide a password. It really depends on whether the target site implemented OAuth, OpenID or etc.

How does Linkedin store the email password? Plaintext since they can't send hashes across?

They hopefully don't store it. If they do, hopefully it would be in a reversible hash.

But the answer to your question is "we have no idea."

LinkedIn showed my email address on their web page, and provided a box under it to type my email password.

Maybe they wouldn't have actually stored my password locally, but there's no way for a user to know that for sure.

Ah, I use GMail, which allows that the type of functionality I mentioned. I didn't see that it behaves differently with other providers.

So they do use Google's API to do this, and not a direct password authentication.

Then what's the problem? That is certainly not phishing...

Not everyone uses Gmail. The fallback is to ask for your email password. Really.