Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Glassdoor not so anonymous

webworm.co

Post reply on HN
Print view View original

31–40 of 507 posts

Re: Glassdoor not so anonymous

#31

Post by SkittyDog »

kelnos wrote: post #23
gruez wrote: post #9

>Glassdoor’s FAQ goes into a little more detail about how they will defend user anonymity. They know this is vital their success: If glassdoor cares so much about anonymity, why didn't they engineer their site in such a way that prevents them from being able to deanonymize reviewers? For instance, not keeping identifying user details after they have been verified?

Probably because doing so is hard. You not only have to verify that a review is coming from an actual current or former employee, but then you have to ensure that the same employee cannot write multiple reviews. If you discard all links between a reviewer account and a review, how do you do that? I imagine there's some sort of zero-knowledge magic cryptographic thing you can do (or maybe something simpler, like a...…

> You not only have to verify that a review is coming from an actual current or former employee, but then you have to ensure that the same employee cannot write multiple reviews. If you discard all links between a reviewer account and a review, how do you do that?

Just FYI, Glassdoor does NOT try to prove that reviewers are current or former employees. Anybody can post claiming to be an employee, and Glassdoor will accept their review.

Re: Glassdoor not so anonymous

#32

Post by lostcolony »

kelnos wrote: post #23
gruez wrote: post #9

>Glassdoor’s FAQ goes into a little more detail about how they will defend user anonymity. They know this is vital their success: If glassdoor cares so much about anonymity, why didn't they engineer their site in such a way that prevents them from being able to deanonymize reviewers? For instance, not keeping identifying user details after they have been verified?

Probably because doing so is hard. You not only have to verify that a review is coming from an actual current or former employee, but then you have to ensure that the same employee cannot write multiple reviews. If you discard all links between a reviewer account and a review, how do you do that? I imagine there's some sort of zero-knowledge magic cryptographic thing you can do (or maybe something simpler, like a...…

"The same employee cannot write multiple reviews" - they can create new accounts.

But even if you want one account to not write multiple reviews, you can flag that an account wrote a review for a company without tying it to -what- review.

You can even disassociate that; hash usernames with the company and store that to track who has written a review. Then, you can only confirm that a given user account has written a review for a company, but not which review is theirs, and given a company you can't determine what users wrote those reviews without attempting to hash every username against it.

And that's if you -absolutely- have to try and prevent an account writing more than one review (again, noting that you can just create another account).

Re: Glassdoor not so anonymous

#33

Post by NamTaf »

Does Glassdoor even have a legal presence in NZ? If so, why? If not, why are they even bothered by this?

Could they theoretically not just play hardball, ignore the NZ courts entirely on the basis that they have no legal entity within NZ, and see what happens? Are there cross-border legal agreements that give the NZ courts any teeth? Or would it come down to NZ having to mandate that all ISPs block Glassdoor within NZ?

Re: Glassdoor not so anonymous

#34

Post by gene91 »

NamTaf wrote: post #33

Does Glassdoor even have a legal presence in NZ? If so, why? If not, why are they even bothered by this? Could they theoretically not just play hardball, ignore the NZ courts entirely on the basis that they have no legal entity within NZ, and see what happens? Are there cross-border legal agreements that give the NZ courts any teeth? Or would it come down to NZ having to mandate that all ISPs block Glassdoor within N…

This order is from a California court.

Re: Glassdoor not so anonymous

#35

Post by chaps »

Once had a contract where my client wanted me to do "security work", which was initially meant to be for pentesting their clients, but it turned into me building their wifi auth system.

At some point in the gig, one of their clients went to them asking them if it was possible to de-anonymize someone glassdoor review since someone still-employed worked with them. They then went to me to see if I could do it for them. They didn't clarifywhy they went to me, but I legitimately think they wanted me to "hack" glassdoor. I told them in no uncertain terms that I wouldn't do it and they backed off.

A bit later they fired the employee.. I didn't hear how they found the person, but it really spoke to the lengths that some organizations will go to burn down the lives of those who speak up.

Use this google search to find more companies that do it:

  "Glassdoor Alert: Employer Legal Action" site:glassdoor.com

  https://www.glassdoor.ca/Reviews/Employee-Review-Media-Consulta-RVW23674692.htm
  https://www.glassdoor.ca/Reviews/Canidae-Reviews-E845482.htm
  https://www.glassdoor.com/Overview/Working-at-Echelon-Environmental-EI_IE1069898.11,32.htm
  https://www.glassdoor.ca/Reviews/Canidae-Reviews-E845482.htm
  https://fr.glassdoor.ca/Pr%C3%A9sentation/Travailler-chez-Echelon-Environmental-EI_IE1069898.16,37.htm
  https://www.glassdoor.ca/Reviews/Employee-Review-BW-Legal-RVW58014087.htm

Re: Glassdoor not so anonymous

#36

Post by dylan604 »

Would these companies have a case if an employee left refusing to sign the paper work agreeing to not talk shit? One company I left tied their severance package to a signature on that kind of agreement.

Re: Glassdoor not so anonymous

#38

Post by gruez »

kelnos wrote: post #23
gruez wrote: post #9

>Glassdoor’s FAQ goes into a little more detail about how they will defend user anonymity. They know this is vital their success: If glassdoor cares so much about anonymity, why didn't they engineer their site in such a way that prevents them from being able to deanonymize reviewers? For instance, not keeping identifying user details after they have been verified?

Probably because doing so is hard. You not only have to verify that a review is coming from an actual current or former employee, but then you have to ensure that the same employee cannot write multiple reviews. If you discard all links between a reviewer account and a review, how do you do that? I imagine there's some sort of zero-knowledge magic cryptographic thing you can do (or maybe something simpler, like a...…

> Probably because doing so is hard. You not only have to verify that a review is coming from an actual current or former employee, but then you have to ensure that the same employee cannot write multiple reviews. If you discard all links between a reviewer account and a review, how do you do that?

It doesn't seem hard to me.

1. when making a review, send a verification link to the email on file

2. after the email is verified, post the review, but delink the email from the actual review.

3. to prevent the same email from being used to spam reviews, add a coarse grained timestamp (eg. rounded to the nearest month, depending on how much activity the company gets) of when it was last used.

4. if you want users to be able to update reviews afterwards, display a secret key to them and keep a hashed version on file. The user must present the secret key if he wants to update his review

Re: Glassdoor not so anonymous

#39

Post by Mandatum »

chaps wrote: post #35

Once had a contract where my client wanted me to do "security work", which was initially meant to be for pentesting their clients, but it turned into me building their wifi auth system. At some point in the gig, one of their clients went to them asking them if it was possible to de-anonymize someone glassdoor review since someone still-employed worked with them. They then went to me to see if I could do it for them.…

DNS records of your VPN or corporate work station would be pretty easy. You can line then up with when the review was posted. Then investigate their workstation more "thoroughly".

Re: Glassdoor not so anonymous

#40

Post by el_benhameen »

croes wrote: post #15

> Zuru hasn't simply alleged that it suffered a loss; Zuru’s cofounders declared, under penalty of perjury, that because of the negative reviews, Zuru had to spend more money to recruit job candidates for a particular position. ” Does Zuru have proof it's because of negative reviews and not other causes?

I mean, they’re gonna have to spend a hell of a lot more on recruiting now that the Streisand effect has kicked in.
Post reply on HN