Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn Customers Allege Company Hacked E-Mail Addresses

bloomberg.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#21

Post by bowlofpetunias »

Here's what may have happened: when you go to LinkedIn, you regularly get shown a box (inline) inviting you to do something, like endorse people's skills.

One of those boxes invites you to "grow your network". It's not all that explicit as a call-to-action, as in the text may just be a slogan. The main focal point of that box is a login & password form, which looks exactly like the regular login form that users get when they want to do something that requires explicit re-authentication.

In other words: it's common to have to enter your login/password on LinkedIn, this looks a bit like one of those cases, so users will blindly start typing. If they use the same email/password combo for their email account as for their LinkedIn account, then they've just given LinkedIn access to that email-account.

The box itself is quite deliberately misleading. Unlike the regular invitations to load your addressbook, there are no Google or Yahoo logo's, and no explicit descriptions.

I don't know whether there is a more explicit request for permission at the next step before it starts sucking in conctacts, I don't dare entering a valid password.

If there is a next step that requires explicit confirmation, than this "trap" (which it quite obviously is) is merely annoying and a bit scummy.

If there isn't, I think they have a good case, because this is would basically be phishing in reverse.

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#22

Post by logicallee »

city41 wrote: post #12
kevingadd wrote: post #4

Earlier quoted context omitted.

My guess is they used the same password for their email and LinkedIn account, so LinkedIn had the credentials for both and was able to harvest contacts. That, or during the sign up process they plugged in their email credentials without realizing LinkedIn would abuse them in this way. Scummy in either case, even if it's technically legal.

I had the latter happen to me and so have several other people here on HN. LinkedIn ended up sending an invite to everyone I had ever emailed. It was catastrophically embarrassing and caused a lot of grief.

Not to detract from the main point of this thread (which I agree with) but do you mind sharing why you write "catastrophically" embarrassing? And caused 'a lot of grief'?

I'd never think twice about getting a linkedin invite email from anyone who for any reason has ever emailed me (ever). It's obviously automatic... I really can't think of an exception...

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#23

Post by fourstar »

dror wrote: post #18

Here's how they do it. Various times Linkedin provides me with a form to "import" my contacts from my gmail account. This dialog looks very similar to the login form to the site. If you use the same password for both sites (I don't), you might be thinking that you're logging in, when in fact you're bringing in everyone in your address book. Not sure, if they then automatically spam everyone on your list or not. Linke…

Alternative because the company is trying to make money? Sounds good until the (so-called) other company does the same exact thing.

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#24

Post by yorak »

dror wrote: post #18

Here's how they do it. Various times Linkedin provides me with a form to "import" my contacts from my gmail account. This dialog looks very similar to the login form to the site. If you use the same password for both sites (I don't), you might be thinking that you're logging in, when in fact you're bringing in everyone in your address book. Not sure, if they then automatically spam everyone on your list or not. Linke…

Also, I recently found out that Android app from Linkedin extracts your gmail contacts. From what I could gather, you cannot opt-out. I was quite annoyed by this. I also see this a more probable explanation to contact harvesting than hacking to email accounts.

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#25

Post by dobbsbob »

Yet another scummy social media spying site I'm happy to have never signed up/used for anything. The vast majority of jobs I've found were idling in the local hack space IRC room with ~300 developers and engineers who dump openings, joint ventures and paid projects there first before the usual channels.

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#26

Post by obiterdictum »

bowlofpetunias wrote: post #21

Here's what may have happened: when you go to LinkedIn, you regularly get shown a box (inline) inviting you to do something, like endorse people's skills. One of those boxes invites you to "grow your network". It's not all that explicit as a call-to-action, as in the text may just be a slogan. The main focal point of that box is a login & password form, which looks exactly like the regular login form that users get w…

I think it's more likely that LinkedIn mobile app grabs your phone contacts, if you happen to give it permissions to do so.

I've noticed that the "People you may know" section started to contain faceless placeholder entries with emails from my address book (though, I'm not sure if/when I've given the iOS app the address book access).

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#27

Post by kibibu »

logicallee wrote: post #22
city41 wrote: post #12

Earlier quoted context omitted.

I had the latter happen to me and so have several other people here on HN. LinkedIn ended up sending an invite to everyone I had ever emailed. It was catastrophically embarrassing and caused a lot of grief.

Not to detract from the main point of this thread (which I agree with) but do you mind sharing why you write "catastrophically" embarrassing? And caused 'a lot of grief'? I'd never think twice about getting a linkedin invite email from anyone who for any reason has ever emailed me (ever). It's obviously automatic... I really can't think of an exception...

> Your Ex has sent you an invitation to LinkedIn. Would you like to endorse their skills?

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#28

Post by christoph »

obiterdictum wrote: post #26
bowlofpetunias wrote: post #21

Here's what may have happened: when you go to LinkedIn, you regularly get shown a box (inline) inviting you to do something, like endorse people's skills. One of those boxes invites you to "grow your network". It's not all that explicit as a call-to-action, as in the text may just be a slogan. The main focal point of that box is a login & password form, which looks exactly like the regular login form that users get w…

I think it's more likely that LinkedIn mobile app grabs your phone contacts, if you happen to give it permissions to do so. I've noticed that the "People you may know" section started to contain faceless placeholder entries with emails from my address book (though, I'm not sure if/when I've given the iOS app the address book access).

I noticed that recently as well. Some of them actually say "X shared contacts" below them as well. I know for a fact some of these people are not on LinkedIn, so it's essentially building up shadow profiles and trying to get users to "invite" them to the website for them.

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#29

Post by anodari »

bowlofpetunias wrote: post #21

Here's what may have happened: when you go to LinkedIn, you regularly get shown a box (inline) inviting you to do something, like endorse people's skills. One of those boxes invites you to "grow your network". It's not all that explicit as a call-to-action, as in the text may just be a slogan. The main focal point of that box is a login & password form, which looks exactly like the regular login form that users get w…

I fell into this trap. Once, when accessing my account, I thought I had forgotten the password, but in truth they were asking for the password to my email and I inadvertently put. It is very common to reuse passwords, I bet they test for reuse and "invade" the e-mail account without permission.

Re: LinkedIn Customers Allege Company Hacked E-Mail Addresses

#30

Post by donohoe »

bowlofpetunias wrote: post #21

Here's what may have happened: when you go to LinkedIn, you regularly get shown a box (inline) inviting you to do something, like endorse people's skills. One of those boxes invites you to "grow your network". It's not all that explicit as a call-to-action, as in the text may just be a slogan. The main focal point of that box is a login & password form, which looks exactly like the regular login form that users get w…

This is exactly what happened to me.

I thought it more of bad UI and lack of attention on my part. Everyone in my address book got an Invite.

LinkedIn need to address this but I think this lawsuit over-states the issue (still need to examine it in full but first impression)

Post reply on HN