16 ms·

Tell HN: AngelList told my employer that I'd updated my profile

958 points by oliversisson 11y ago

I recently updated my AngelList profile and they emailed my employer, pretending to be me, to "confirm" the project I'd added. How can they think this is a good idea?

Animats 11y ago
This might be "false personation" under California law. See California penal code 529.[1] This is slightly different from identity theft. It's a criminal offense. The key elements of this offense are that someone else impersonated you in some way, and they derived some benefit from doing so. Because this is a criminal offense, AngelList's TOS's arbitration clause does not apply. You can file a police report with the SFPD. If several people do that, something might be done about it. [1] http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&group=00001-01000&file=528-539 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&gr...
- nakedrobot2 11y ago
  Unless you have authorized them to do this under the Terms and Conditions of course.....
  - Karunamon 11y ago
    Correct me if I'm wrong, but as I understand it, you cannot contract your way out of criminal law.
    - dchest 11y ago
      In this case, every giving would be stealing. If I gave you something, you didn't steal it from me. Likewise, if I gave you the right to impersonate me in particular circumstances, it's not a criminal offense if you do.
      - 9935c101ab17a66 11y ago
        Except he obviously didn't give them permission to do this.
      - IanCal 11y ago
        The comparison to stealing is frankly ridiculous, as the law doesn't say you can't transfer money. It will explicitly talk about consent. If contracts allowed you to agree to anything then minimum wage laws couldn't work. Which side the impersonation laws fall on will depend on how they're written.
        OJFord 11y ago
        What about boxing, martial arts sparring, fencing, assisted suicide, and voting by proxy? The point here is that you either _can_ contract your way out, or (what I suspect is the case) there re exclusions in the law were relevant. Either way, it suggests this might not be illegal if covered by something blindly tick-boxed.
        ams6110 11y ago
        You seem to be opertating under the delusion that the law is logically consistent. It isn't. There are some things you can allow by contract/permission and some things you cannot, and circumstance matters.
        OJFord 11y ago
        No, I'm not. I'm responding to the blanket statement to the contrary. I fully expect that it's a case of cased exclusions as I've said in another comment.
        IanCal 11y ago
        You cannot, uniformly, give people the ability to do anything to you. That's the point I'm making. > What about boxing, martial arts sparring, fencing Consent only works up to a point. I cannot consent to you stabbing me or beating me into a bloody pulp. https://en.wikipedia.org/wiki/Consent_(criminal_law) https://en.wikipedia.org/wiki/Consent_(criminal_law) https://en.wikipedia.org/wiki/R_v_Brown https://en.wikipedia.org/wiki/R_v_Brown It's worth noting that bare knuckle boxing is illegal in the UK, and you can't just sign a document to do it. > assisted suicide Assisted suicide is illegal in the UK. It does not matter if the patient signs a contract to say it's OK, it's still illegal.
      - iopq 11y ago
        If your Windows EULA said "Microsoft can take any of your property" they still can't steal from you just because you agreed to it.
        donatj 11y ago
        It would no longer be stealing because you agreed to it. This is why repossession is legal.
        Karunamon 11y ago
        Such a contract would likely be ruled unconscionable (invalid) if anyone challenged it. I don't think there's a judge in the country that could be convinced that any piece of code is good enough consideration for random tangible property.
        dchest 11y ago
        Yes, you can agree to transfer all of your property to Microsoft in exchange for a Windows license. But including this in EULA will not work though, as there are limits on what you can agree to without signature or notary.
      - notalaser 11y ago
        It depends on where you are in the world, but in most places in the civilized world, criminal law does not work that way. If something is illegal, we cannot sign a contract that says it's ok between you and me, and magically make it legal. E.g. if I kill someone, the state will prosecute me for murder, regardless of whether or not that guy and I signed a contract that said it was fine. If impersonating someone is a criminal offense in a particular jurisdiction, then -- assuming that jurisdiction has a sane criminal code -- there is no way to make it legal through a contract. Edit: there are good reasons why this is in place, the most relevant of which is that it provides protection against abuses. Otherwise, we'd have things like employers that would still be at liberty to use lashing and beating as disciplinary action against employees who don't really have a choice about signing a contract or not.
        vidarh 11y ago
        The point is that the specific criteria defining what is criminal can include whether or not there is consent. A contract can establish consent. E.g. if I go into your house without permission and take stuff, then it is theft. If I have a contract saying that I have permission to go into your house and take stuff, then it is not. I have not contracted my away from something illegal. The contract has established consent, which meant the criteria that otherwise would have made my actions criminal are not fulfilled. > If impersonating someone is a criminal offense in a particular jurisdiction, then -- assuming that jurisdiction has a sane criminal code -- there is no way to make it legal through a contract. That depends whether or not the criteria that needs to be met for it to be a crime requires lack of consent. If it requires lack of consent, then a contract can document that the consent has been given. All jurisdictions I'm aware of (not a lawyer) have the concept of agents that may act on your behalf with consent. To what extent such agents can act using your name (with consent) vs. using their own name but on your behalf, varies greatly. E.g. some places your agents (say a PA) will sign letters "[agents name] for and on behalf of [your name]" or similar, while other places they will use a signature stamp with your signature, or do "p.p. [their signature] [your printed name]" (the p.p. stands for "per procurationem"). Many other variations are in use, and how obvious signs there are that a document was not personally signed by the person the letter is from varies greatly.
  - JupiterMoon 11y ago
    No! If an offence is criminal it can't be magically made OK by a contract. I am not a lawyer. This is not legal advice.
    - wojt_eu 11y ago
      Wouldn't it make it impossible under California law to have an agent that impersonate me? Have them tweet from my account, reply to emails in my name etc.
      - robzyb 11y ago
        It is, of course, perfectly legal to do that with permission. The problem here is that it was done without permission. The OP is claiming that the impersonation without permission is a crime, and that it is impossible to waive the crime-ness of it through a contract.
        OJFord 11y ago
        Parent is replying to a comment stating: > If an offence is criminal it can't be magically made OK > by a contract. I think this must be mistaken (IANAL either). Boxing, assisted suicide, and voting by proxy come to mind.
        deleted 11y ago
        [deleted]
        svckr 11y ago
        The quote sounds right to me. If the act of impersonating someone is indeed a criminal offense, you can not smooth that over with a contract. Voting by proxy is not impersonation, you give someone the right to act (vote in this case) in your name. Thus, no criminal offense. The other cases: Assisted suicide is a criminal offense in many countries. For example (similar, but not the same), there has been some legal struggle over "Sterbehilfe" here in Germany which garnered quite some media attention. Boxing – I might be mistaken, but perhaps "beating someone" is not a criminal offense as long as it is not against the other persons will? All these things hinge on very subtle differences in wording. For example the terms might say: "AngelList reserves the right to send mails on your behalf" which grants them the right to send mails to third parties in your name, but I'd be surprised if law would allow them to state "AngelList reserves the right to claim your identity".
  - morninj 11y ago
    Not sure why you're being downvoted so much. The statute clearly imposes penalties for impersonation "without consent," so consent is a defense here.
  - btbuildem 11y ago
    If I authorize you to kill someone, you're still on hook for committing the murder.
  - jjallen 11y ago
    A contract that requires a party to do something illegal is inherently unenforceable. https://en.wikipedia.org/wiki/Illegal_agreement https://en.wikipedia.org/wiki/Illegal_agreement To illustrate why this is the case, we can look at an extreme example: a contract to have someone murdered. Would a court enforce that? Of course not.
- johnchristopher 11y ago
  > he key elements of this offense are that someone else impersonated you in some way, and they derived some benefit from doing so. Is Facebook usage of their user's profile pic for advertisement purpose a false impersonation too ? (I don't know if it's still in practice or if it was ever implemented)
  - Pyxl101 11y ago
    If Facebook used their photos to claim to be them, then maybe it would be impersonation. Using their photos in advertising is not claiming to be them.
  - davismwfl 11y ago
    If Facebook uses your picture for advertisement purposes it generally falls under "using your likeness" and is covered under their terms of service about advertising. They are not impersonating you because they are not claiming to be you, they are instead using your likeness to promote either themselves or their clients. This is similar to agreements you might sign with an employer, photographer or other third party so they can use your photo in an ad or as part of marketing material. And from what I understand (IANAL) the requirements vary from state to state in the US and obviously outside the US. Although there are blanket terms that cover it from what I have seen. BTW -- Anytime you have professional photos done, this is something you should always look for and make sure you are comfortable with the terms they lay out in their "Agreement". Many have boiler plate in their agreements that states they can use your likeness without paying you for it and without prior written consent. I just went through this when looking for a professional photographer when we had some family photos done as I don't want anyone using images of my family or kids.
- temphn 11y ago
  Are you seriously advocating reporting someone to the police based on a one sentence secondhand account from a single dumb Hacker News front page post? You have zero context for what happened here (could well be user error!) and yet you are encouraging an angry mob to go and SWAT someone. If you want to play that game, I'm sure that filing false police reports -- or encouraging others to do so -- is a flagrant violation of California's penal code. It is you, John Nagle, who should be thrown in jail if this turns out to be a nothingburger (as is likely the case!). Or we could all just calm down and report it as a bug. Jesus Christ.
  - deleted 11y ago
    [deleted]
  - jcsnv 11y ago
    Why is this getting down voted?
    - hnal943 11y ago
      Because Animats is suggesting that the OP file a police report, not randoms from the internet. He then says if enough people (i.e. customers of AngelList) complain, they may be heard. There's nothing untoward about referring someone who believes they've been victimized to the police.
    - dang 11y ago
      Probably because it escalated by getting personal. Wrong direction to go.
afoxtron 11y ago
You're giving me cold sweats now thinking that angel list emailed my company
NetOpWibby 11y ago
That's fucked up.
eaxitect 11y ago
AFAIK, AL asks confirmation only if an entry is related to -that- company/person/etc. You might add -your- project (i assume not related to your employer) some how as if it is related to your employer.
tamersalama 11y ago
What kind of TOS would allow that 3rd party involvement? If none - then it's grounds for law suit.
- etjossem 11y ago
  You can ask them yourself: team@angel.co Let us know what you find out?
joshfraser 11y ago
They do the same impersonation trick to confirm investors and co-founders as well. It gives them cleaner data & is great for growth.
- chris_wot 11y ago
  That's extraordinarily unethical. I doubt I'd need to use them, but if I ever have the opportunity, I won't.
- jedmeyers 11y ago
  Some call this "impersonation trick" an identity theft.
- deleted 11y ago
  [deleted]
- logicallee 11y ago
  do you see any difference between these two statements: "John Fraser has just added you as an employer, can you confirm? -Linkedin" "I'd like to add you as an employer on linkedin, can you confirm! -John Fraser"
  - joshfraser 11y ago
    Of course I do. I wasn't meaning to condone their behavior, only to share that it's something they do extensively and give some context on their potential motivation for it. They send these emails from team@angel.co but the name and content definitely gives the impression it came from someone else.
- RIMR 11y ago
  >They do the same impersonation trick to confirm investors and co-founders as well. It gives them cleaner data & is great for growth. I just started pointing to groups at bars when the bartender asks me if I want to start a tab. It's done wonders for my personal finances! /s
deleted 11y ago
[deleted]
MichaelBurge 11y ago
Depending on the details, it could be a minor felony for fraud.
- alanh 11y ago
  Clarify? Who would have committed a felony, in what circumstance?
  - deleted 11y ago
    [deleted]
  - elevenfist 11y ago
    Identity theft/impersonation, the company, ceo
  - fiatmoney 11y ago
    See this for a related case. https://en.wikipedia.org/wiki/Hewlett-Packard_spying_scandal https://en.wikipedia.org/wiki/Hewlett-Packard_spying_scandal
  - MichaelBurge 11y ago
    Let's take a more obvious case: Suppose you're running a Bitcoin exchange, and people are dumb enough to sign up for an account on it and give you their banking details. You have a copy of their id, their checking account number, their social security number, etc. The person puts an order for $100,000 in Dogecoin on the exchange, and you'd like more information before you process it in case its fraudulent. So you call up their bank and pretend to be them, using all the information they've given you to bypass their security questions. Then you ask the representative to have a year's worth of statements sent to you via email. Bank of America will mail them to you for free. This seems like it should be fraud, even though they didn't steal any money. There's a couple differences: * They used a email to trick the target rather than the telephone. Telephone has a history of regulations associated with it. * They're tricking your employer rather than your bank. Regulations surrounding banks are tighter, so this might only be fraud if it deals with a bank. * They may have used fewer documents when authenticating themselves. For example, they probably don't have your government id, so they likely only sent publicly available information when identifying themselves. * They may have used an automated system to send the email rather than having someone manually craft it. I don't think this matters, except to make it a little harder to establish intent. * They're not using this to gain new information, but rather to validate information already given. So no theft of company secrets, unless they ask for more details in the email. * AngelList is based in California, so depending on where OP or his previous employer were, it might not cross state lines and so could be immune to federal law. * It's unclear to me what exactly the contents of these emails are. Are they basically like LinkedIn spam, clearly identifiable as such? Or is someone crafting emails by hand and pretending to have a conversation with the manager to get details about the project? Imagine saying you worked at Valve on a secret game, so they called up your manager pretending to be you and ended up getting the release date for Half Life 3. That's fraud. * It's unclear how they pretended to be the OP. Did they just forge the from: header on the email? Did they log into his gmail account and send an email authenticated from Google's servers? The latter would escalate the crime. To answer your question, I was mainly thinking identity theft and that they'd fine the AngelList LLC. Exactly which of these differences matters I'm unsure about. I don't think anyone would seriously care too much about it even if it were illegal though. The worst that would happen would be them being told to stop if enough people complained. It'd be worse if they were doing it to investors.
DonHopkins 11y ago
I had big problems with the "Angel List" web site, because it was extremely flakey and appeared to be a typical piece of garbage that some dime-a-dozen huckster with very little experience had just thrown together after watching the Ruby on Rails Make Your Own Trendy Dot Com Crud Web Site in 10 Minutes screencast. Major features were totally broken. Many things about the design were devoid of thought and just haphazardly thrown together, as if I was using a mock-up that was nowhere near ready for prime time. Obviously whoever implemented it and runs it had no intention of using it themselves, and puts no time into maintaining the site or supporting the "customers" (who are actually the product). The only "design" apparent was in the most shallow surface details and of the least meaningful kind. Their support is absolutely non-existent. I heard nothing back from them whatsoever, after sending several emails. Lights are on but nobody's home. It has the feel of yet another ghost town scam web site run by a sociopathic all-talk-no-chops frat boy "idea man" who long ago went on to something else after pissing off and driving away all their developers who worked for free on the promise of equity, and is now letting it run on autopilot. Too many self described "Serial Hacktrepeneurs", not enough programmers. Because I encountered so many problems that I have no control over but should, it's an embarrassment to be listed with so many glitches that I am unable to work around, which cause investors to see my profile in such a haphazard state. Their carelessness makes it look like I'm the one who's careless. I hope Silicon Valley does an episode parodying AngelList, or at least somebody writes some fanfic about it. [1] [1] https://www.fanfiction.net/tv/Silicon-Valley/ https://www.fanfiction.net/tv/Silicon-Valley/
- Negative1 11y ago
  Insulting, bordering on abusive hyperbole. You seem to have a major chip on your shoulder. Did Angel List eat your baby or something? Also, if you hate them so much but seem to have some sort of reliance on their service, why not take yourself off the site and make a competing product?
  - DonHopkins 11y ago
    I don't make a competing product because I don't have 10 minutes to watch a Ruby on Rails screencast.
echelon 11y ago
Wow, I'm never going to use AngelList if this turns out to be true. What an unbelievable betrayal of trust.
godzillabrennus 11y ago
Yeah Angel List does this whenever you list an incubator as well.
SirNoobsAlot 11y ago
Want to know something funnier? I am a non-HR and non-recruiter employee at my company and I can see recruiting tab (angel.co/candidates). On a related note, I try to avoid applying to jobs through AngelList. I'll usually go directly to the company website itself and apply.
- etjossem 11y ago
  I second this and it's arguably scarier than OP. I've seen this tab before - it shows everyone in our industry who has ever expressed interest in our company through AngelList. It lets me CRUD job listings and contact/reject any candidate. Presumably I got this incredibly far-reaching access simply because I was confirmed as one of 50 employees with an AngelList account. As far as I know, there was no intervention or approval from our recruiting lead. From applicant perspective: as soon as you apply for a job through AngelList, everyone who ever works at that company (now and future) can trivially find you and decide your fate. This is really uncomfortable from the company's perspective too. I could just as easily have been an employee who isn't expected to recruit / shouldn't be making first contact with candidates / shouldn't be able to touch job listings.
- arikrak 11y ago
  I don't even think you need to be confirmed at the company. I think once you put yourself as an employee of any given company, you can see their applicants, but they may have fixed this issue. Though overall AngelList seem like a site that's focused on helping startups (and investors), and unlike most sites, they don't even charge for their job listings.
beachstartup 11y ago
this doesn't even scratch the surface of what shady people in the funding industry do to put entrepreneurs or wannabe entrepreneurs in terrible positions.
afshin 11y ago
I quit using AngelList when a recruiter confirmed that he'd seen that my profile was actively browsing the site. The old adage about who is the customer and who is the product rang so true with AngelList. I hadn't realized that it was even possible to build a scammier version of LinkedIn until that point.
skrebe 11y ago
account deleted
sergiotapia 11y ago
Thank you for the heads up, I just deleted my account there. How do these companies think for a second that being sleazy like this is OK?
seejay 11y ago
Just deleted the account. Thanks for the tip, OP!
- whiskahs 11y ago
  Same
dwightgunning 11y ago
When you say "pretending to be me" do you mean that they spoofed your email address in the from and/or reply-to fields? [edit: typo]
- dwightgunning 11y ago
  Downvotes? Just looking for some clarification on what actually happened here. It's not exactly clear.
  - jonesb6 11y ago
    People probably read too much into your comment, hence the down votes. Reason would dictate from the very small amount of info provided that AngelList merely made the email out to look like it was from OP. To say they spoofed them email headers would've gotten 3x the number of up-votes.
- solve 11y ago
  Yes, the FROM spoofs your name so that the person will believe it's being sent directly from you in most email clients, and the Reply-to goes directly to your email. These are the email headers: From: YOUR_NAME <team@angel.co> Reply-To: YOUR_NAME <YOUR_EMAIL@gmail.com>
- oliversisson 11y ago
  They used my name in the email from and reply-to fields, and to sign my name. I've replied to my original post with the actual email.
  - dwightgunning 11y ago
    Thanks, that spells it out. Damn, that is fairly messed up. I had a similar experience with F6S sending emails in my name so I know how uncomfortable it feels. This is a shame and hopefully just a one-off error.
sakoht 11y ago
Hah. Good to know how this happens. I thought it was an personal insider convo...
OoTheNigerian 11y ago
HN users confuse me quite a bit. How would they confirm if you are lying or Telling the truth? I believe the only wah would be to confirm from the organization owner. Or else, ANYONE can claim to have done any project. I believe they do the same verification (it's simple verification) for roles in an organization.e.g Adviser, Co founder, Investor etc. And the verification is the other way too. If an employer adds you as an employee, you are to verify it too. I struggle to find what the issue is. Perhaps they should have told you they were going to verify your project? Animats / John, when you invite your friend on a social network and they send a message on your behalf, is that criminal too? Remember, OP(Oliver) took an action by claiming he did a project in an organization. It could have been true or false. Don Hopkins, take a deep breath man. You can pass a message without being mean. Except that's the intention for a reason not stated here. In that case, it's all good.
- gedrap 11y ago
  Think, when people usually update their profile on angellist, linkedin, etc? Usually, when looking for a new job. And normally, you'd rather not share the fact that you're looking for something with your current company as they might start looking for your replacement before you're ready. >>> Perhaps they should have told you they were going to verify your project? That would a huge difference and that's why the frustration - it's not something expected.
  - OoTheNigerian 11y ago
    It's a semi prison if you are not allowed to update your profile at a job you work. Remember, the person in question had to chose they were in the said organization and did a certain project. Anyway, asking Angelist to show any claim will be confirmed is not asking for too much. However, it is not such a scandal as OP makes it out to be.
    - uniclaude 11y ago
      > It's a semi prison if you are not allowed to update your profile at a job you work. It's not disallowed, it's just not good. You might not pay attention when your employees are looking for other jobs, but most business owners do, and react rather negatively to it. > it is not such a scandal as OP makes it out to be OP posted a one-line "Tell HN" comment, you're actually the one calling it a scandal.
reactor 11y ago
account deleted, thanks!
thom 11y ago
They do something similar (though less creepy) when you add a team member to your own org. I've got replies from people to emails sent out with my name, and my address in the reply-to field. They're deliberately crafted to seem personal, with I/you/me/us peppered throughout the body and "Thanks, [your name]" in the sig. Ultimately it's a social network with accounts for orgs and people - it's no surprise that people are getting _some_ notification, but the impersonation is a little discomforting. It would be totally find if they just showed it as a template and said "hey, we're about to send this, okay?"
bachback 11y ago
AngelList lists startups, so why are you registering there if you are employed? That's likely a violation of your contract in the first place, and their ToS, and it's public info anyway. AngelList is for companies, not projects. You do realise this info is meant to be public? AngelList is a public register of startups showing the people behind them. If you don't want that info public, don't register there.
- imazio 11y ago
  There is also a "JOBS" section. If they are not protecting the confidentiality of the potential candidates, well, they are not making any favour to the startups or their business.
uptownfunk 11y ago
If this is true, I'm deleting my account immediately.
halotrope 11y ago
Thank you for sharing the news. I have just deleted my account. In case someone has problems as well finding out how: 1. Click your profile picture on the top right corner 2. Click settings in the dropdown. 3. Click Delete account 4. ? 5. Profit
- Cartwright2 11y ago
  Before deleting your account you should edit out and overwrite as much information as possible. Things like your name, e-mail, and any other fields should be falsified before deleting. You have no way of knowing if their "delete" mechanism just flips a deleted bit or if it actually erases your data. The problem, in this case, is that the company might notify your employer that you're making those changes. Not sure what I'd do in this case. It might be worth creating some dummy accounts to see what actions actually trigger notifications.
  - nathancahill 11y ago
    It flips a delete bit. But here's the bigger problem: your pages return a 404 error page with status code 200, so Google takes a long time to clear them from their cache (real 404s clear semi-instantly).
- dhimes 11y ago
  What are the odds that works?
- Kpourdeilami 11y ago
  I deleted my account but it's still visible
- aprdm 11y ago
  Thanks, just deleted it.
lgomezma 11y ago
Just deleted my account, this is unacceptable.
solve 11y ago
Edit: Oh cool, Hackernews still has this account rank-banned so the comments always stay at the bottom of the page no matter how many upvotes they get. So happy that I'm not the only one who was extremely surprised and upset about Angel List's impersonation tactics. In my experience, 100% of the people who received this impersonation email that angel.co sent, thought it was written by me. If the system wants to send a message on my behalf, it must AT LEAST show me what would be sent with my signature on it, and allow me to confirm or cancel any email that's signed with my full name before it's sent. Angel List is sending out emails with your signature and other impersonation tricks, totally behind your back. I've had people impersonate emails from me in the past as well. Even if the emails aren't offensive, just the idea that someone else now thinks they have my permission to send whatever they want to, while impersonating me behind my back makes me feel extremely uneasy. Here's the impersonation email they send to cofounders when they're added to a profile. As you can see, signing the email with the user's full name, as if the user had written the letter, is a clear impersonation that the user never consents to. FROM: <MY_FULL_NAME> <team@angel.co> Hi <RECEIVER_NAME>, I'm building an AngelList profile for <PROJECT_NAME> and need your help. Can you do me a favor and confirm that you're a founder by clicking here: https://angel.co/l/54223434234234583948593475 This is important to us; confirming that you're a founder will help us build our profile. Thanks, <MY_FULL_NAME> P.S. If you would like to visit our profile first, go here: https://angel.co/<PROJECT_NAME> Email headers used: From: <MY_FULL_NAME> <team@angel.co> Reply-To: <MY_FULL_NAME> <MY_EMAIL@gmail.com>
- enzanki_ars 11y ago
  In the past couple of weeks I began signing my emails with PGP. Those who are technically inclined can ensure that I sent it, and those not would be a little more suspicious of an automated looking email without a random string of characters at the end.
ahoka 11y ago
Thanks, deleted myself.
danenania 11y ago
If you're looking for a place to list your projects that doesn't do spammy/scammy stuff like this, check out MakerSlate, a résumé tool I created that's tailored to devs and designers. I built it partly out of frustration with these sorts of practices. http://makerslate.io http://makerslate.io
monroepe 11y ago
Wow. Deleting account now.
sterl 11y ago
I'm expecting a response from angel list here. If one does not happen in closing my account.
icedchai 11y ago
So what happened as a result? Anything?
jcsnv 11y ago
Was the project based off of something you did with your employer? I don't know why this thread is so angry, when this could have been a user error. Everyone should put down their pitchforks till we get more information. This is something HN REALLY needs to work on imo.
taveras 11y ago
account deleted! later, AngelList
ishanr 11y ago
Wow.. This is insane. Just deleted my account. How can they be so insensitive.
dzohrob 11y ago
Hi there, I’m Dave and I work at AngelList on our Talent platform. Please accept our sincere apologies for what happened here. Sending an email without giving you a heads-up or control over its content was wrong. Here’s what we’re doing to fix it: * We’ve made it clearer that tagging a company on a project may notify them by email. * We’ve revised the project tagging email to clarify that it’s automatically generated by AngelList. * We’re looking through all emails we send on behalf of our users to make sure that a) it’s clear when an action may generate an email notification, and b) any automatically generated notifications come directly from AngelList. As long as you keep your profile up-to-date by tagging your current and previous employers, we won't show them you’re looking for a job— they won’t see your name or resume appear when using our recruiting tools. Again, please accept our apologies. We’re working to make this better. Please let me know if you have any further questions or concerns -- dave@angel.co. Thanks, dave
- DiNovi 11y ago
  Of course, updating your profile after months of inactivity will probably tip them off. IMO any response that isn't "we have turned off this feature and will re-evaluate" is no bueno.
- greggarious 11y ago
  Our of curiosity, does AngelList have a chief privacy officer, or even a privacy manager or subject matter expert embedded with the engineers? (Until this moment I wasn't familiar with the service - I mostly get jobs through friends and former coworkers.) I understand some companies are not large enough to have a dedicated privacy professional, but as someone who knows quite a bit about it, it's really frustrating when the response to something like this is "whoops! here are the steps we are taking to correct this". Don't get me wrong Dave: This is a great response and you sound like you truly want to avoid incidents in the futures. Kudos for that - many companies would simply quote their privacy policy and offer up a feeble "Sorry you're sorry." But this is more than a one time bug to be quashed. IMHO all companies (even small startups) should endeavor to move beyond reactive solutions like this, and put processes and controls in place so that these incidents never happen to begin with. If you or anyone reading this is on the fence, think of it as marketing. Marketing in the sense of providing a quality product that fulfills a need, and makes other people want to buy your product because it's solid and good.
synaesthesisx 11y ago
Wow fail - looks like AngelList is going the way of LinkedIn. Anyone have any suggestions to alternatives before I delete my account?
leephillips 11y ago
You recently gave critical information about yourself, including your employer's email address, to some guys with a website. How can you think this is a good idea?
synaesthesisx 11y ago
Unacceptable. You guys fucked up. RIP AngelList
- jorgecurio 11y ago
  wow that escalated.
  - rm_-rf_slash 11y ago
    It's the gist of about 1/4 of the posts on this thread. It's a little worrying that people will be upset by something that didn't happen to them and throw it all away without a second thought. There was an op-Ed in the New York Times the other day about a former UN bureaucrat saying the UN is broken and needs reform, and the astounding reader reaction was essentially to burn it down and start fresh. I don't think many programmers here would seriously advocate the same approach with large systems.
    - numbsafari 11y ago
      Ummm... This is a forum for people interested in startups, which are defined more as "start fresh, then use it to burn down the old thing." Not exactly the same thing, but offend driven by the same sentiment.
      - rm_-rf_slash 11y ago
        Yes the sentiment is the same, but it takes little historical understanding to see how tearing down is always easier and more exciting than building up. What works at a startup often can't work at a big company. Or a university. Or a government. You have to work with the system you have. For those that leave angellist without a second thought, what are your alternatives? LinkedIn?
        jorgecurio 11y ago
        was thinking about this just now. how easy it is to influence people over the internet through mediums like reddit, HN, etc. as soon as something gains enough upvotes, it becomes the truth.
andlarry 11y ago
When our CEO added me to our angel list account, I recieved this email from them: Hi [My Name], I'm building an AngelList profile for [our company] and need your help. Can you do me a favor and confirm that you're a team member by clicking here: https://angel.co/l/[shortlink] To prove that you're the real [My Name] you will be asked to create an account if you don't already have one. This is important to us; confirming that you're a team member will help us build our profile. Thanks, [CEO's Name] P.S. If you would like to visit our profile first, go here: https://angel.co/[our company] They're really aggressive about impersonating folks, my CEO didn't write that and was very suprised by the content of the email.
- gragas 11y ago
  I know almost nothing about law, but that has to be illegal in some way, right?
  - anigbrowl 11y ago
    Perhaps not criminally, as some nugget buried deep in the Terms of Service probably gives them a contractual right to do this with the nominal assent of the users, but even if it's contractually valid it strikes me unconscionable and open to challenge in civil court. It also seems like a spectacularly self-defeating business strategy, but then again I thought the same thing about all those 'one weird trick...' adverts.
- indeed30 11y ago
  I got that message a while back and up until this moment had genuinely believed that was a message from our CEO.
  - andlarry 11y ago
    I did too! I can understand why they do it, but it seems like a very hill-climby optimization. This was basically my first interaction with them and it engendered a lack of trust in their product. I filled out the minimum amount of info in my account and don't intend to use them much going forward, mainly given how creepy I found this interaction. edit: phrasing
latenightcoding 11y ago
Angel list trying to be shady like linkedin
oliversisson 11y ago
This is the original email. My name is Oliver Sisson and I work at Coursera. From: Oliver Sisson <team@angel.co> Date: March 20, 2016 at 10:02:25 AM PDT To: staffing@coursera.org Subject: [recruiting] I created a project for Coursera, could you confirm? Reply-To: Oliver Sisson <oliversisson@gmail.com> Hi Coursera, I created a project for Coursera: [Project description redacted] Could you please confirm the project, by following this link: https://angel.co/l/3248d1520e525149b6bf36369d0b519a/MbVzt https://angel.co/l/3248d1520e525149b6bf36369d0b519a/MbVzt Thanks, Oliver Sisson
- exadeci 11y ago
  http://careers.stackoverflow.com/ http://careers.stackoverflow.com/
snotrockets 11y ago
Instructions on how to delete your AngelList profile: https://angel.co/help/general/delete-user-profile https://angel.co/help/general/delete-user-profile
dreeves 11y ago
I like user andlarry's characterization: "very hill-climby optimization". The other technical CS term is "greedy". This is related to a much less bad (but still kinda bad) thing that companies often do, namely sending smarmbot emails: http://blog.beeminder.com/smarmbot http://blog.beeminder.com/smarmbot You could call what Angel List sent "nonconsensual smarmbot emails".
m0d0nne11 11y ago
"We’ve made it clearer that tagging a company on a project may notify them by email." I had not previously heard of AngelList but I am grateful that this declaration appeared early in these comments as I can now stop reading, knowing with full confidence that AngelList is an organization that I will never, Ever, EVER do any kind of business with. OMFG...
dzohrob 11y ago
UPDATE: To everyone worried about their privacy on AngelList: We’re sorry. Thanks for all your feedback. We’ve made more changes: 1) We stopped using the first-person on all emails. We wrote that first-person notification literally 5 years ago when we had a few thousand users, and we never re-visited it. It was pretty stupid. Now they all clearly come from AngelList. 2) We won’t send notifications to companies when you add them to a project. We used to because the project shows up on the company profile too. But it’s not what people expect, so we stopped, and we stopped showing the projects on company profiles too. Thanks again. Dave AngelList (Posting at top-level in case people miss it as a reply)
stedesign 11y ago
Just to erase any doubts, I've deleted my account. I can survive without AngelList
phantom_oracle 11y ago
Does anybody else find it strange how this unethical "growth hack" has backfired on this company? They were steadily becoming THE place for listing your startup and get seen by investors, but then this happened. I wonder if we will see a trickle down and this gets reported on those popular SV tech sites. May just be a bump in the road though. Kudos to the person recommending filling your profile with dummy data before deleting your account. Then again, every company and their dog is doing "big data", so your real info is probably trapped in an AWS server until the end of time.

958 points by oliversisson 11y ago

I recently updated my AngelList profile and they emailed my employer, pretending to be me, to "confirm" the project I'd added. How can they think this is a good idea?

Animats 11y ago

This might be "false personation" under California law. See California penal code 529.[1] This is slightly different from identity theft. It's a criminal offense. The key elements of this offense are that someone else impersonated you in some way, and they derived some benefit from doing so. Because this is a criminal offense, AngelList's TOS's arbitration clause does not apply. You can file a police report with the SFPD. If several people do that, something might be done about it. [1] http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&group=00001-01000&file=528-539 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&gr...

nakedrobot2 11y ago
Unless you have authorized them to do this under the Terms and Conditions of course.....
- Karunamon 11y ago
  Correct me if I'm wrong, but as I understand it, you cannot contract your way out of criminal law.
  - dchest 11y ago
    In this case, every giving would be stealing. If I gave you something, you didn't steal it from me. Likewise, if I gave you the right to impersonate me in particular circumstances, it's not a criminal offense if you do.
    - 9935c101ab17a66 11y ago
      Except he obviously didn't give them permission to do this.
    - IanCal 11y ago
      The comparison to stealing is frankly ridiculous, as the law doesn't say you can't transfer money. It will explicitly talk about consent. If contracts allowed you to agree to anything then minimum wage laws couldn't work. Which side the impersonation laws fall on will depend on how they're written.
      - OJFord 11y ago
        What about boxing, martial arts sparring, fencing, assisted suicide, and voting by proxy? The point here is that you either _can_ contract your way out, or (what I suspect is the case) there re exclusions in the law were relevant. Either way, it suggests this might not be illegal if covered by something blindly tick-boxed.
        ams6110 11y ago
        You seem to be opertating under the delusion that the law is logically consistent. It isn't. There are some things you can allow by contract/permission and some things you cannot, and circumstance matters.
        OJFord 11y ago
        No, I'm not. I'm responding to the blanket statement to the contrary. I fully expect that it's a case of cased exclusions as I've said in another comment.
        IanCal 11y ago
        You cannot, uniformly, give people the ability to do anything to you. That's the point I'm making. > What about boxing, martial arts sparring, fencing Consent only works up to a point. I cannot consent to you stabbing me or beating me into a bloody pulp. https://en.wikipedia.org/wiki/Consent_(criminal_law) https://en.wikipedia.org/wiki/Consent_(criminal_law) https://en.wikipedia.org/wiki/R_v_Brown https://en.wikipedia.org/wiki/R_v_Brown It's worth noting that bare knuckle boxing is illegal in the UK, and you can't just sign a document to do it. > assisted suicide Assisted suicide is illegal in the UK. It does not matter if the patient signs a contract to say it's OK, it's still illegal.
    - iopq 11y ago
      If your Windows EULA said "Microsoft can take any of your property" they still can't steal from you just because you agreed to it.
      - donatj 11y ago
        It would no longer be stealing because you agreed to it. This is why repossession is legal.
        Karunamon 11y ago
        Such a contract would likely be ruled unconscionable (invalid) if anyone challenged it. I don't think there's a judge in the country that could be convinced that any piece of code is good enough consideration for random tangible property.
      - dchest 11y ago
        Yes, you can agree to transfer all of your property to Microsoft in exchange for a Windows license. But including this in EULA will not work though, as there are limits on what you can agree to without signature or notary.
    - notalaser 11y ago
      It depends on where you are in the world, but in most places in the civilized world, criminal law does not work that way. If something is illegal, we cannot sign a contract that says it's ok between you and me, and magically make it legal. E.g. if I kill someone, the state will prosecute me for murder, regardless of whether or not that guy and I signed a contract that said it was fine. If impersonating someone is a criminal offense in a particular jurisdiction, then -- assuming that jurisdiction has a sane criminal code -- there is no way to make it legal through a contract. Edit: there are good reasons why this is in place, the most relevant of which is that it provides protection against abuses. Otherwise, we'd have things like employers that would still be at liberty to use lashing and beating as disciplinary action against employees who don't really have a choice about signing a contract or not.
      - vidarh 11y ago
        The point is that the specific criteria defining what is criminal can include whether or not there is consent. A contract can establish consent. E.g. if I go into your house without permission and take stuff, then it is theft. If I have a contract saying that I have permission to go into your house and take stuff, then it is not. I have not contracted my away from something illegal. The contract has established consent, which meant the criteria that otherwise would have made my actions criminal are not fulfilled. > If impersonating someone is a criminal offense in a particular jurisdiction, then -- assuming that jurisdiction has a sane criminal code -- there is no way to make it legal through a contract. That depends whether or not the criteria that needs to be met for it to be a crime requires lack of consent. If it requires lack of consent, then a contract can document that the consent has been given. All jurisdictions I'm aware of (not a lawyer) have the concept of agents that may act on your behalf with consent. To what extent such agents can act using your name (with consent) vs. using their own name but on your behalf, varies greatly. E.g. some places your agents (say a PA) will sign letters "[agents name] for and on behalf of [your name]" or similar, while other places they will use a signature stamp with your signature, or do "p.p. [their signature] [your printed name]" (the p.p. stands for "per procurationem"). Many other variations are in use, and how obvious signs there are that a document was not personally signed by the person the letter is from varies greatly.
- JupiterMoon 11y ago
  No! If an offence is criminal it can't be magically made OK by a contract. I am not a lawyer. This is not legal advice.
  - wojt_eu 11y ago
    Wouldn't it make it impossible under California law to have an agent that impersonate me? Have them tweet from my account, reply to emails in my name etc.
    - robzyb 11y ago
      It is, of course, perfectly legal to do that with permission. The problem here is that it was done without permission. The OP is claiming that the impersonation without permission is a crime, and that it is impossible to waive the crime-ness of it through a contract.
      - OJFord 11y ago
        Parent is replying to a comment stating: > If an offence is criminal it can't be magically made OK > by a contract. I think this must be mistaken (IANAL either). Boxing, assisted suicide, and voting by proxy come to mind.
        deleted 11y ago
        [deleted]
        svckr 11y ago
        The quote sounds right to me. If the act of impersonating someone is indeed a criminal offense, you can not smooth that over with a contract. Voting by proxy is not impersonation, you give someone the right to act (vote in this case) in your name. Thus, no criminal offense. The other cases: Assisted suicide is a criminal offense in many countries. For example (similar, but not the same), there has been some legal struggle over "Sterbehilfe" here in Germany which garnered quite some media attention. Boxing – I might be mistaken, but perhaps "beating someone" is not a criminal offense as long as it is not against the other persons will? All these things hinge on very subtle differences in wording. For example the terms might say: "AngelList reserves the right to send mails on your behalf" which grants them the right to send mails to third parties in your name, but I'd be surprised if law would allow them to state "AngelList reserves the right to claim your identity".
- morninj 11y ago
  Not sure why you're being downvoted so much. The statute clearly imposes penalties for impersonation "without consent," so consent is a defense here.
- btbuildem 11y ago
  If I authorize you to kill someone, you're still on hook for committing the murder.
- jjallen 11y ago
  A contract that requires a party to do something illegal is inherently unenforceable. https://en.wikipedia.org/wiki/Illegal_agreement https://en.wikipedia.org/wiki/Illegal_agreement To illustrate why this is the case, we can look at an extreme example: a contract to have someone murdered. Would a court enforce that? Of course not.
johnchristopher 11y ago
> he key elements of this offense are that someone else impersonated you in some way, and they derived some benefit from doing so. Is Facebook usage of their user's profile pic for advertisement purpose a false impersonation too ? (I don't know if it's still in practice or if it was ever implemented)
- Pyxl101 11y ago
  If Facebook used their photos to claim to be them, then maybe it would be impersonation. Using their photos in advertising is not claiming to be them.
- davismwfl 11y ago
  If Facebook uses your picture for advertisement purposes it generally falls under "using your likeness" and is covered under their terms of service about advertising. They are not impersonating you because they are not claiming to be you, they are instead using your likeness to promote either themselves or their clients. This is similar to agreements you might sign with an employer, photographer or other third party so they can use your photo in an ad or as part of marketing material. And from what I understand (IANAL) the requirements vary from state to state in the US and obviously outside the US. Although there are blanket terms that cover it from what I have seen. BTW -- Anytime you have professional photos done, this is something you should always look for and make sure you are comfortable with the terms they lay out in their "Agreement". Many have boiler plate in their agreements that states they can use your likeness without paying you for it and without prior written consent. I just went through this when looking for a professional photographer when we had some family photos done as I don't want anyone using images of my family or kids.
temphn 11y ago
Are you seriously advocating reporting someone to the police based on a one sentence secondhand account from a single dumb Hacker News front page post? You have zero context for what happened here (could well be user error!) and yet you are encouraging an angry mob to go and SWAT someone. If you want to play that game, I'm sure that filing false police reports -- or encouraging others to do so -- is a flagrant violation of California's penal code. It is you, John Nagle, who should be thrown in jail if this turns out to be a nothingburger (as is likely the case!). Or we could all just calm down and report it as a bug. Jesus Christ.
- deleted 11y ago
  [deleted]
- jcsnv 11y ago
  Why is this getting down voted?
  - hnal943 11y ago
    Because Animats is suggesting that the OP file a police report, not randoms from the internet. He then says if enough people (i.e. customers of AngelList) complain, they may be heard. There's nothing untoward about referring someone who believes they've been victimized to the police.
  - dang 11y ago
    Probably because it escalated by getting personal. Wrong direction to go.

afoxtron 11y ago

You're giving me cold sweats now thinking that angel list emailed my company

NetOpWibby 11y ago

That's fucked up.

eaxitect 11y ago

AFAIK, AL asks confirmation only if an entry is related to -that- company/person/etc. You might add -your- project (i assume not related to your employer) some how as if it is related to your employer.

tamersalama 11y ago

What kind of TOS would allow that 3rd party involvement? If none - then it's grounds for law suit.

etjossem 11y ago
You can ask them yourself: team@angel.co Let us know what you find out?

joshfraser 11y ago

They do the same impersonation trick to confirm investors and co-founders as well. It gives them cleaner data & is great for growth.

chris_wot 11y ago
That's extraordinarily unethical. I doubt I'd need to use them, but if I ever have the opportunity, I won't.
jedmeyers 11y ago
Some call this "impersonation trick" an identity theft.
deleted 11y ago
[deleted]
logicallee 11y ago
do you see any difference between these two statements: "John Fraser has just added you as an employer, can you confirm? -Linkedin" "I'd like to add you as an employer on linkedin, can you confirm! -John Fraser"
- joshfraser 11y ago
  Of course I do. I wasn't meaning to condone their behavior, only to share that it's something they do extensively and give some context on their potential motivation for it. They send these emails from team@angel.co but the name and content definitely gives the impression it came from someone else.
RIMR 11y ago
>They do the same impersonation trick to confirm investors and co-founders as well. It gives them cleaner data & is great for growth. I just started pointing to groups at bars when the bartender asks me if I want to start a tab. It's done wonders for my personal finances! /s

deleted 11y ago

[deleted]

MichaelBurge 11y ago

Depending on the details, it could be a minor felony for fraud.

alanh 11y ago
Clarify? Who would have committed a felony, in what circumstance?
- deleted 11y ago
  [deleted]
- elevenfist 11y ago
  Identity theft/impersonation, the company, ceo
- fiatmoney 11y ago
  See this for a related case. https://en.wikipedia.org/wiki/Hewlett-Packard_spying_scandal https://en.wikipedia.org/wiki/Hewlett-Packard_spying_scandal
- MichaelBurge 11y ago
  Let's take a more obvious case: Suppose you're running a Bitcoin exchange, and people are dumb enough to sign up for an account on it and give you their banking details. You have a copy of their id, their checking account number, their social security number, etc. The person puts an order for $100,000 in Dogecoin on the exchange, and you'd like more information before you process it in case its fraudulent. So you call up their bank and pretend to be them, using all the information they've given you to bypass their security questions. Then you ask the representative to have a year's worth of statements sent to you via email. Bank of America will mail them to you for free. This seems like it should be fraud, even though they didn't steal any money. There's a couple differences: * They used a email to trick the target rather than the telephone. Telephone has a history of regulations associated with it. * They're tricking your employer rather than your bank. Regulations surrounding banks are tighter, so this might only be fraud if it deals with a bank. * They may have used fewer documents when authenticating themselves. For example, they probably don't have your government id, so they likely only sent publicly available information when identifying themselves. * They may have used an automated system to send the email rather than having someone manually craft it. I don't think this matters, except to make it a little harder to establish intent. * They're not using this to gain new information, but rather to validate information already given. So no theft of company secrets, unless they ask for more details in the email. * AngelList is based in California, so depending on where OP or his previous employer were, it might not cross state lines and so could be immune to federal law. * It's unclear to me what exactly the contents of these emails are. Are they basically like LinkedIn spam, clearly identifiable as such? Or is someone crafting emails by hand and pretending to have a conversation with the manager to get details about the project? Imagine saying you worked at Valve on a secret game, so they called up your manager pretending to be you and ended up getting the release date for Half Life 3. That's fraud. * It's unclear how they pretended to be the OP. Did they just forge the from: header on the email? Did they log into his gmail account and send an email authenticated from Google's servers? The latter would escalate the crime. To answer your question, I was mainly thinking identity theft and that they'd fine the AngelList LLC. Exactly which of these differences matters I'm unsure about. I don't think anyone would seriously care too much about it even if it were illegal though. The worst that would happen would be them being told to stop if enough people complained. It'd be worse if they were doing it to investors.

DonHopkins 11y ago

I had big problems with the "Angel List" web site, because it was extremely flakey and appeared to be a typical piece of garbage that some dime-a-dozen huckster with very little experience had just thrown together after watching the Ruby on Rails Make Your Own Trendy Dot Com Crud Web Site in 10 Minutes screencast. Major features were totally broken. Many things about the design were devoid of thought and just haphazardly thrown together, as if I was using a mock-up that was nowhere near ready for prime time. Obviously whoever implemented it and runs it had no intention of using it themselves, and puts no time into maintaining the site or supporting the "customers" (who are actually the product). The only "design" apparent was in the most shallow surface details and of the least meaningful kind. Their support is absolutely non-existent. I heard nothing back from them whatsoever, after sending several emails. Lights are on but nobody's home. It has the feel of yet another ghost town scam web site run by a sociopathic all-talk-no-chops frat boy "idea man" who long ago went on to something else after pissing off and driving away all their developers who worked for free on the promise of equity, and is now letting it run on autopilot. Too many self described "Serial Hacktrepeneurs", not enough programmers. Because I encountered so many problems that I have no control over but should, it's an embarrassment to be listed with so many glitches that I am unable to work around, which cause investors to see my profile in such a haphazard state. Their carelessness makes it look like I'm the one who's careless. I hope Silicon Valley does an episode parodying AngelList, or at least somebody writes some fanfic about it. [1] [1] https://www.fanfiction.net/tv/Silicon-Valley/ https://www.fanfiction.net/tv/Silicon-Valley/

Negative1 11y ago
Insulting, bordering on abusive hyperbole. You seem to have a major chip on your shoulder. Did Angel List eat your baby or something? Also, if you hate them so much but seem to have some sort of reliance on their service, why not take yourself off the site and make a competing product?
- DonHopkins 11y ago
  I don't make a competing product because I don't have 10 minutes to watch a Ruby on Rails screencast.

echelon 11y ago

Wow, I'm never going to use AngelList if this turns out to be true. What an unbelievable betrayal of trust.

godzillabrennus 11y ago

Yeah Angel List does this whenever you list an incubator as well.

SirNoobsAlot 11y ago

Want to know something funnier? I am a non-HR and non-recruiter employee at my company and I can see recruiting tab (angel.co/candidates). On a related note, I try to avoid applying to jobs through AngelList. I'll usually go directly to the company website itself and apply.

etjossem 11y ago
I second this and it's arguably scarier than OP. I've seen this tab before - it shows everyone in our industry who has ever expressed interest in our company through AngelList. It lets me CRUD job listings and contact/reject any candidate. Presumably I got this incredibly far-reaching access simply because I was confirmed as one of 50 employees with an AngelList account. As far as I know, there was no intervention or approval from our recruiting lead. From applicant perspective: as soon as you apply for a job through AngelList, everyone who ever works at that company (now and future) can trivially find you and decide your fate. This is really uncomfortable from the company's perspective too. I could just as easily have been an employee who isn't expected to recruit / shouldn't be making first contact with candidates / shouldn't be able to touch job listings.
arikrak 11y ago
I don't even think you need to be confirmed at the company. I think once you put yourself as an employee of any given company, you can see their applicants, but they may have fixed this issue. Though overall AngelList seem like a site that's focused on helping startups (and investors), and unlike most sites, they don't even charge for their job listings.

beachstartup 11y ago

this doesn't even scratch the surface of what shady people in the funding industry do to put entrepreneurs or wannabe entrepreneurs in terrible positions.

afshin 11y ago

I quit using AngelList when a recruiter confirmed that he'd seen that my profile was actively browsing the site. The old adage about who is the customer and who is the product rang so true with AngelList. I hadn't realized that it was even possible to build a scammier version of LinkedIn until that point.

skrebe 11y ago

account deleted

sergiotapia 11y ago

Thank you for the heads up, I just deleted my account there. How do these companies think for a second that being sleazy like this is OK?

seejay 11y ago

Just deleted the account. Thanks for the tip, OP!

whiskahs 11y ago
Same

dwightgunning 11y ago

When you say "pretending to be me" do you mean that they spoofed your email address in the from and/or reply-to fields? [edit: typo]

dwightgunning 11y ago
Downvotes? Just looking for some clarification on what actually happened here. It's not exactly clear.
- jonesb6 11y ago
  People probably read too much into your comment, hence the down votes. Reason would dictate from the very small amount of info provided that AngelList merely made the email out to look like it was from OP. To say they spoofed them email headers would've gotten 3x the number of up-votes.
solve 11y ago
Yes, the FROM spoofs your name so that the person will believe it's being sent directly from you in most email clients, and the Reply-to goes directly to your email. These are the email headers: From: YOUR_NAME <team@angel.co> Reply-To: YOUR_NAME <YOUR_EMAIL@gmail.com>
oliversisson 11y ago
They used my name in the email from and reply-to fields, and to sign my name. I've replied to my original post with the actual email.
- dwightgunning 11y ago
  Thanks, that spells it out. Damn, that is fairly messed up. I had a similar experience with F6S sending emails in my name so I know how uncomfortable it feels. This is a shame and hopefully just a one-off error.

sakoht 11y ago

Hah. Good to know how this happens. I thought it was an personal insider convo...

OoTheNigerian 11y ago

HN users confuse me quite a bit. How would they confirm if you are lying or Telling the truth? I believe the only wah would be to confirm from the organization owner. Or else, ANYONE can claim to have done any project. I believe they do the same verification (it's simple verification) for roles in an organization.e.g Adviser, Co founder, Investor etc. And the verification is the other way too. If an employer adds you as an employee, you are to verify it too. I struggle to find what the issue is. Perhaps they should have told you they were going to verify your project? Animats / John, when you invite your friend on a social network and they send a message on your behalf, is that criminal too? Remember, OP(Oliver) took an action by claiming he did a project in an organization. It could have been true or false. Don Hopkins, take a deep breath man. You can pass a message without being mean. Except that's the intention for a reason not stated here. In that case, it's all good.

gedrap 11y ago
Think, when people usually update their profile on angellist, linkedin, etc? Usually, when looking for a new job. And normally, you'd rather not share the fact that you're looking for something with your current company as they might start looking for your replacement before you're ready. >>> Perhaps they should have told you they were going to verify your project? That would a huge difference and that's why the frustration - it's not something expected.
- OoTheNigerian 11y ago
  It's a semi prison if you are not allowed to update your profile at a job you work. Remember, the person in question had to chose they were in the said organization and did a certain project. Anyway, asking Angelist to show any claim will be confirmed is not asking for too much. However, it is not such a scandal as OP makes it out to be.
  - uniclaude 11y ago
    > It's a semi prison if you are not allowed to update your profile at a job you work. It's not disallowed, it's just not good. You might not pay attention when your employees are looking for other jobs, but most business owners do, and react rather negatively to it. > it is not such a scandal as OP makes it out to be OP posted a one-line "Tell HN" comment, you're actually the one calling it a scandal.

reactor 11y ago

account deleted, thanks!

thom 11y ago

They do something similar (though less creepy) when you add a team member to your own org. I've got replies from people to emails sent out with my name, and my address in the reply-to field. They're deliberately crafted to seem personal, with I/you/me/us peppered throughout the body and "Thanks, [your name]" in the sig. Ultimately it's a social network with accounts for orgs and people - it's no surprise that people are getting _some_ notification, but the impersonation is a little discomforting. It would be totally find if they just showed it as a template and said "hey, we're about to send this, okay?"

bachback 11y ago

AngelList lists startups, so why are you registering there if you are employed? That's likely a violation of your contract in the first place, and their ToS, and it's public info anyway. AngelList is for companies, not projects. You do realise this info is meant to be public? AngelList is a public register of startups showing the people behind them. If you don't want that info public, don't register there.

imazio 11y ago
There is also a "JOBS" section. If they are not protecting the confidentiality of the potential candidates, well, they are not making any favour to the startups or their business.

uptownfunk 11y ago

If this is true, I'm deleting my account immediately.

halotrope 11y ago

Thank you for sharing the news. I have just deleted my account. In case someone has problems as well finding out how: 1. Click your profile picture on the top right corner 2. Click settings in the dropdown. 3. Click Delete account 4. ? 5. Profit

Cartwright2 11y ago
Before deleting your account you should edit out and overwrite as much information as possible. Things like your name, e-mail, and any other fields should be falsified before deleting. You have no way of knowing if their "delete" mechanism just flips a deleted bit or if it actually erases your data. The problem, in this case, is that the company might notify your employer that you're making those changes. Not sure what I'd do in this case. It might be worth creating some dummy accounts to see what actions actually trigger notifications.
- nathancahill 11y ago
  It flips a delete bit. But here's the bigger problem: your pages return a 404 error page with status code 200, so Google takes a long time to clear them from their cache (real 404s clear semi-instantly).
dhimes 11y ago
What are the odds that works?
Kpourdeilami 11y ago
I deleted my account but it's still visible
aprdm 11y ago
Thanks, just deleted it.

lgomezma 11y ago

Just deleted my account, this is unacceptable.

solve 11y ago

Edit: Oh cool, Hackernews still has this account rank-banned so the comments always stay at the bottom of the page no matter how many upvotes they get. So happy that I'm not the only one who was extremely surprised and upset about Angel List's impersonation tactics. In my experience, 100% of the people who received this impersonation email that angel.co sent, thought it was written by me. If the system wants to send a message on my behalf, it must AT LEAST show me what would be sent with my signature on it, and allow me to confirm or cancel any email that's signed with my full name before it's sent. Angel List is sending out emails with your signature and other impersonation tricks, totally behind your back. I've had people impersonate emails from me in the past as well. Even if the emails aren't offensive, just the idea that someone else now thinks they have my permission to send whatever they want to, while impersonating me behind my back makes me feel extremely uneasy. Here's the impersonation email they send to cofounders when they're added to a profile. As you can see, signing the email with the user's full name, as if the user had written the letter, is a clear impersonation that the user never consents to. FROM: <MY_FULL_NAME> <team@angel.co> Hi <RECEIVER_NAME>, I'm building an AngelList profile for <PROJECT_NAME> and need your help. Can you do me a favor and confirm that you're a founder by clicking here: https://angel.co/l/54223434234234583948593475 This is important to us; confirming that you're a founder will help us build our profile. Thanks, <MY_FULL_NAME> P.S. If you would like to visit our profile first, go here: https://angel.co/<PROJECT_NAME> Email headers used: From: <MY_FULL_NAME> <team@angel.co> Reply-To: <MY_FULL_NAME> <MY_EMAIL@gmail.com>

enzanki_ars 11y ago
In the past couple of weeks I began signing my emails with PGP. Those who are technically inclined can ensure that I sent it, and those not would be a little more suspicious of an automated looking email without a random string of characters at the end.

ahoka 11y ago

Thanks, deleted myself.

danenania 11y ago

If you're looking for a place to list your projects that doesn't do spammy/scammy stuff like this, check out MakerSlate, a résumé tool I created that's tailored to devs and designers. I built it partly out of frustration with these sorts of practices. http://makerslate.io http://makerslate.io

monroepe 11y ago

Wow. Deleting account now.

sterl 11y ago

I'm expecting a response from angel list here. If one does not happen in closing my account.

icedchai 11y ago

So what happened as a result? Anything?

jcsnv 11y ago

Was the project based off of something you did with your employer? I don't know why this thread is so angry, when this could have been a user error. Everyone should put down their pitchforks till we get more information. This is something HN REALLY needs to work on imo.

taveras 11y ago

account deleted! later, AngelList

ishanr 11y ago

Wow.. This is insane. Just deleted my account. How can they be so insensitive.

dzohrob 11y ago

Hi there, I’m Dave and I work at AngelList on our Talent platform. Please accept our sincere apologies for what happened here. Sending an email without giving you a heads-up or control over its content was wrong. Here’s what we’re doing to fix it: * We’ve made it clearer that tagging a company on a project may notify them by email. * We’ve revised the project tagging email to clarify that it’s automatically generated by AngelList. * We’re looking through all emails we send on behalf of our users to make sure that a) it’s clear when an action may generate an email notification, and b) any automatically generated notifications come directly from AngelList. As long as you keep your profile up-to-date by tagging your current and previous employers, we won't show them you’re looking for a job— they won’t see your name or resume appear when using our recruiting tools. Again, please accept our apologies. We’re working to make this better. Please let me know if you have any further questions or concerns -- dave@angel.co. Thanks, dave

DiNovi 11y ago
Of course, updating your profile after months of inactivity will probably tip them off. IMO any response that isn't "we have turned off this feature and will re-evaluate" is no bueno.
greggarious 11y ago
Our of curiosity, does AngelList have a chief privacy officer, or even a privacy manager or subject matter expert embedded with the engineers? (Until this moment I wasn't familiar with the service - I mostly get jobs through friends and former coworkers.) I understand some companies are not large enough to have a dedicated privacy professional, but as someone who knows quite a bit about it, it's really frustrating when the response to something like this is "whoops! here are the steps we are taking to correct this". Don't get me wrong Dave: This is a great response and you sound like you truly want to avoid incidents in the futures. Kudos for that - many companies would simply quote their privacy policy and offer up a feeble "Sorry you're sorry." But this is more than a one time bug to be quashed. IMHO all companies (even small startups) should endeavor to move beyond reactive solutions like this, and put processes and controls in place so that these incidents never happen to begin with. If you or anyone reading this is on the fence, think of it as marketing. Marketing in the sense of providing a quality product that fulfills a need, and makes other people want to buy your product because it's solid and good.

synaesthesisx 11y ago

Wow fail - looks like AngelList is going the way of LinkedIn. Anyone have any suggestions to alternatives before I delete my account?

leephillips 11y ago

You recently gave critical information about yourself, including your employer's email address, to some guys with a website. How can you think this is a good idea?

synaesthesisx 11y ago

Unacceptable. You guys fucked up. RIP AngelList

jorgecurio 11y ago
wow that escalated.
- rm_-rf_slash 11y ago
  It's the gist of about 1/4 of the posts on this thread. It's a little worrying that people will be upset by something that didn't happen to them and throw it all away without a second thought. There was an op-Ed in the New York Times the other day about a former UN bureaucrat saying the UN is broken and needs reform, and the astounding reader reaction was essentially to burn it down and start fresh. I don't think many programmers here would seriously advocate the same approach with large systems.
  - numbsafari 11y ago
    Ummm... This is a forum for people interested in startups, which are defined more as "start fresh, then use it to burn down the old thing." Not exactly the same thing, but offend driven by the same sentiment.
    - rm_-rf_slash 11y ago
      Yes the sentiment is the same, but it takes little historical understanding to see how tearing down is always easier and more exciting than building up. What works at a startup often can't work at a big company. Or a university. Or a government. You have to work with the system you have. For those that leave angellist without a second thought, what are your alternatives? LinkedIn?
      - jorgecurio 11y ago
        was thinking about this just now. how easy it is to influence people over the internet through mediums like reddit, HN, etc. as soon as something gains enough upvotes, it becomes the truth.

andlarry 11y ago

When our CEO added me to our angel list account, I recieved this email from them: Hi [My Name], I'm building an AngelList profile for [our company] and need your help. Can you do me a favor and confirm that you're a team member by clicking here: https://angel.co/l/[shortlink] To prove that you're the real [My Name] you will be asked to create an account if you don't already have one. This is important to us; confirming that you're a team member will help us build our profile. Thanks, [CEO's Name] P.S. If you would like to visit our profile first, go here: https://angel.co/[our company] They're really aggressive about impersonating folks, my CEO didn't write that and was very suprised by the content of the email.

gragas 11y ago
I know almost nothing about law, but that has to be illegal in some way, right?
- anigbrowl 11y ago
  Perhaps not criminally, as some nugget buried deep in the Terms of Service probably gives them a contractual right to do this with the nominal assent of the users, but even if it's contractually valid it strikes me unconscionable and open to challenge in civil court. It also seems like a spectacularly self-defeating business strategy, but then again I thought the same thing about all those 'one weird trick...' adverts.
indeed30 11y ago
I got that message a while back and up until this moment had genuinely believed that was a message from our CEO.
- andlarry 11y ago
  I did too! I can understand why they do it, but it seems like a very hill-climby optimization. This was basically my first interaction with them and it engendered a lack of trust in their product. I filled out the minimum amount of info in my account and don't intend to use them much going forward, mainly given how creepy I found this interaction. edit: phrasing

latenightcoding 11y ago

Angel list trying to be shady like linkedin

oliversisson 11y ago

This is the original email. My name is Oliver Sisson and I work at Coursera. From: Oliver Sisson <team@angel.co> Date: March 20, 2016 at 10:02:25 AM PDT To: staffing@coursera.org Subject: [recruiting] I created a project for Coursera, could you confirm? Reply-To: Oliver Sisson <oliversisson@gmail.com> Hi Coursera, I created a project for Coursera: [Project description redacted] Could you please confirm the project, by following this link: https://angel.co/l/3248d1520e525149b6bf36369d0b519a/MbVzt https://angel.co/l/3248d1520e525149b6bf36369d0b519a/MbVzt Thanks, Oliver Sisson

exadeci 11y ago
http://careers.stackoverflow.com/ http://careers.stackoverflow.com/

snotrockets 11y ago

Instructions on how to delete your AngelList profile: https://angel.co/help/general/delete-user-profile https://angel.co/help/general/delete-user-profile

dreeves 11y ago

I like user andlarry's characterization: "very hill-climby optimization". The other technical CS term is "greedy". This is related to a much less bad (but still kinda bad) thing that companies often do, namely sending smarmbot emails: http://blog.beeminder.com/smarmbot http://blog.beeminder.com/smarmbot You could call what Angel List sent "nonconsensual smarmbot emails".

m0d0nne11 11y ago

"We’ve made it clearer that tagging a company on a project may notify them by email." I had not previously heard of AngelList but I am grateful that this declaration appeared early in these comments as I can now stop reading, knowing with full confidence that AngelList is an organization that I will never, Ever, EVER do any kind of business with. OMFG...

dzohrob 11y ago

UPDATE: To everyone worried about their privacy on AngelList: We’re sorry. Thanks for all your feedback. We’ve made more changes: 1) We stopped using the first-person on all emails. We wrote that first-person notification literally 5 years ago when we had a few thousand users, and we never re-visited it. It was pretty stupid. Now they all clearly come from AngelList. 2) We won’t send notifications to companies when you add them to a project. We used to because the project shows up on the company profile too. But it’s not what people expect, so we stopped, and we stopped showing the projects on company profiles too. Thanks again. Dave AngelList (Posting at top-level in case people miss it as a reply)

stedesign 11y ago

Just to erase any doubts, I've deleted my account. I can survive without AngelList

phantom_oracle 11y ago

Does anybody else find it strange how this unethical "growth hack" has backfired on this company? They were steadily becoming THE place for listing your startup and get seen by investors, but then this happened. I wonder if we will see a trickle down and this gets reported on those popular SV tech sites. May just be a bump in the road though. Kudos to the person recommending filling your profile with dummy data before deleting your account. Then again, every company and their dog is doing "big data", so your real info is probably trapped in an AWS server until the end of time.