5 ms·

If anyone cares, there are a nontrivial amount of companies who have your 'private' LinkedIn info. I don't know if they make fake accounts to friend you, recru

by axaxs 6y ago

If anyone cares, there are a nontrivial amount of companies who have your 'private' LinkedIn info. I don't know if they make fake accounts to friend you, recruiter profiles, or buy it from LinkedIn. I asked one to please remove my info, and they sent me a CCPA form. I told them I didn't live in California, and an agent acted confused and told me to just fill it out, it's the only way to remove it. In short, don't trust LinkedIn.

DyslexicAtheist 6y ago
crunchbase is one such place. they harvested everything from my LinkedIn, I asked them to remove my profile they say it's not possible unless I also send them additional data (scan of my passport). they say it's impossible to remove my info because it is "crowd sourced" which may be the case today but from the data they have on me it is from when they had no users yet and when they scraped sh!t from linkedin: * Hello, To comply with various privacy laws, we require the completion of this form to remove the person profile you have mentioned. If you would like to delete your personal profile page, please complete this form here. Best, Erika ---- Dear Erika, thank you for the information. I have never signed up to this site and therefore do _not_ consent to any information about me being stored on your systems and I do not care who creates these profiles. It is your responsibility under GDPR not to store information about me without my explicit consent and I therefore kindly ask for information about me to be deleted, further I expect any future profiles about me to be blocked from getting created and such info not to be stored also in the future. In case information is not deleted within 30 days I will hand over this matter to my lawyer and also file a report with my data protection commissioner in the EU. best regards, ---- dear <...>, Thank you for contacting Crunchbase! Please note, if you have an active trial or subscription we recommend that you cancel first before moving forward. Instructions on how to cancel your trial here. And instructions on how to cancel your subscription here. If you would like to download or permanently delete your user account information, please complete this form here. If you would like to delete your personal profile page, please complete this form here. If you would like to deactivate your user account, please reply to this email to deactivate your account. You can contact support@crunchbase.com if you wish to reactivate your account at a later date. Keep in mind, your user account is the private information that you can use to control your billing, login information, and alerts. A profile page is what displays externally on Crunchbase - these are completely separate. Because Crunchbase is a crowdsourced platform, any registered user can add or edit any profile page - profiles are not explicitly linked to any user. Please feel free to reach out if you have any additional questions - we'll be happy to help! Best, Erika
- axaxs 6y ago
  Yep, same shit. Just checked my email, the last one in question was 'Apollo'. The form in question makes you attest you are a resident of California, which began the back and forth. APOLLO Dear Alex, On behalf of Apollo, we are pleased to assist you in exercising your access rights under GDPR and/or CCPA. You may exercise your access rights as follows. If you wish to remove the personal information that we have that is tied to your email address, then please respond to this communication by submitting the attached Identify Verification Form. We will then respond to your access request upon further email verification. Why we require this: We require the above because GDPR and CCPA asks that we verify your identity to a reasonable degree of certainty before providing information: this is important, to avoid providing personal information to someone “spoofing” an identity. We believe this process provides that reasonable certainty while avoiding having consumers send us personal government IDs, which contain sensitive information and which we prefer not to receive. (And, unlike companies that deal directly with you, it’s not possible for us to verify you based on our prior relationship – like, by having you list your last movies watched, clothes purchased, or trips booked.) If you prefer to avoid the above process, you can learn detailed information about the categories of personal information that Apollo collects, and how we source it, sell it, and use it for business purposes, by reviewing our Privacy Policy (available at: https://www.apollo.io/privacy https://www.apollo.io/privacy). That Privacy Policy also will tell you how to easily opt out of our marketing databases. Thank you for your interest in our business and data practices.
  - chinathrow 6y ago
    This is such a shitshow. They never took "reasonable degree of certainty" before storing private data either - it makes no sense to then ask that for deletion requests.
    - ornornor 6y ago
      It does if you want to feign compliance while making it hard to delete data.
- gorgoiler 6y ago
swiley 6y ago
I’ve realized a long long time ago that any interaction with linked-in is a bad idea. You might think facebook behaves pathologically but linked-in takes it to a new level!
- Delk 6y ago
  Do you have any examples of that kind of behaviour by LinkedIn?
  - Lio 6y ago
    Well there was the well publicised man-in-the-middle attack by Linkedin. They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining. That seems like a pretty dark pattern to me. To my knowledge no one got fired for unethical behaviour over that. The company seems to have a “don’t get caught” attitude to privacy.
    - Delk 6y ago
      Okay, I didn't actually know about (or remember) that one. Regardless of their intentions, I don't understand how anyone could have thought that was a good idea.
    - gruez 6y ago
      >Well there was the well publicised man-in-the-middle attack by Linkedin. >They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining. Isn't that technically not mitm? That would imply the user was using linkedin as a mail client/proxy or something. This is closer to fraud or phishing.
      - darwingr 6y ago
        Yeah, that's the 3rd time today I've seen someone use that word wrong on here.
- XenophileJKO 6y ago
yearoflinux 6y ago
LinkedIn is pure cancer. They actively tempt you to message your contacts in a way where you think that the recepient would welcome your message right now but it's an opposite situation. This at best creates a communication gap and is at worst rude and might break up communication. I'm shocked that Microsoft which is primarily bases on trust as far as corporate stuff is concerned went for linkedin. I hope they sell them or just burn them. Nothing good can ever come out of linkedin they have less ethics than facebook and twitter.
- ShorsHammer 6y ago
  I'm always surprised at the number of people in infosec or _really interesting_ defense positions who have linkedin profiles. It's the lowest rung of where nation states target and you've just handed it to them on a platter. As horrible as it sounds you all sort of deserve it for selling your soul to such a horrendous platform hellbent on fucking with its users. For some reason we're all worried about tiktok now though.
  - yearoflinux 6y ago
    Thinking about it, it obviously makes sense. These are people who want to be approached by anyone and everyone and will sell to the highest bidder.
  - huffmsa 6y ago
    People describe their company's entire tech stack, in detail on LinkedIn. And the little shot of dopamine they get from being LinkedIn popular would probably make them happy to answer any questions you have about things they left out.
    - salawat 6y ago
      There's a difference between knowing all the pieces that go into a working machine, and knowing how, in what order, to what end, and all the little interactions and knock-on effects in the form of of unwritten knowledge that keep a company cranking along. Go ahead and set yourself up a Tomcat cluster, an internal Tomcat cluster, some Oracle databases, and even go so far as to reverse-engineer a UI and maybe a data model if we're being extra ambitious. A business, you still will not have.
nom 6y ago
Two years ago, I got a real 'welcome to LinkedIn' email on my relatively new company email address with my real name that couldn't have been extracted from the address. Password reset did not work, no account existed. Best guess is someone there messed up when they merged some internal email lists.
- smt88 6y ago
  LinkedIn used to (maybe still does) push users to "see who's on LinkedIn" by connecting your contacts. They then maintained this connection indefinitely without telling the user and also used it to spam people under your name. They used this system to send my ex-girlfriend an invite to join me on LinkedIn. Absolutely repulsive and infuriating.
grimzucchini 6y ago
Now the question is: Do they keep a track of these CCPA forms? Is there a data collection of people asking to remove their info.
- Breza 6y ago
  This is an interesting question. I was technical lead for CCPA and GDPR implementation at my company. We keep hashes of email addresses that have asked to be forgotten and we compare new email signups with the hash list to make sure we never collect their information. Both laws allow companies to keep lists of requests but we like to be extra secure.
fartcannon 6y ago
You left out the most important name: Microsoft. LinkedIn is Microsoft and has been for years. Don't trust Microsoft.

by axaxs 6y ago

DyslexicAtheist 6y ago

crunchbase is one such place. they harvested everything from my LinkedIn, I asked them to remove my profile they say it's not possible unless I also send them additional data (scan of my passport). they say it's impossible to remove my info because it is "crowd sourced" which may be the case today but from the data they have on me it is from when they had no users yet and when they scraped sh!t from linkedin: * Hello, To comply with various privacy laws, we require the completion of this form to remove the person profile you have mentioned. If you would like to delete your personal profile page, please complete this form here. Best, Erika ---- Dear Erika, thank you for the information. I have never signed up to this site and therefore do _not_ consent to any information about me being stored on your systems and I do not care who creates these profiles. It is your responsibility under GDPR not to store information about me without my explicit consent and I therefore kindly ask for information about me to be deleted, further I expect any future profiles about me to be blocked from getting created and such info not to be stored also in the future. In case information is not deleted within 30 days I will hand over this matter to my lawyer and also file a report with my data protection commissioner in the EU. best regards, ---- dear <...>, Thank you for contacting Crunchbase! Please note, if you have an active trial or subscription we recommend that you cancel first before moving forward. Instructions on how to cancel your trial here. And instructions on how to cancel your subscription here. If you would like to download or permanently delete your user account information, please complete this form here. If you would like to delete your personal profile page, please complete this form here. If you would like to deactivate your user account, please reply to this email to deactivate your account. You can contact support@crunchbase.com if you wish to reactivate your account at a later date. Keep in mind, your user account is the private information that you can use to control your billing, login information, and alerts. A profile page is what displays externally on Crunchbase - these are completely separate. Because Crunchbase is a crowdsourced platform, any registered user can add or edit any profile page - profiles are not explicitly linked to any user. Please feel free to reach out if you have any additional questions - we'll be happy to help! Best, Erika

axaxs 6y ago
Yep, same shit. Just checked my email, the last one in question was 'Apollo'. The form in question makes you attest you are a resident of California, which began the back and forth. APOLLO Dear Alex, On behalf of Apollo, we are pleased to assist you in exercising your access rights under GDPR and/or CCPA. You may exercise your access rights as follows. If you wish to remove the personal information that we have that is tied to your email address, then please respond to this communication by submitting the attached Identify Verification Form. We will then respond to your access request upon further email verification. Why we require this: We require the above because GDPR and CCPA asks that we verify your identity to a reasonable degree of certainty before providing information: this is important, to avoid providing personal information to someone “spoofing” an identity. We believe this process provides that reasonable certainty while avoiding having consumers send us personal government IDs, which contain sensitive information and which we prefer not to receive. (And, unlike companies that deal directly with you, it’s not possible for us to verify you based on our prior relationship – like, by having you list your last movies watched, clothes purchased, or trips booked.) If you prefer to avoid the above process, you can learn detailed information about the categories of personal information that Apollo collects, and how we source it, sell it, and use it for business purposes, by reviewing our Privacy Policy (available at: https://www.apollo.io/privacy https://www.apollo.io/privacy). That Privacy Policy also will tell you how to easily opt out of our marketing databases. Thank you for your interest in our business and data practices.
- chinathrow 6y ago
  This is such a shitshow. They never took "reasonable degree of certainty" before storing private data either - it makes no sense to then ask that for deletion requests.
  - ornornor 6y ago
    It does if you want to feign compliance while making it hard to delete data.
gorgoiler 6y ago

swiley 6y ago

I’ve realized a long long time ago that any interaction with linked-in is a bad idea. You might think facebook behaves pathologically but linked-in takes it to a new level!

Delk 6y ago
Do you have any examples of that kind of behaviour by LinkedIn?
- Lio 6y ago
  Well there was the well publicised man-in-the-middle attack by Linkedin. They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining. That seems like a pretty dark pattern to me. To my knowledge no one got fired for unethical behaviour over that. The company seems to have a “don’t get caught” attitude to privacy.
  - Delk 6y ago
    Okay, I didn't actually know about (or remember) that one. Regardless of their intentions, I don't understand how anyone could have thought that was a good idea.
  - gruez 6y ago
    >Well there was the well publicised man-in-the-middle attack by Linkedin. >They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining. Isn't that technically not mitm? That would imply the user was using linkedin as a mail client/proxy or something. This is closer to fraud or phishing.
    - darwingr 6y ago
      Yeah, that's the 3rd time today I've seen someone use that word wrong on here.
XenophileJKO 6y ago

yearoflinux 6y ago

LinkedIn is pure cancer. They actively tempt you to message your contacts in a way where you think that the recepient would welcome your message right now but it's an opposite situation. This at best creates a communication gap and is at worst rude and might break up communication. I'm shocked that Microsoft which is primarily bases on trust as far as corporate stuff is concerned went for linkedin. I hope they sell them or just burn them. Nothing good can ever come out of linkedin they have less ethics than facebook and twitter.

ShorsHammer 6y ago
I'm always surprised at the number of people in infosec or _really interesting_ defense positions who have linkedin profiles. It's the lowest rung of where nation states target and you've just handed it to them on a platter. As horrible as it sounds you all sort of deserve it for selling your soul to such a horrendous platform hellbent on fucking with its users. For some reason we're all worried about tiktok now though.
- yearoflinux 6y ago
  Thinking about it, it obviously makes sense. These are people who want to be approached by anyone and everyone and will sell to the highest bidder.
- huffmsa 6y ago
  People describe their company's entire tech stack, in detail on LinkedIn. And the little shot of dopamine they get from being LinkedIn popular would probably make them happy to answer any questions you have about things they left out.
  - salawat 6y ago
    There's a difference between knowing all the pieces that go into a working machine, and knowing how, in what order, to what end, and all the little interactions and knock-on effects in the form of of unwritten knowledge that keep a company cranking along. Go ahead and set yourself up a Tomcat cluster, an internal Tomcat cluster, some Oracle databases, and even go so far as to reverse-engineer a UI and maybe a data model if we're being extra ambitious. A business, you still will not have.

nom 6y ago

Two years ago, I got a real 'welcome to LinkedIn' email on my relatively new company email address with my real name that couldn't have been extracted from the address. Password reset did not work, no account existed. Best guess is someone there messed up when they merged some internal email lists.

smt88 6y ago
LinkedIn used to (maybe still does) push users to "see who's on LinkedIn" by connecting your contacts. They then maintained this connection indefinitely without telling the user and also used it to spam people under your name. They used this system to send my ex-girlfriend an invite to join me on LinkedIn. Absolutely repulsive and infuriating.

grimzucchini 6y ago

Now the question is: Do they keep a track of these CCPA forms? Is there a data collection of people asking to remove their info.

Breza 6y ago
This is an interesting question. I was technical lead for CCPA and GDPR implementation at my company. We keep hashes of email addresses that have asked to be forgotten and we compare new email signups with the hash list to make sure we never collect their information. Both laws allow companies to keep lists of requests but we like to be extra secure.

fartcannon 6y ago

You left out the most important name: Microsoft. LinkedIn is Microsoft and has been for years. Don't trust Microsoft.