4 ms·
Right after you log in, they display a page that looks almost exactly like a login page asking for your email address and password. I didn't read the page -- I
by wfunction 13y ago
Right after you log in, they display a page that looks almost exactly like a login page asking for your email address and password.
I didn't read the page -- I assumed it was either a "verify your email" or "authentication failed" page of some sort, so I entered my Gmail email address and password. (No, I didn't enter my Gmail password. Read below.)
There is REALLY easy-to-miss "skip" link (I forget the exact text) on the page, but the page looks so much like a login window or "verify your address" window or some other window like that that you don't realize it (and think the "skip" link is probably saying something typical like "Forgot your password?"), so you go ahead and type your credentials -- even though you've already logged in.
The only thing that saved me was the fact that Google asked me if I wanted to "Allow Access" or not, and that made my heart skip a beat and I finally realized what had happened. Thanks Google.
The scary part is that you DON'T have to type in your Google password for this to work! In fact, I typed in my LinkedIn password (I'm not quite stupid enough to type in my Google password on LinkedIn's website) -- but Google still popped up a window asking me for permission, because I was already logged into Google and it didn't even bother checking my password.
So LinkedIn almost got my permission without me ever entering my Gmail password... I almost granted access (thinking it might have been an OpenID thing) before I came to my senses and thought, WTF just happened right now?! Hell no!
- Aloisius 13y agoI didn't read the page -- I assumed This is really the heart of it isn't it? Even if LinkedIn has text in a 40pt font that says, "Import your address book, we're going to log into your email account and download your contacts so that we can link you with them and here is exactly what we're going to do with them," you probably still wouldn't have read it.
- wfunction 13y ago> This is really the heart of it isn't it? It might be a good time for you to pick up the dictionary and look up what "deception" or "misleading" means. > even if [...] you probably still wouldn't have read it. Wow, so you've read a few words of my writing and you already know me so well, so much better than myself? Well, even if you look those words up in the dictionary, you still probably won't understand what they mean. (And FYI, no, I would have read it if it didn't look like another of the same login page.)
- benologist 13y agoLinkedIn went significantly out of their way to position and format that page to phish people. I used to fall for it periodically because I just assumed I'd been signed out and my linkedin credentials were pre-filled in waiting to fail to gain access to my email fortunately. That is the heart of it. If they'd put a 40pt font message, or simply not positioned the "other" email + password sign in screen straight after the "real" email + password sign in screen, we wouldn't be having this discussion. The most damning part is that's not even what they're being sued for - they're being sued for another way they scammed their way into people's email accounts.
- arjie 13y agoLet's not pretend this is not a UI dark pattern.
- mikevm 13y agoI fell for this scam a couple of years ago. I was hastily signing up for LinkedIn, and figured that the page was asking me for my LinkedIn credentials again. Lo and behold, it mined all my Gmail data. It was partially my fault, because I used the same password for my Gmail account as I did for my LinkedIn account. Never again.
- wfunction 13y agoI guess it wouldn't have mattered much if you'd had different passwords anyway, since the same thing would've happened to you as what happened to me (unless things were different two years ago).
- throwawaykf02 13y agoCan you (or anyone) post screenshots of the login and email pages?
- deleted 13y ago[deleted]
- wfunction 13y agoHere's some. I didn't take the screenshots, so I don't remember if these are exactly the same screens as I saw. However, they look quite similar to what I saw and illustrate my point -- compare: http://pamlawhorne.com/wp-content/uploads/2011/09/3-connect-via-email.jpg http://pamlawhorne.com/wp-content/uploads/2011/09/3-connect-... http://help.webscribble.com/download/attachments/1442111/Untitled-3.png http://help.webscribble.com/download/attachments/1442111/Unt... http://homebizideas4u.com/wp-content/uploads/2-upload-mail-contacts.png http://homebizideas4u.com/wp-content/uploads/2-upload-mail-c...
- deleted 13y ago[deleted]