6 ms·

Setting the Record Straight on False Accusations

33 points by r0h1n 13y ago

lawnchair_larry 13y ago
It seems that this person doesn't understand the difference between getting permission and tricking the user. If the users also felt that they gave permission, there would not be a lawsuit.
- droithomme 13y ago
  I agree. For those who understand what is really going on with this issue, Linked In's response here is infuriating lies and doublespeak that assumes the reader is either uninformed or ignorant.
- HNLogInShit 13y ago
  And if LinkedIn cared about user security or making things better, they wouldn't stick with this asinine, amateurish, and user-risking behavior: http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use...
- thrownaway2424 13y ago
  I think that's a bit of a leap. There will always be some lawsuit to fend off. A company the size of LinkedIn is probably defending 20 cases at once. It's just the nature of the lawyer industry. This case sorta-kinda reminds me of the class action where people are saying that when you mail someone at Gmail, Google "intercepts" the message. There's always going to be class actions like that one. Whatever a lawyer can dream up, he can litigate as a civil action.
300bps 13y ago
Obviously written or heavily edited by LinkedIn attorneys. If they wanted to set the record straight they'd say something along the lines of: Like other Internet companies, we ask people for the login and password to their email account. We then suck all the contacts out of that to promote our business in various ways. Some people evidently misunderstood that they were actually giving us permission to do this when they logged into their email account through our site. This led them to believe we were logging into their account without permission. But in fact they gave us permission - they just didn't know they did that. It's not really surprising they didn't know that. Maybe we could've made it more clear - after all we actually prompt them with: Quickly grow your professional network Join John, Joe and 127 others who have found people they already know. But after testing making it crystal clear that our user is giving us access to their email account, fewer people opt to do that.
ams6110 13y ago
The question is would LinkedIn users and LinkedIn agree on whether "permission" to access email contacts has or has not been not granted? Evidently not, hence the lawsuit. It's probably true that LinkedIn does not "hack" email accounts. However it is also probably true that their requests for "permission" use dark patterns[1] and users do not clearly understand what they are agreeing to allow (note, this is speculation on my part; I have a LinkedIn account but don't actively use it and am not familiar with their tactics in the past few years). 1: http://darkpatterns.org/ http://darkpatterns.org/ Edit: I originally posted this comment on the now [dead] copy of this submission. Edit 2: and it seems that this comment is [dead] as well. Interesting.
chopin 13y ago
I'd still like to know whats technically going on. There are bold accusations in another thread (https://news.ycombinator.com/item?id=6425444)for https://news.ycombinator.com/item?id=6425444)for which I do not understand how they are accomplished technically. Both XSRF and simply OAuth seem possible. The latter can't go on unnoticed, imho.
- msandford 13y ago
  What happens is that when you click on a "This person wants to connect with you..." link in an email LinkedIn's website connects you automatically. BUT they throw up a page that looks a HELL OF A LOT like a "you're not logged in yet page" that has a password form on it which SEEMINGLY prompts you to login to their site. What it's actually doing is prompting you to give them your email password so that they can login and scrape contacts. I know this because I've nearly fallen for it myself in the last couple of months. Thankfully I have some internet savvy. The folks who are suing probably saw "please enter a password" and entered one and just happened to use the same password for LinkedIn as their email; LinkedIn thus "hacked" their emails. I think LinkedIn should have to face some heat for this for deceiving people, though I don't believe what they're doing is technically hacking.
  - tonfa 13y ago
    > I don't believe what they're doing is technically hacking Social engineering is often considered hacking.
    - msandford 13y ago
      Yeah I would agree with that. It's "unauthorized access" for nearly all reasonable definitions of "unauthorized". I guess when I said "not technically hacking" what I meant was that I don't believe they're doing XSS or brute-force or SQL injection or something along those lines.
  - lukeschlather 13y ago
    Legally, there's no definition of hacking. LinkedIn does seem to be guilty of violating the same statute most "hackers" are prosecuted under, making it a felony to access a computer without authorization. Really, what they're doing is textbook password phishing.
dreen 13y ago
So upon reading this I went to my LinkedIn to find the settings he is talking about but I don't see them anywhere. Can anybody help me? Where can I disable this?
- ZoF 13y ago
  It's in the Terms and Conditions on signup. huehuehue. In reality I have no idea where this opt-in occurs, nor how to opt-out; I'm (somewhat)surprised it isn't easily accessible.
  - hluska 13y ago
    This makes me want to sign up for another LinkedIn account so that I can try this out! You're possibly an expert growth hacker...;)
Fourplealis 13y ago
Well, they didnt explained what have they done to make people angry. Those invites didnt send themselves.
lutusp 13y ago
Let me guess -- LinkedIn automatically and surreptitiously "opts you in" to sharing your email contact list and there's either no meaningful way to opt out, or the option is buried by people as skilled as those who buried Jimmy Hoffa, or it doesn't exist at all. So they now can speak the half-truth that those malcontents who are suing them didn't find the opt-out option, therefore it was all right to exploit their contact lists. One more thing. Given that a lawsuit is pending, it's extremely unwise to reveal one's defense in advance of the proceedings -- that can only help the other side. When a lawyer tells you to say nothing publicly about an upcoming legal action, you really should listen to him. This tells me that LinkedIn either doesn't have competent counsel, or they're in the habit of ignoring wise advice.
- abat 13y ago
  They're probably more worried about bad press than the payout for the case. The class action lawyers only care about their own fees. They'll probably get a settlement that involves giving some money to some privacy charity rewarding the lawyers and not actually doing anything to directly benefit the members of the class action.
  - mathattack 13y ago
    Exactly. Losing their spot as the business social network would kill them.
  - benologist 13y ago
    I think the ramifications are bigger than that - heaps of services want unrestricted, virtually unaccountable access to our contacts and address books and quite liberally help themselves to it - like Path earlier this year found to be uploading everyone's address books to their servers. A best case scenario for us will greatly limit the way and extent companies access our data.
    - mgkimsal 13y ago
      Some services give it regardless of whether it's asked for - I'm specifically thinking of facebook here. I've done a couple of prototype apps with "login with facebook" functionality. Regardless of whether our app requests it or not, facebook automatically says that we're requesting "access to friends list" - that's just one of the minimum levels of things you get, even if you don't want them, and there's no way to not get it.
lifeisstillgood 13y ago
it's not a legal definition, but it is a marketplace definition: if I give you permission that I did not realise or understand, it's not really permission. if I give you permission to do something, and the way you do it is so out of whack with my expectations it's not really permission. The lawsuit is about one or both of these happening. neither has any realistic legal hope without legislation, but that's not the point. LinkedIn, one of the great professional business hopes for a real revolution in how we find and work with others, is a spammy marketeer. And worse, they don't realise it. nb - you don't have to be a spammy marketeer all the time for it to be an accurate description. just as you don't have to beat your wife every night to be accurately described as a wife beater. you might think you are being a good husband tonight - she is just waiting for the next round a long winded way to say you have lost my trust LinkedIn. One day a viable alternative will appear and you will discover the meaning of freefall. in the meantime have my monthly subscription darn it
- lutusp 13y ago
  > it's not a legal definition, but it is a marketplace definition: > if I give you permission that I did not realise or understand, it's not really permission. Yes, that's true, but it's also true in a legal sense. At least in the U.S., if you enter into a contract that includes conditions that no reasonable person would agree to, those are called "unconscionable" conditions, they have no force, and therefore the contract has no force. http://www.legalmatch.com/law-library/article/what-is-an-unconscionable-contract.html http://www.legalmatch.com/law-library/article/what-is-an-unc... Quote: "What is an Unconscionable Contract? An unconscionable contract is one that is so one-sided that it is unfair to one party and therefore unenforceable under law. It is a type of contract that leaves one party with no real, meaningful choice, usually due to major differences in bargaining power between the parties."
  - quanticle 13y ago
    I'm not a lawyer, but I thought most contracts had clauses that said that if one part of this contract is found to be invalid, the rest of the contract still holds. In other words, each part of the contract has to be struck down individually for the whole contract to be struck down.
3327 13y ago
I have personally felt the same anger against linkedin. Enough to sign my name under a class action. They deserve this and I think its justified.
bsullivan01 13y ago
You "get" permission by tricking users. I am very web-savvy and almost fell for your tricks, so I hope you have to pay at least a $billion as a message. (That and clicking on ads on Google and other SE, they make it extremely hard to distinguish between ads and content. If we had an FTC that stuff would end after threats of lawsuits and billion dollar fines.)
busterarm 13y ago
Notice how they don't say they aren't logging into people's email accounts at all? Why should they be logging into anyone's email account, at all, ever? This might as well be an admission of guilt.
- cschmidt 13y ago
  They do log into people's email accounts, to see the address book. They are saying they have permission, and I'm sure they do in a strict, legal sense, if you read all their TOS. The issue is that they are trying to get as many people to agree as possible, so they are being sneaky about it. People don't know what they're going to do, even though they clicked on a box. Legally correct, yet scummy.
  - busterarm 13y ago
    Absolutely. It's a totally scummy company. I don't and have never had a LinkedIn account. I'm just trying to argue that why should a company even be trying to get access to your email account? They shouldn't be trying to defend the practice. What does this mean for all of the email providers out there who in their own TOS say that they're providing a service and that you can't give any other party permission to access your account? Can LinkedIn be absolved of blame fot accessing something you were never allowed to give them access to to begin with?
  - zeckalpha 13y ago
    So many sites/apps do this sort of thing as "growth hacking". If this goes through, it will set a precedent allowing for many many other suits. I think where the line will be drawn is how well were users informed of what they were consenting to. This will generally improve the quality of ToS, eventually. Hopefully. It also could potentially kill off the business growth model that a lot of social sites use to build themselves off others, e.g. Zynga on Facebook. This is a bigger deal than people are making it.
    - DerpDerpDerp 13y ago
      If this gets marked as legal, I'm going in to the business of legally phishing your passwords.
rvivek 13y ago
Not even sure how this is even setting the record straight. Just negating the assumptions doesn't help anyone. I'm not saying Linkedin is doing anything wrong but clearly the blog post could have had a deeper analysis.
rhizome 13y ago
Note that he does not define who is a member in stating the LinkedIn motto as "Members First." Something tells me it's not "everyone who has created an account."
pbreit 13y ago
This message rings sort of hollow. First, including "False Accusations" in the title seems overly defensive. That immediately trips my Spidey senses. Next, while reading what LinkedIn apparently does NOT do, all I can think is, well, "what does LinkedIn DO?"
- JanezStupar 13y ago
  They do everything he did not claim. He never said that they do not show you a form that tricks you into thinking that you are logging into LinkedIn but in reality you are handing over your email password.
molecule 13y ago
"Who wrote this? Who is Blake Lawit?" From the inside of a business, it might seem like a proper business behavior to have the Senior Director, Litigation at LinkedIn publicly address a class-action lawsuit, but the source doesn't do much to assuage LinkedIn-users' concerns, and the source's defensive role in the situation could be interpreted as an indication impropriety. A response from the CEO, CTO or someone in charge of user experience or user relations would have been much better if LinkedIn wanted to "(set) the record straight" w/ their users. https://www.linkedin.com/in/blakelawit https://www.linkedin.com/in/blakelawit
- mathattack 13y ago
  Agree. The lawyer should draft it, and the chairman or CEO should post it.
- coldcode 13y ago
  What kind of lawyer comments on pending litigation in a public forum? A stupid one.
avty 13y ago
Where there is smoke, there is fire.
nullc 13y ago
Considering all the apologies I get from people after linked in spams the everlasting crap out of me and mailing lists I'm on, I'm having a hard time believing that there isn't _something_ wrong going on there and that Linkedin doesn't know about it. I'm not a fan of social networks— but Likedin seems like an actually reasonable idea... However, I've never made an account there because before I ever got to it the floods of invites (many clearly not intended) provided ample evidence to me that this wasn't something that I wanted anything to do with.
jmmcd 13y ago
> We never deceive you by “pretending to be you” in order to access your email account. I literally don't know what "pretending to be you" means.
- gergles 13y ago
  It's a literal quote from the (incredibly poorly written) suit against LinkedIn.
throwawaykf02 13y ago
Some potentially relevant screenshots from the other thread: https://news.ycombinator.com/item?id=6427599 https://news.ycombinator.com/item?id=6427599

33 points by r0h1n 13y ago

It seems that this person doesn't understand the difference between getting permission and tricking the user. If the users also felt that they gave permission, there would not be a lawsuit.

droithomme 13y ago
I agree. For those who understand what is really going on with this issue, Linked In's response here is infuriating lies and doublespeak that assumes the reader is either uninformed or ignorant.
HNLogInShit 13y ago
And if LinkedIn cared about user security or making things better, they wouldn't stick with this asinine, amateurish, and user-risking behavior: http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use...
thrownaway2424 13y ago
I think that's a bit of a leap. There will always be some lawsuit to fend off. A company the size of LinkedIn is probably defending 20 cases at once. It's just the nature of the lawyer industry. This case sorta-kinda reminds me of the class action where people are saying that when you mail someone at Gmail, Google "intercepts" the message. There's always going to be class actions like that one. Whatever a lawyer can dream up, he can litigate as a civil action.

300bps 13y ago

Obviously written or heavily edited by LinkedIn attorneys. If they wanted to set the record straight they'd say something along the lines of: Like other Internet companies, we ask people for the login and password to their email account. We then suck all the contacts out of that to promote our business in various ways. Some people evidently misunderstood that they were actually giving us permission to do this when they logged into their email account through our site. This led them to believe we were logging into their account without permission. But in fact they gave us permission - they just didn't know they did that. It's not really surprising they didn't know that. Maybe we could've made it more clear - after all we actually prompt them with: Quickly grow your professional network Join John, Joe and 127 others who have found people they already know. But after testing making it crystal clear that our user is giving us access to their email account, fewer people opt to do that.

ams6110 13y ago

The question is would LinkedIn users and LinkedIn agree on whether "permission" to access email contacts has or has not been not granted? Evidently not, hence the lawsuit. It's probably true that LinkedIn does not "hack" email accounts. However it is also probably true that their requests for "permission" use dark patterns[1] and users do not clearly understand what they are agreeing to allow (note, this is speculation on my part; I have a LinkedIn account but don't actively use it and am not familiar with their tactics in the past few years). 1: http://darkpatterns.org/ http://darkpatterns.org/ Edit: I originally posted this comment on the now [dead] copy of this submission. Edit 2: and it seems that this comment is [dead] as well. Interesting.

chopin 13y ago

I'd still like to know whats technically going on. There are bold accusations in another thread (https://news.ycombinator.com/item?id=6425444)for https://news.ycombinator.com/item?id=6425444)for which I do not understand how they are accomplished technically. Both XSRF and simply OAuth seem possible. The latter can't go on unnoticed, imho.

msandford 13y ago
What happens is that when you click on a "This person wants to connect with you..." link in an email LinkedIn's website connects you automatically. BUT they throw up a page that looks a HELL OF A LOT like a "you're not logged in yet page" that has a password form on it which SEEMINGLY prompts you to login to their site. What it's actually doing is prompting you to give them your email password so that they can login and scrape contacts. I know this because I've nearly fallen for it myself in the last couple of months. Thankfully I have some internet savvy. The folks who are suing probably saw "please enter a password" and entered one and just happened to use the same password for LinkedIn as their email; LinkedIn thus "hacked" their emails. I think LinkedIn should have to face some heat for this for deceiving people, though I don't believe what they're doing is technically hacking.
- tonfa 13y ago
  > I don't believe what they're doing is technically hacking Social engineering is often considered hacking.
  - msandford 13y ago
    Yeah I would agree with that. It's "unauthorized access" for nearly all reasonable definitions of "unauthorized". I guess when I said "not technically hacking" what I meant was that I don't believe they're doing XSS or brute-force or SQL injection or something along those lines.
- lukeschlather 13y ago
  Legally, there's no definition of hacking. LinkedIn does seem to be guilty of violating the same statute most "hackers" are prosecuted under, making it a felony to access a computer without authorization. Really, what they're doing is textbook password phishing.

dreen 13y ago

So upon reading this I went to my LinkedIn to find the settings he is talking about but I don't see them anywhere. Can anybody help me? Where can I disable this?

ZoF 13y ago
It's in the Terms and Conditions on signup. huehuehue. In reality I have no idea where this opt-in occurs, nor how to opt-out; I'm (somewhat)surprised it isn't easily accessible.
- hluska 13y ago
  This makes me want to sign up for another LinkedIn account so that I can try this out! You're possibly an expert growth hacker...;)

Fourplealis 13y ago

Well, they didnt explained what have they done to make people angry. Those invites didnt send themselves.

lutusp 13y ago

Let me guess -- LinkedIn automatically and surreptitiously "opts you in" to sharing your email contact list and there's either no meaningful way to opt out, or the option is buried by people as skilled as those who buried Jimmy Hoffa, or it doesn't exist at all. So they now can speak the half-truth that those malcontents who are suing them didn't find the opt-out option, therefore it was all right to exploit their contact lists. One more thing. Given that a lawsuit is pending, it's extremely unwise to reveal one's defense in advance of the proceedings -- that can only help the other side. When a lawyer tells you to say nothing publicly about an upcoming legal action, you really should listen to him. This tells me that LinkedIn either doesn't have competent counsel, or they're in the habit of ignoring wise advice.

abat 13y ago
They're probably more worried about bad press than the payout for the case. The class action lawyers only care about their own fees. They'll probably get a settlement that involves giving some money to some privacy charity rewarding the lawyers and not actually doing anything to directly benefit the members of the class action.
- mathattack 13y ago
  Exactly. Losing their spot as the business social network would kill them.
- benologist 13y ago
  I think the ramifications are bigger than that - heaps of services want unrestricted, virtually unaccountable access to our contacts and address books and quite liberally help themselves to it - like Path earlier this year found to be uploading everyone's address books to their servers. A best case scenario for us will greatly limit the way and extent companies access our data.
  - mgkimsal 13y ago
    Some services give it regardless of whether it's asked for - I'm specifically thinking of facebook here. I've done a couple of prototype apps with "login with facebook" functionality. Regardless of whether our app requests it or not, facebook automatically says that we're requesting "access to friends list" - that's just one of the minimum levels of things you get, even if you don't want them, and there's no way to not get it.

lifeisstillgood 13y ago

it's not a legal definition, but it is a marketplace definition: if I give you permission that I did not realise or understand, it's not really permission. if I give you permission to do something, and the way you do it is so out of whack with my expectations it's not really permission. The lawsuit is about one or both of these happening. neither has any realistic legal hope without legislation, but that's not the point. LinkedIn, one of the great professional business hopes for a real revolution in how we find and work with others, is a spammy marketeer. And worse, they don't realise it. nb - you don't have to be a spammy marketeer all the time for it to be an accurate description. just as you don't have to beat your wife every night to be accurately described as a wife beater. you might think you are being a good husband tonight - she is just waiting for the next round a long winded way to say you have lost my trust LinkedIn. One day a viable alternative will appear and you will discover the meaning of freefall. in the meantime have my monthly subscription darn it

lutusp 13y ago
> it's not a legal definition, but it is a marketplace definition: > if I give you permission that I did not realise or understand, it's not really permission. Yes, that's true, but it's also true in a legal sense. At least in the U.S., if you enter into a contract that includes conditions that no reasonable person would agree to, those are called "unconscionable" conditions, they have no force, and therefore the contract has no force. http://www.legalmatch.com/law-library/article/what-is-an-unconscionable-contract.html http://www.legalmatch.com/law-library/article/what-is-an-unc... Quote: "What is an Unconscionable Contract? An unconscionable contract is one that is so one-sided that it is unfair to one party and therefore unenforceable under law. It is a type of contract that leaves one party with no real, meaningful choice, usually due to major differences in bargaining power between the parties."
- quanticle 13y ago
  I'm not a lawyer, but I thought most contracts had clauses that said that if one part of this contract is found to be invalid, the rest of the contract still holds. In other words, each part of the contract has to be struck down individually for the whole contract to be struck down.

3327 13y ago

I have personally felt the same anger against linkedin. Enough to sign my name under a class action. They deserve this and I think its justified.

bsullivan01 13y ago

You "get" permission by tricking users. I am very web-savvy and almost fell for your tricks, so I hope you have to pay at least a $billion as a message. (That and clicking on ads on Google and other SE, they make it extremely hard to distinguish between ads and content. If we had an FTC that stuff would end after threats of lawsuits and billion dollar fines.)

busterarm 13y ago

Notice how they don't say they aren't logging into people's email accounts at all? Why should they be logging into anyone's email account, at all, ever? This might as well be an admission of guilt.

cschmidt 13y ago
They do log into people's email accounts, to see the address book. They are saying they have permission, and I'm sure they do in a strict, legal sense, if you read all their TOS. The issue is that they are trying to get as many people to agree as possible, so they are being sneaky about it. People don't know what they're going to do, even though they clicked on a box. Legally correct, yet scummy.
- busterarm 13y ago
  Absolutely. It's a totally scummy company. I don't and have never had a LinkedIn account. I'm just trying to argue that why should a company even be trying to get access to your email account? They shouldn't be trying to defend the practice. What does this mean for all of the email providers out there who in their own TOS say that they're providing a service and that you can't give any other party permission to access your account? Can LinkedIn be absolved of blame fot accessing something you were never allowed to give them access to to begin with?
- zeckalpha 13y ago
  So many sites/apps do this sort of thing as "growth hacking". If this goes through, it will set a precedent allowing for many many other suits. I think where the line will be drawn is how well were users informed of what they were consenting to. This will generally improve the quality of ToS, eventually. Hopefully. It also could potentially kill off the business growth model that a lot of social sites use to build themselves off others, e.g. Zynga on Facebook. This is a bigger deal than people are making it.
  - DerpDerpDerp 13y ago
    If this gets marked as legal, I'm going in to the business of legally phishing your passwords.

rvivek 13y ago

Not even sure how this is even setting the record straight. Just negating the assumptions doesn't help anyone. I'm not saying Linkedin is doing anything wrong but clearly the blog post could have had a deeper analysis.

rhizome 13y ago

Note that he does not define who is a member in stating the LinkedIn motto as "Members First." Something tells me it's not "everyone who has created an account."

pbreit 13y ago

This message rings sort of hollow. First, including "False Accusations" in the title seems overly defensive. That immediately trips my Spidey senses. Next, while reading what LinkedIn apparently does NOT do, all I can think is, well, "what does LinkedIn DO?"

JanezStupar 13y ago
They do everything he did not claim. He never said that they do not show you a form that tricks you into thinking that you are logging into LinkedIn but in reality you are handing over your email password.

molecule 13y ago

"Who wrote this? Who is Blake Lawit?" From the inside of a business, it might seem like a proper business behavior to have the Senior Director, Litigation at LinkedIn publicly address a class-action lawsuit, but the source doesn't do much to assuage LinkedIn-users' concerns, and the source's defensive role in the situation could be interpreted as an indication impropriety. A response from the CEO, CTO or someone in charge of user experience or user relations would have been much better if LinkedIn wanted to "(set) the record straight" w/ their users. https://www.linkedin.com/in/blakelawit https://www.linkedin.com/in/blakelawit

mathattack 13y ago
Agree. The lawyer should draft it, and the chairman or CEO should post it.
coldcode 13y ago
What kind of lawyer comments on pending litigation in a public forum? A stupid one.

avty 13y ago

Where there is smoke, there is fire.

nullc 13y ago

Considering all the apologies I get from people after linked in spams the everlasting crap out of me and mailing lists I'm on, I'm having a hard time believing that there isn't _something_ wrong going on there and that Linkedin doesn't know about it. I'm not a fan of social networks— but Likedin seems like an actually reasonable idea... However, I've never made an account there because before I ever got to it the floods of invites (many clearly not intended) provided ample evidence to me that this wasn't something that I wanted anything to do with.

jmmcd 13y ago

> We never deceive you by “pretending to be you” in order to access your email account. I literally don't know what "pretending to be you" means.

gergles 13y ago
It's a literal quote from the (incredibly poorly written) suit against LinkedIn.

throwawaykf02 13y ago

Some potentially relevant screenshots from the other thread: https://news.ycombinator.com/item?id=6427599 https://news.ycombinator.com/item?id=6427599