Comment by andlarry | Hacker News Reader

Comment by andlarry | Hacker News Reader

When our CEO added me to our angel list account, I recieved this email from them:

  Hi [My Name],

  I'm building an AngelList profile for [our company] and need your help.

  Can you do me a favor and confirm that you're a team member by clicking here:

  https://angel.co/l/[shortlink]
  To prove that you're the real [My Name] you will be asked to create an account if you don't already have one.

  This is important to us; confirming that you're a team member will help us build our profile.

  Thanks,
  [CEO's Name]

  P.S. If you would like to visit our profile first, go here: https://angel.co/[our company]

They're really aggressive about impersonating folks, my CEO didn't write that and was very suprised by the content of the email.

I got that message a while back and up until this moment had genuinely believed that was a message from our CEO.

I did too!

I can understand why they do it, but it seems like a very hill-climby optimization.

This was basically my first interaction with them and it engendered a lack of trust in their product.

I filled out the minimum amount of info in my account and don't intend to use them much going forward, mainly given how creepy I found this interaction.

edit: phrasing

Wouldn't it have the wrong sender address?

Or are they actually forging it? (and somehow not getting put into spam due to SPF/DKIM failing)

  From:  [CEO Name] <team@angel.co>
  Reply-To: [CEO Name] <ceo's email address>

They're not forging the from address, it was SPF/DKIM signed.

I know almost nothing about law, but that has to be illegal in some way, right?

Perhaps not criminally, as some nugget buried deep in the Terms of Service probably gives them a contractual right to do this with the nominal assent of the users, but even if it's contractually valid it strikes me unconscionable and open to challenge in civil court. It also seems like a spectacularly self-defeating business strategy, but then again I thought the same thing about all those 'one weird trick...' adverts.

This is impersonation using a computer. Surely that's about 3 levels of computer fraud under US law, isn't it?

Reply on news.ycombinator.com