Comment by DeusExMachina | Hacker News Reader

Comment by DeusExMachina | Hacker News Reader

> What we also don’t really know here — the DPC doesn’t really address it — is where LinkedIn obtained those 18 million email addresses, and any other related data, in the first place.

Well, one such source of email addresses was me.

When I joined it more than 10 years ago, I was not as privacy aware as I am today. So, upon joining, I uploaded my address book to connect to people who already had a LinkedIn account.

I shortly after realized that they abused it. They sent an invite email to every person that was not on their platform.

I only got to know about it becasue one of my university professors sent me an email saying that she was not interested in joining yet another network. I had to apologize, because I did not expect that to happen.

To this day, LinkedIn still uses that information to suggest new connections to me and to prompt me to invite people that are still not on their platform.

In retrospect, it was a stupid move to upload my address book, but I'm sure I am not the only one that made that mistake, and probably many people still do nowadays.

Right there with you. I had assumed it would just look for folks on the network and give me the option at that point on who to add. Nope. I had folks replying back to me declining invite. I had people in my address book I never wanted to contact again. I finally got LinkedIn to stop retrying people from my list, but I failed to get them to forget my list apparently because, like you, some of these people/addresses are on my recommendation list.

It's worse than that now. If you sign up with Gmail it will request access to view your contacts in the OAuth dialog (and will periodically keep requesting this access if you deny it). So no uploading is even necessary; it's sufficient to be using a big email provider and then accept the nag notices.

It only takes one person in your entire contact list to upload their entire contact list, so that your information gets uploaded to Linkedin/Facebook/Google, etc. It's almost impossible to assert that level of control, so my assumption is that my details including my birthday, address, phone number, place of work, etc, has already been uploaded to all of those service. It's infuriating, but it's a reality since I can't stop one of my contacts from uploading my data.

Their app also periodicacally asks you to upload your phone contact list for them. I'm glad Apple have a clear warning message they obviously can't circumvent because the LinkedIn UI makes it really easy to accidentally trigger it in a few places.

I consulted there years back. Helped them relo to a new building. Dolly in one hand, network layouts in the other. After the relo was done, I transitioned to handling trouble tickets along with other consultants.

After a couple of months, our "leader" grabs me and his lieutenant for a special project. We had done a few of those before, I was up for it. We all went for a ride in one of the company vans. Which have only two seats. My job? Make sure the empty rack in the back of the van didn't fall over.

Dude didn't bother to slow down for a number of speedbumps. He let me go that same Friday.

In retrospect, it is always a stupid idea to extend too much trust, when any trust has not first been earned.

I still remember how mailing lists were spammed by same invite messages. :)

It wasn't stupid of you, not your fault LinkedIn literally impersonated you. The mail it sent out all those years ago was written in your name and as though you had actively crafted and sent it. Anyone who knows your name could have impersonated you. Don't worry about doing something wrong.

A quick google suggests linkedin was sued and reached a class action settlement in exchange for the practice.

You can be almost certain that LinkedIn knew it was illegal when they did it, and accurately calculated that the fine they would receive (if any) would be much lower than the value derived from increased membership. In fact they would be stupid not to in winner-takes-all markets like social media.

Silicon Valley has a phrase for such flagrantly unethical practice, it is called "growth hacking".

To gratuitously quote Fight Club:

"It was my job to apply The Formula™. [...] Take the number of vehicles in the field, A. Multiply it by the probable rate of failure, B. Then multiply it by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."

Reply on news.ycombinator.com