Comment by TechBro8615 | Hacker News Reader

Comment by TechBro8615 | Hacker News Reader

Parent Full thread

This was a well known fact during the years 2012 - 2015. It's not like it was hidden. LinkedIn asked you to enter your GMail password in a form on their website. It didn't require any sleuthing – you just had to log into LinkedIn and you could see for yourself.

The reason they implemented it that way is because Google did not yet provide APIs to facilitate contact import. As Google adopted more secure standards like OAuth, LinkedIn started using the official GMail API features like "import contacts," rather than logging into your account on your behalf.

People underestimate just how far privacy/security have come since 2013 (pre-Snowden), when even major websites still used HTTP on their payment portals. Someone could sit in a coffeeshop with FireSheep and alter your Amazon order. Privacy enhancing features like OAuth, TLS, and 2FA have only become widespread in the last 7-8 years.

Having the user enter their password for connecting to Gmail is very different to having the service try the passwords themselves. The service shouldn't even have the password in clear text to begin with.

Until OP provides proof I doubt this claim from such a big service like LinkedIn.

What you're describing is them asking you to give them the password explicitly so they could log in and get your contact list. GP suggested they did this behind the scenes by trying the password you use with their service. That's a pretty big claim.

Oh, yeah I see what you're saying. They didn't "guess" your GMail password as far as I know (although I wouldn't put it past them, especially back then).

Giving them your password so they can login on your behalf is just as egregious, IMO. Then again, Plaid did the same thing with your bank account and created a multi-billion dollar business out of it.

> LinkedIn asked you to enter your GMail password in a form on their website.

That is entirely different than what was claimed. The claim was platforms were running "credential stuffing" attacks against their own users by attempting logins to other platforms by guessing that they use the same email address and password for both.

Reply on news.ycombinator.com