Glassdoor not so anonymous

Once had a contract where my client wanted me to do "security work", which was initially meant to be for pentesting their clients, but it turned into me building their wifi auth system.

At some point in the gig, one of their clients went to them asking them if it was possible to de-anonymize someone glassdoor review since someone still-employed worked with them. They then went to me to see if I could do it for them. They didn't clarifywhy they went to me, but I legitimately think they wanted me to "hack" glassdoor. I told them in no uncertain terms that I wouldn't do it and they backed off.

A bit later they fired the employee.. I didn't hear how they found the person, but it really spoke to the lengths that some organizations will go to burn down the lives of those who speak up.

Use this google search to find more companies that do it:

  "Glassdoor Alert: Employer Legal Action" site:glassdoor.com

  https://www.glassdoor.ca/Reviews/Employee-Review-Media-Consulta-RVW23674692.htm
  https://www.glassdoor.ca/Reviews/Canidae-Reviews-E845482.htm
  https://www.glassdoor.com/Overview/Working-at-Echelon-Environmental-EI_IE1069898.11,32.htm
  https://www.glassdoor.ca/Reviews/Canidae-Reviews-E845482.htm
  https://fr.glassdoor.ca/Pr%C3%A9sentation/Travailler-chez-Echelon-Environmental-EI_IE1069898.16,37.htm
  https://www.glassdoor.ca/Reviews/Employee-Review-BW-Legal-RVW58014087.htm

Glassdoor has posted a notice on ZURU's page regarding this: https://www.glassdoor.com.au/Reviews/ZURU-Reviews-E2286297.h...

It appears a few other companies are doing this too, including Kraken (https://www.kraken.com/) as you can see here: https://www.glassdoor.com.au/Overview/Working-at-Kraken-Digi...

EDIT: If anyone from Glassdoor is reading this, please advise on a way to either unlink my profile from my identity - or remove my profile and contact information altogether. I believe GDPR may provide some assistance here.

This is actually an amazing opportunity for Glassdoor.

Just put a "badge" next to companies known to sue employees who post reviews on Glassdoor.

No reviews are even needed from that point on to signify a shitty company; for all anyone knows all negative reviews may have been taken down through legal action, but the badge stays, signifying that there was at least one review so damaging that they had to get lawyers involved (or that the company climate is of that toxic kind that sues its own disgruntled employees more generally).

In the end suing will end up acting as the ultimate bad review for that company on the site.

In 2016 I left a very scathing, and very truthful, of my current employer on Glassdoor a couple of weeks before deciding to quit. Two weeks later, Glassdoor sends me an email notifying me that the employer is pursuing legal action and I have two options: 1) delete the review, or 2) stand by the review if it's true and, when it comes down to it, my identity may need to be revealed in court when necessary. That was my catalyst to quit.

I stood by the review and Glassdoor notified me that the employer pulled back on the legal action. My review is still there. And Glassdoor did their best to not reveal my identity under the threat of legal action -- not until absolutely necessary.

This is interesting but a more accurate title would be "New Zealand law allows corporations to sue Glassdoor for user data." As the article notes:

> statements of “pure opinion” are protected by the First Amendment in America. But New Zealand doesn’t have this. Statements of opinion are not categorically protected.

That said, the warning that Glassdoor adds to the pages of companies that do this has to be the biggest warning not to go work for these companies; definitely a bigger deal than a couple of bad reviews.

This is the worst kind of publicity for ZURU. They thought it was difficult to hire employees because of a handful of critical reviews on Glassdoor? It's about to get a lot harder. The company should have spent those extra resources researching how to make their employees happier (and hence, more productive).

Contact us page for Zuru Toys. I just sent them a short message explaining that previously I was not aware of their company but now this issue is the only thing that I know about them and it is not a good look. https://zurutoys.co/contact/

My current company had around 20 or so negative reviews bringing the ratings down to 2. We had a new HR head come in and asked employees to rate 5 stars. Poof. 16 of the negative reviews have vanished. They're now replaced with 5 star reviews. We're currently at 3. HR's goal is to bring it up to 4.

I definitely don't trust glassdoor. :(

>Zuru hasn't simply alleged that it suffered a loss; Zuru’s cofounders declared, under penalty of perjury, that because of the negative reviews, Zuru had to spend more money to recruit job candidates for a particular position.”

Does Zuru have proof it's because of negative reviews and not other causes?

Why don't they make the whole process anonymous?

After verifying that you work for a company, why don't they physically destroy everything that could be used to de-anonymize you, leaving with only some kind of public key and a proof of that you work for company X?

For the legal part I think there were some countries (IIRC Sweden) that doesn't require to keep any logs so that they can move operations there with an owned company and legally anonymize users.

I know it's much easier written here on HN than actually done, but that should be the intention: anonymous by design ground-up.

// edit: fixed "do" to "don't" on first line

Ive never posted on glassdoor because its basically impossible to be anonymous. The date of employment alone probably can narrow down to a handful of people for almost any position.

Any mid or high level job you might as well just post under your name. There simply are too few people that have ever had your job and its only a matter of a bit of work to figure out who you are.

I wonder what the most common job by a single company in the world is? Amazon warehouse worker? Even if a few million people had that job I bet any HN data scientist could deanonomize almost every review.

I'd not heard of Zuru before. Turns out they make tons of cheap plastic crap that makes Happy Meal toys look well made. Their main brands are chinzy collectable toys that combine gambling with too many layers of plastic wrapping, Mini Brandz (because having kids collect mini plastic versions of Heinz and Miracle Whip isn't weird), and Bunch O Balloons (the ultimate in single-use plastic).

Never trusted the fact that reviews on glassdoor AREN'T anonymous...

Oh sure, they hide your name and email, but they have it. A good secret isn't a secret if someone knows it.

I always wondered if they should - and now I wonder if they could - have really anonymous reviews. Just don't tie a review to a user. Sure, ask users to create accounts, validate them, but once they submit a review, it's store without details.

This would make it impossible to respond to subpoenas such as this. And my question now is, could they?

A decent outcome here would be if Glassdoor revealed all employers that attempt to go after former employees with alerts like the current one on the Zuru page.

The original review can be read here https://www.reddit.com/r/newzealand/comments/w2lvgp/zuru_gla...

Does Glassdoor actually have any business operations or webservers in NZ that would be subject to this order if it was issued from a court in NZ?

Since when does a NZ order apply to a non NZ company. For example, American media regularly publishes the names of persons charged with crimes in Canada where the name may be banned from publication by a Canadian court. It's a first amendment thing.

If US companies start obeying orders like this, how is it any different from getting a court order from a "totally neutral" court in Hong Kong, actually controlled by beijing, to de-anonymize the users of an american-based web service.

Looking at the details, it appears that they were sued in a us court in California, so the order does apply.

In the past I've been tempted to leave reviews for bad employers I've had. I've always come to the conclusion that the risks of doing so totally outweigh the completely minimal rewards. The risk of being deanonymised, and receiving retaliation from the company is too high. My threat model didn't include the possibility of litigation compelling the company to hand over PII. I was more concerned that I'd inadvertently betray my identity in my review. Not to mention the issues related to Glassdoor as a company, and their lack of objectivity. Why do people use their service in the first place?

Why you should never leave Glassdoor reviews using;

- Your real name

- Your real email address

- Your real salary and job title

- Your normal vocabulary and idioms

- Any of your devices (as in, go to an internet cafe or something)

They can deanonymize as much as they like all they're going to find is that "dbcooper42069[at]hotmail", using non-region specific language, took a very dim view of company X's management style and pay rates.

It's generally a safer bet than not to assume everything you post on the internet can/will be de-anonymized.

Giving a company your real identity and trusting them to keep you anonymous isn’t a good idea. Either keep yourself anonymous online using your own open source toolset, or consider yourself identified when doing anything.

Glassdoor has a paradox at its heart. Yes we all want to have honest reviews of corporate culture, and anonymity is probably the only way to get that. Except that how does anyone trust an anonymous post ?

The only way to get around this is some impossible to imagine global regulatory chnage where companies may never take action against negative non-anonymous postings.

I am not sure how to overcome this massive information asymmetry that corporations have against us

In general, I don't like the idea of breaking the anonymity, and I haven't checked the reviews posted about Zuru, but the tough question is, should you/a company have the right to break anonymity for factually inaccurate statements.

As a publicly elected official, I have had someone lie about me at a public meeting. An accusation which if true, would certainly inhibit my ability to get re-elected. Since it was in public, I could find the person who said it and got a public retraction at the next meeting.

Thankfully these occurrences are few and far between, but doesn't diminish the question about the rights of the target.

But what if this accusation was posted anonymously and I could not find the the accuser? Should I be allowed to get the name from the site?

Every review I have posted on Glassdoor has been with a disposable email address, using my own device and using a public WiFi hotspot. I once had an employer try to get legal on me because I went to work for a rival after they laid me off - so I know some employers can be petty like that.

I trust Glassdoor to keep their promise of not releasing my ID voluntarily, but when courts get involved all bets are off.

After two experiences, I no longer use or trust Glassdoor.

1. After turning in my notice to resign, the company I was leaving offered me a written agreement where they would pay me $2500 for leaving a positive review on Glassdoor.

2. Someone I used to work with posted a personal attack on Glassdoor, that was clearly against the policies (along the lines of "The CEO is human garbage"), and yet no amount of flagging or reporting the post resulted in them taking it down.

I’ve never used Glassdoor, so it’s a big surprise that they collect and retain identity information in the first place. I would never, ever provide my real name while talking about my previous employers, even if I was told that I would remain “anonymous”

It appears that they have won the lawsuit against Glassdoor.

https://www.nzherald.co.nz/business/kiwi-toy-giant-zuru-wins...

Perhaps this event will send a chilling message to would-be whistle-blowers...

It's also getting a LOT harder to get a totally alter-ego email address that's not connected to you. They want a working phone number now. And hardly any of the "temp SMS" providers work for them - all blocked.

I figure at this point I will need to literally buy a burner phone with cash if I wanted to create some identity not connected to myself online.

>Glassdoor’s FAQ goes into a little more detail about how they will defend user anonymity. They know this is vital their success:

If glassdoor cares so much about anonymity, why didn't they engineer their site in such a way that prevents them from being able to deanonymize reviewers? For instance, not keeping identifying user details after they have been verified?

Why would Glassdoor keep this information? And why would they say they kept it rather than saying they had already deleted it?

Regardless, they need to just delete it now and say they lost the information, and risk the wrath of the NZ legal system rather than risking never getting a review again.

The US court deciding under New Zealand law is bad, very bad:

"Here, then, the question under New Zealand law ..."

The day the courts here decide to pay attention to say the Russian or Saudi laws a lot of people would get in a lot of trouble.

Would these companies have a case if an employee left refusing to sign the paper work agreeing to not talk shit? One company I left tied their severance package to a signature on that kind of agreement.

It’s amazing that companies with billions of dollars of revenue make such poor moves. All I think when I see a story like this is “well I guess there isn’t much competition in NZ toy companies”.

> As for their first point, statements of “pure opinion” are protected by the First Amendment in America. But New Zealand doesn’t have this. Statements of opinion are not categorically protected. Instead, it all comes down to “the honest-opinion defense”.

This is the most surprising part of this article to me. Not the NZ one, but the US one.

Does this mean you can say whatever you want in the US without risking be labeled libel? What if you're a victim of it (NOT saying in this case, but in general like personally)?

Turns out they're actually a HK company now https://app.companiesoffice.govt.nz/companies/app/ui/pages/c....

So I guess this means HK-owned, New Zealand-headquartered, US-sales-team-based companies can now court order user information from other companies.

Interesting.

Maybe this is a foolish statement coming from my never having used Glassdoor, but why the fuck would an anonymous review website even keep PII in the first place?

I just attempted to look at the reviews.

There's an uncloseable pop-up telling you to log in.

Normally I wouldn't bother, but curiousity got the best of me - I logged in with my Google OAuth.

Not so fast - you haven't contributed to Glassdoor in the last 12 months, here's another annoying pop up and you cannot dismiss it until you do.

Does anyone actually bother to use this dark pattern infused service?

Nothing on the Internet these days (especially on review sites) are anonymous any more. Putting opinions on the internet is a risky business if untrue, there are legal consequences. Fun fact: I had received cease or decease letters from the lawyers representing a business that I left negative reviews on Yelp many years ago.

As long as your reviews are true and factual based, they don't have much of a case against you (libel or defamation), with exceptions of course like Depp v. Heard which wasn't trialed in the court of Virginia but really trialed in the court of public opinions and lots of lawyers thought Depp would loose.

Another exception to the high bar of winning libel/defamation case is Bollea v. Gawker - which Peter Thiel has enough deep pocket to literally bankrupted Gawker media.

Otherwise, stay truth state facts in reviews, you should be fine for the most scenarios.

Reminds me of the Penet remailer scandal[1] - which lead to chilling-effects over 'anonymous' user information being disclosed and its eventual shutdown.

[1] https://en.wikipedia.org/wiki/Penet_remailer

Now wait for Blind app to get ordered to reveal the same, or it gets leaked in general.

Blind is more fun as they have a habit of forcing you to use your work email for "verification". They let other people on Blind too, but conveniently use that as a reason to kick them off if they say anything controversial.

Very uncool. I’m going to comment on the mentality of using glassdoor instead.

I’ve used it to gauge the industry many times, research companies a few times. I think I’ve only ever left feedback myself once, and it was positive.

But I never had an actual expectation of total privacy. I figure you could piece identities together based on the posting date alone, especially if it is negative

If you’re an engineer worth hiring, you know that this layer of anonymity is just to prevent it from showing up on your grandma’s linkedin feed; or in a more paranoid way, your vengeful ex-boss easily googling your comments.

If someone really wants to find you, of course they will. I take a bit of a riskier tack. I’m usually just me… we’ll see how it goes in the end

I don't understand why people ever trust the anonymity of Glassdoor. They have neither technical guarantees (e.g. zero knowledge cryptography) nor contractual guarantees (e.g. you can sue for damages if they fail to protect your identity).

My learning is that we should never trust any site that says a form is anonymous. Use TOR and a disposable email alias to create account. If they have anything that blocks using either, don't participate if you want to be anonymous.

I operate on principle that any site that asks you to create login is not anonymous.

Question- how does a company like Zuru think this is a good idea? Suing a former employee because they left a negative review doesn’t exactly give me warm fuzzies. Is this just a case of C level megalomania?

Maybe this legal retaliation attempt speaks more than the reviews themselves...

Blind promises that "all email addresses are hashed, salted and then encrypted. Blind accounts are stored separately from the hashed email addresses. This means that a user’s activity cannot be traced to an email. As an added measure, we do not collect real names. We also discourage users from sharing too much personal information in their posts and messages, which others could potentially use to identify them."[1]

[1]: https://us.teamblind.com/logic

My honest opinion is that Zuru sounds like exactly the sort of shit employer that the comments on Glassdoor make it out to be.

Can they, in pursuing legal options against their employees prove the employees correct?

If you want to fix your Glassdoor review, it’s really simple.

As soon as you onboard employees, pressure then to leave Glassdoor reviews. Since they just started, they obviously approve, albeit ignorantly.

"Zuru hasn't simply alleged that it suffered a loss; Zuru’s cofounders declared, under penalty of perjury, that because of the negative reviews, Zuru had to spend more money to recruit job candidates for a particular position."

I don't understand the logic of the judge here. If even the most true-to-fact negative review may result in spending more for recruiting. Did not they have to demonstrate that they had monetary losses specifically attributed to dishonest negative review?

Sad New Zealand doesn’t have freedom of speech. Especially odd as our western media fawns over their police state and tyrannical government. This was never mentioned though.

Wouldn’t this ruling destroy Glassdoor’s business model? And wouldn’t Zuru actually shoot themselves in the foot with this move? I’d certainly stay away from a company that is this litigious for such a thing. I think it would have been a better option for Zuru to have hired a new management (or reshuffle the old one at least) and do some PR to clean their name. At least they’ll learn about the Streissand effect

I read through all the reviews. https://www.glassdoor.com.au/Reviews/ZURU-Reviews-E2286297_P...

I don't see anything out of the ordinary, and there are definitely some common threads amongst negative reviews.

Wouldn't they have to prove the allegations are false?

Not only this but internal surveys as well. One particular company (100+ startup) in Vancouver was well known for this. The CEO would tell workers that the survey was anonymous but then would immediately try to identify track down humiliate them. It was posted on Glassdoor a couple of times but pretty sure they were taken down like this.

Hopefully Glassdoor is still pursuing protection of the reviewers. This was a rejected motion to squash the whole case without a hearing. That doesn't mean after a hearing there will be a decision in Zuru's favor, just that there is enough for a hearing. At least that's the way I read it, but I'm not a lawyer.

Does Glassdoor give a way for companies to do something about fake reviews that are done in bad faith? I doubt they check validity of any reviews, even if a company claims that it is fake.

I am not saying this is an example to such case but I don't see any other option. Other than perhaps suing glassdoor instead, would that do any good?

I long ago deleted my Glassdoor account and refuse to use it.

This got me to thinking, though. If Glassdoor and similar websites are unreliable, what are some other tactics for learning about the internal culture of a potential workplace? Play the long game and make friends at every company you might be interested in in the future?

Who tells us that these negative reviews are always true and not posted by some disgruntled or mentally ill employee or even someone who never worked there? I know it’s easy to side on the negative reviewer side on glassdoor but it’s an anonymous place and the employer has almost no chance of fighting back.

If a formal legal-entity organization keeps your personal data, non-anonymized, then the those world states it operates in can be assumed to have access to the data. And then it is a question of what private corporations can get the state to provide them with - officially or unofficially.

a fatal double-bind for glassdoor’s prospects for continued existence imo.

competitors are surely celebrating this ruling. especially those who physically cannot put anonymous commenters at risk while somehow still turning a profit without being able to traffic in tracking data.

A good reminder that when you want to be anonymous on the internet, don't use any email / username / ip adress that can be linked back to you.

It's quite easy to create a throwaway email and send your review from a public wi-fi.

Would a blockchain based Glassdoor alternative make sense? You can't sue a blockchain, and if they do somehow, they're not going to ban the entire blockchain in the whole country just because it provides anonymous reviews.

Glassdoor makes you fill out your own company review in order to view others. However you actually don’t know how anonymous they are and if there is a way to find who wrote it as it can present legal risks to employees

Glassdoor is now a tainted site unless they are active about anonymity. Meaning, they don't even have identifying information in their database. I will tell everyone I know to stay away from this website.

Where is glassdor located? If it’s not in New Zealand, what are the consequences of giving them the middle finger and saying “No, we will not comply; feel free to block us in your insignificant country”?

Glassdoor has systematically taken down negative reviews for companies for years. I can’t say I love any of the “board” sites who engage in this type of product, and that includes Yelp, Google Places, etc

The greatest thing I ever saw on Glassdoor was our company's Chief People Officer arguing with anonymous people in their reviews. It wasn't a response they were aggressively going them.

That CPO soon moved on.

This is why we need zero-knowledge proofs for these sorts of products.

A site that promises anonymity without ensuring that compelling identifying data is technically impossible is unfortunate. They are one good breach away from ruining many lives.

If I were the Glassdoor IT admin, I would give out silly names with false IPs.

The best solution is to have zero knowledge (delete all info that can identify a user), but the second best thing is to have double logs. A real one (internal use only) and a false one (for legal usage only). I know it goes against the moral/legal sense, but hey we're living in strange times and the best thing is not to go against multi bilion companies that can force you to do anything they want.

Who from the court or Zuru (or any other "bad" company) can say if the reviews by bill brown with IP 123.124.125.126 or john james with IP 132.133.134.135 are real or not ;-)

Man, apparently these founders have never heard of the Streisand effect. Very dumb move by them. I would never work for a company that sues whistle blowers like this.

This is the reality of "anonymity" on the internet. Whatever promises to be anonymous today will invariably, inevitably, become reconstituted in the long-term.

dang, can Nick Mowbray and Anna Mowbray, the founders of ZURU, compel News.YC to hand over my information if I wrote a poor review of their company in a scathing Tell HN?

Anyone remember back when Glassdoor didn't use TLS for many years?

You're employer had a cakewalk seeing what you were posting if you did it from the office. :/

I don't really understand how this helps that company. This will probably make a lot more people stay really far away from the company.

Reminds me of VPNs, they say they're anonymous, but you never really know till shit hits the fan. At that point, you could be fucked.

I'm not sure how Glassdoor works but wont these people just see this news and can't they just delete their reviews?

Thanks for the heads up I was always unsure about posting reviews on Glassdoor now I know that I will not post any reviews.

Sad to see that were going to have to start using throwaway accounts to post anything on glassdoor. Next up: Blind.

I have seen some reviews mysteriously disappear from glass door. It's not a glass door but an opaque door.

Why don't they just anonymise the data, so even Glassdoor doesn't know who it came from?

I wouldn’t be surprised if there is lots of money to be made de-anonymizing Reddit users

I have never used Glassdoor but I have a decent sense of what they do there …

… and it never occurred to me for even a moment that any user of Glassdoor provided personally identifiable details … why would anyone do this ?

Related:

Where can I see the op ? Blog says they are scared to repost it but I’m not.

Where can I see the “offending” material ?

Is there any issue with not giving Glassdoor your real identity?

I'm not familiar with the law here. Can Glassdoor appeal?

I expect the same thing to happen to thelayoff as well.

I’m glad people are finally seeing through glassdoor

This is where web3 might finally have some use. Truely anonymous decentralised network for reviewing companies. No entity to subpoena and no server logs or user data anyway if they could.

Obligatory 'How do delete all your data from Glassdoor' link https://help.glassdoor.com/s/privacyrequest?language=en_US

so when is the Tor site coming out?

Does Glassdoor even have a legal presence in NZ? If so, why? If not, why are they even bothered by this?

Could they theoretically not just play hardball, ignore the NZ courts entirely on the basis that they have no legal entity within NZ, and see what happens? Are there cross-border legal agreements that give the NZ courts any teeth? Or would it come down to NZ having to mandate that all ISPs block Glassdoor within NZ?

Someone wrote something very shitty, and damaging about (it wasn’t 100% clear - i suspect on purpose) me or some of the people i worked with. It was categorically false for me to be included in these allegations (i believe the entire claim was untrue but i guess i only really know my truth), and i had no way to even ask the person to omit me or why they felt i should be bundled in. At one point this became such a stress i was having panic attacks. I had zero recourse. I hated the job but stayed longer just to prove me leaving wasn’t related to that review which became the topic of the company all hands when they hired an investigative lawyer to look into the allegations.

So yeah…Screw that person but also screw glassdoor for facilitating their narrative.

I mean if the reviews violate NDAs why shouldn't they be able to?

If they don't violate NDAs and the allegations aren't true, why shouldn't they be able to?

Finally, if Glassdoor is anonymous, why would they have any records of anyone who posts a review? If you want to claim some content has an anonymous author, you, the company hosting the content, cannot have any ability to identify the author. Otherwise all this "anonymous" info is a hack, malicious employee, or lawsuit away from no longer being anonymous.