Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

"The complaint was specifically about LinkedIn asking for the passwords to their users' email accounts."

Fair enough. He didn't enter his password, it isn't required to use the service. It is only useful for discovering more people via your contacts (and perhaps to spam them as you, that would be bad).

So they implement a feature poorly. Why the hate? The automatic climate control on my Subaru sucks dead gophers through a hose, but I don't translate the fact that Subaru let an crappy design get of an auxiliary feature get into production with "the car sucks, I'm selling it." Especially if my use of it doesn't require a lot of climate management (which it doesn't in California). I might think differently if the car wouldn't start unless the windows were up and the climate control engaged on automatic, that would cause me to sell it.

So I'm confused about the LinkedIn rant a bit.

View on HN

You and I are educated enough about web security that we know not to type one site's password into another site.

Many people aren't. Phishing is a real problem.

When "legitimate" sites start doing slimy, insecure things like asking for third-party passwords, three things happen. One, those "legitimate" sites have the power to do things that most users don't really want them to, like spam their entire contact list as them. Two, it becomes harder for unsophisticated users to distinguish legitimate sites from phishing sites. Three, it means that if a criminal breaks into a "legitimate" site, there's more valuable information there for him to steal.

Completely agree, the confusing bit then is the call to action, instead of "Help me educate LinkedIn" its "I'm deleting my account."

Does the author want to fix LinkedIn? Do they want a different service (or the same service done differently?) or a nearly the same service? It is easy to be dismissive of this form of rant, and sometimes that is actually the best response. But if there is something to learn here[1] that would be good too.

I suspect I'm overthinking it and the author was just venting.

[1] I get the 'here is another exemplar of stupid design' thought as well.

He says pretty explicitly why he deleted his account:

> They should know better than to put their marketing plans ahead of their users' security. They're not going to learn about security until it costs them users. So, scratch one user.

I think this is a reasonable justification, and I imagine the point was to get others to do the same.

the call to action it's up to you I guess, the author exposed some annoying, dishonest and potentially dangerous interaction that LinkedIn is using.

when you read the news do you ask yourself: "what's the call to action of this article?"

when you read the news do you ask yourself: "what's the call to action of this article?"

Always.

I've given up on LinkedIn. They had a high-profile breach less than a year ago and they're still doing insecure things like this. Either they don't know or they don't care. So I'm setting the permanent bozo bit on their company.

Do I expect this to accomplish much? Not really. But I'm no longer part of the problem.

Reply on news.ycombinator.com