News for hackers. Stuff that matters.
Re:Data Broker Opt-Out List by axaxs on Sunday September 06, 2020 @02:26AM (#24389420)
If anyone cares, there are a nontrivial amount of companies who have your 'private' LinkedIn info. I don't know if they make fake accounts to friend you, recruiter profiles, or buy it from LinkedIn. I asked one to please remove my info, and they sent me a CCPA form. I told them I didn't live in California, and an agent acted confused and told me to just fill it out, it's the only way to remove it. In short, don't trust LinkedIn.
Re:Data Broker Opt-Out List by yearoflinux on Sunday September 06, 2020 @05:13AM (#24390073)
LinkedIn is pure cancer. They actively tempt you to message your contacts in a way where you think that the recepient would welcome your message right now but it's an opposite situation. This at best creates a communication gap and is at worst rude and might break up communication.

I'm shocked that Microsoft which is primarily bases on trust as far as corporate stuff is concerned went for linkedin. I hope they sell them or just burn them.

Nothing good can ever come out of linkedin they have less ethics than facebook and twitter.

Re:Data Broker Opt-Out List by ShorsHammer on Sunday September 06, 2020 @05:33AM (#24390145)
I'm always surprised at the number of people in infosec or _really interesting_ defense positions who have linkedin profiles.

It's the lowest rung of where nation states target and you've just handed it to them on a platter.

As horrible as it sounds you all sort of deserve it for selling your soul to such a horrendous platform hellbent on fucking with its users. For some reason we're all worried about tiktok now though.

Re:Data Broker Opt-Out List by beagle3 on Sunday September 06, 2020 @06:43AM (#24390422)
It suspect the Facebook DBA+backup teams are the most diverse team in the planet. They surely have representatives from every worthy intelligence service on earth working in perfect harmony.
Re:Data Broker Opt-Out List by yearoflinux on Sunday September 06, 2020 @11:18AM (#24391929)
On that note, what's interesting is nobody on earth ever notes that Snowden was cia before nsa. Nsa and cia jostle for power all the time.
Re:Data Broker Opt-Out List by huffmsa on Sunday September 06, 2020 @05:37AM (#24390161)
People describe their company's entire tech stack, in detail on LinkedIn.

And the little shot of dopamine they get from being LinkedIn popular would probably make them happy to answer any questions you have about things they left out.

Re:Data Broker Opt-Out List by salawat on Sunday September 06, 2020 @07:13PM (#24395410)
There's a difference between knowing all the pieces that go into a working machine, and knowing how, in what order, to what end, and all the little interactions and knock-on effects in the form of of unwritten knowledge that keep a company cranking along.

Go ahead and set yourself up a Tomcat cluster, an internal Tomcat cluster, some Oracle databases, and even go so far as to reverse-engineer a UI and maybe a data model if we're being extra ambitious.

A business, you still will not have.

Re:Data Broker Opt-Out List by huffmsa on Monday September 07, 2020 @07:23AM (#24398615)
I'm not talking about a business perspective, I mean they're laying out their specific attack surface, zero social engineering required.
Re:Data Broker Opt-Out List by yearoflinux on Sunday September 06, 2020 @05:35AM (#24390155)
Thinking about it, it obviously makes sense. These are people who want to be approached by anyone and everyone and will sell to the highest bidder.
Re:Data Broker Opt-Out List by justinclift on Sunday September 06, 2020 @07:29AM (#24390648)
Even worse, the official LinkedIn support team are Community Volunteers.

eg not paid employees, any anyone who "volunteers" to help out.

The many failure scenarios for that combined with peoples (sensitive) private information are mind boggling.

Re:Data Broker Opt-Out List by Kkoala on Sunday September 06, 2020 @12:45PM (#24392627)
Sounds like Google
Re:Data Broker Opt-Out List by specialist on Sunday September 06, 2020 @11:04AM (#24391804)
IDK. A decade ago, I made a love connection. I apologized for misusing the medium. She said "Not necessary. I'm glad LinkedIn is good for something." We lasted about 6 months.
Re:Data Broker Opt-Out List by swiley on Sunday September 06, 2020 @04:26AM (#24389910)
I’ve realized a long long time ago that any interaction with linked-in is a bad idea.

You might think facebook behaves pathologically but linked-in takes it to a new level!

Re:Data Broker Opt-Out List by XenophileJKO on Sunday September 06, 2020 @05:20AM (#24390100)
Linkedin does let you use the same GDPR mechanisms built for compliance even if you live in the US. I work there, not in these systems, but a bunch of development effort goes into maintaining meta-data. This is so systems can accurately auto-purge information when people close accounts or power the ability to export your data and make it as easy as possible.

Download your data. https://www.linkedin.com/help/linkedin/answer/50191/download...

Close your account. https://www.linkedin.com/help/linkedin/answer/63

Re:Data Broker Opt-Out List by Delk on Sunday September 06, 2020 @04:38AM (#24389953)
Do you have any examples of that kind of behaviour by LinkedIn?
Re:Data Broker Opt-Out List by Lio on Sunday September 06, 2020 @05:06AM (#24390052)
Well there was the well publicised man-in-the-middle attack by Linkedin.

They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining.

That seems like a pretty dark pattern to me. To my knowledge no one got fired for unethical behaviour over that.

The company seems to have a “don’t get caught” attitude to privacy.

Re:Data Broker Opt-Out List by Delk on Sunday September 06, 2020 @07:47AM (#24390718)
Okay, I didn't actually know about (or remember) that one.

Regardless of their intentions, I don't understand how anyone could have thought that was a good idea.

Re:Data Broker Opt-Out List by gruez on Sunday September 06, 2020 @09:46AM (#24391252)
>Well there was the well publicised man-in-the-middle attack by Linkedin.

>They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining.

Isn't that technically not mitm? That would imply the user was using linkedin as a mail client/proxy or something. This is closer to fraud or phishing.

Re:Data Broker Opt-Out List by darwingr on Monday September 07, 2020 @01:44AM (#24396897)
Yeah, that's the 3rd time today I've seen someone use that word wrong on here.
Re:Data Broker Opt-Out List by nom on Sunday September 06, 2020 @05:31AM (#24390140)
Two years ago, I got a real 'welcome to LinkedIn' email on my relatively new company email address with my real name that couldn't have been extracted from the address. Password reset did not work, no account existed.

Best guess is someone there messed up when they merged some internal email lists.

Re:Data Broker Opt-Out List by smt88 on Monday September 07, 2020 @11:23AM (#24400020)
LinkedIn used to (maybe still does) push users to "see who's on LinkedIn" by connecting your contacts.

They then maintained this connection indefinitely without telling the user and also used it to spam people under your name.

They used this system to send my ex-girlfriend an invite to join me on LinkedIn. Absolutely repulsive and infuriating.

Re:Data Broker Opt-Out List by fartcannon on Sunday September 06, 2020 @09:32AM (#24391169)
You left out the most important name: Microsoft. LinkedIn is Microsoft and has been for years.

Don't trust Microsoft.

Re:Data Broker Opt-Out List by grimzucchini on Sunday September 06, 2020 @06:02AM (#24390262)
Now the question is: Do they keep a track of these CCPA forms? Is there a data collection of people asking to remove their info.
Re:Data Broker Opt-Out List by Breza on Saturday September 12, 2020 @09:34AM (#24452299)
This is an interesting question. I was technical lead for CCPA and GDPR implementation at my company. We keep hashes of email addresses that have asked to be forgotten and we compare new email signups with the hash list to make sure we never collect their information. Both laws allow companies to keep lists of requests but we like to be extra secure.
Re:Data Broker Opt-Out List by DyslexicAtheist on Sunday September 06, 2020 @02:40AM (#24389473)
crunchbase is one such place. they harvested everything from my LinkedIn, I asked them to remove my profile they say it's not possible unless I also send them additional data (scan of my passport). they say it's impossible to remove my info because it is "crowd sourced" which may be the case today but from the data they have on me it is from when they had no users yet and when they scraped sh!t from linkedin:

*

Hello,

To comply with various privacy laws, we require the completion of this form to remove the person profile you have mentioned. If you would like to delete your personal profile page, please complete this form here.

Best, Erika

----

Dear Erika,

thank you for the information.

I have never signed up to this site and therefore do _not_ consent to any information about me being stored on your systems and I do not care who creates these profiles. It is your responsibility under GDPR not to store information about me without my explicit consent and I therefore kindly ask for information about me to be deleted, further I expect any future profiles about me to be blocked from getting created and such info not to be stored also in the future.

In case information is not deleted within 30 days I will hand over this matter to my lawyer and also file a report with my data protection commissioner in the EU.

best regards,

----

dear <...>,

Thank you for contacting Crunchbase!

Please note, if you have an active trial or subscription we recommend that you cancel first before moving forward. Instructions on how to cancel your trial here. And instructions on how to cancel your subscription here.

If you would like to download or permanently delete your user account information, please complete this form here.

If you would like to delete your personal profile page, please complete this form here.

If you would like to deactivate your user account, please reply to this email to deactivate your account. You can contact [email protected] if you wish to reactivate your account at a later date.

Keep in mind, your user account is the private information that you can use to control your billing, login information, and alerts. A profile page is what displays externally on Crunchbase - these are completely separate. Because Crunchbase is a crowdsourced platform, any registered user can add or edit any profile page - profiles are not explicitly linked to any user.

Please feel free to reach out if you have any additional questions - we'll be happy to help!

Best,

Erika

Re:Data Broker Opt-Out List by axaxs on Sunday September 06, 2020 @02:49AM (#24389512)
Yep, same shit. Just checked my email, the last one in question was 'Apollo'. The form in question makes you attest you are a resident of California, which began the back and forth.

APOLLO

Dear Alex,

On behalf of Apollo, we are pleased to assist you in exercising your access rights under GDPR and/or CCPA. You may exercise your access rights as follows.

If you wish to remove the personal information that we have that is tied to your email address, then please respond to this communication by submitting the attached Identify Verification Form. We will then respond to your access request upon further email verification.

Why we require this: We require the above because GDPR and CCPA asks that we verify your identity to a reasonable degree of certainty before providing information: this is important, to avoid providing personal information to someone “spoofing” an identity. We believe this process provides that reasonable certainty while avoiding having consumers send us personal government IDs, which contain sensitive information and which we prefer not to receive. (And, unlike companies that deal directly with you, it’s not possible for us to verify you based on our prior relationship – like, by having you list your last movies watched, clothes purchased, or trips booked.)

If you prefer to avoid the above process, you can learn detailed information about the categories of personal information that Apollo collects, and how we source it, sell it, and use it for business purposes, by reviewing our Privacy Policy (available at: https://www.apollo.io/privacy). That Privacy Policy also will tell you how to easily opt out of our marketing databases.

Thank you for your interest in our business and data practices.

Re:Data Broker Opt-Out List by chinathrow on Sunday September 06, 2020 @07:48AM (#24390725)
This is such a shitshow. They never took "reasonable degree of certainty" before storing private data either - it makes no sense to then ask that for deletion requests.
Re:Data Broker Opt-Out List by ornornor on Sunday September 06, 2020 @04:53PM (#24394582)
It does if you want to feign compliance while making it hard to delete data.
Re:Data Broker Opt-Out List by gorgoiler on Sunday September 06, 2020 @02:56AM (#24389539)
Deadlines help a lot. Has it elapsed, and what was the followup?
Re:Data Broker Opt-Out List by DyslexicAtheist on Sunday September 06, 2020 @03:36AM (#24389710)
yes it elapsed and the "profile" is still up. my only choice now is to complain to my "data protection commissioner" but considering GDPR has no teeth I'm not confident it will impress anyone.
Re:Data Broker Opt-Out List by TeMPOraL on Sunday September 06, 2020 @04:07AM (#24389830)
It has teeth, but it's not very hungry right now. Still, if you complain and CC crunchbase in, then it's them who have to do this calculation, and in context of risk. It may just be enough to get them to remove the data about you.
Re:Data Broker Opt-Out List by justinclift on Sunday September 06, 2020 @07:32AM (#24390660)
Was the "I will hand over this matter to my lawyer" piece a bluff? :(
Re:Data Broker Opt-Out List by reaperducer on Sunday September 06, 2020 @01:56PM (#24393215)
Good question. 99.999999% of the time when some internet rando says he'll contact his lawyer, the reality is that he has no lawyer and no lawyer would ever take his case.

Threatening to tattle to an imaginary lawyer just gets you written off as an angry whack job.

Re:Data Broker Opt-Out List by yeahforsureman on Sunday September 06, 2020 @06:02AM (#24390263)
"It is your responsibility under GDPR not to store information about me without my explicit consent..."

Not commenting on the particulars of this case (you might be right in this particular instance), as a general statement this is not true. Consent is only one of several possible legal grounds for processing personal data. Generally, data controllers want to avoid it if possible in lieu of more convenient grounds. Nitpicking more, explicit consent is mentioned only as a processing ground for so called special category data, i.e. certain sensitive data, e.g. health data, requiring an additional legal ground.

Re:Data Broker Opt-Out List by CPLX on Sunday September 06, 2020 @05:45AM (#24390201)
I mean is their point of view completely wrong? If they are displaying a profile based on public information that’s journalism.

Lists of people who invested in companies, culled from public disclosures, or names of corporate board members and such, aren’t the same thing as private PII.