[LINK] How does LinkedIn know my contacts?

[Robin Whittle]

Search engine bait: LinkedIn spam LinkedIn problems LinkedIn scam
LinkedIn privacy LinkedIn security.

  https://www.google.com/search?as_q=LinkedIn+scrape  500k
  https://www.google.com/search?as_q=LinkedIn+spam     55M

Please see the other responses, including from Roger Clarke who wrote
about such problems 9 years ago:

 http://www.rogerclarke.com/DV/ContactPITs.html


Hi Rachel,

I recently joined LinkedIn purely so I could participate in a
company-specific forum there which is related to my programming work for
that company.  My profile there is absolutely minimal and states the
above (without mentioning the forum or the company) plus the fact that I
am not interested in linking to other people.  I give my website address
and email address, so people can contact me if they wish without using
LinkedIn at all.

I have serious misgivings about conducting life through these social
networking sites and I have so far avoided them like the plague.  The
reasons for my avoidance could be the subject of a long and tiresome
essay.  However, people are increasingly living their lives through
these systems, so if I want to share some of their activities, maybe I
need to join these damn things.   (A friend joined Facebook about 5 or 8
years ago after he found he was no longer "in the loop" of finding out
what was going on with his friends and neighbors by phone.)

Before I joined I was getting emails from LinkedIn - and probably some
pretending to be from LinkedIn - inviting me to join up.  These
mentioned people, some of whom I know in some way.

I picked one of these invitations, from someone I had been emailing
recently and with whom I have friendly relations, and joined up.  He was
my only link until recently when I received a link request from the CEO
of the company I write software for.

During the sign-up procedure, the system *repeatedly* requested that I
give my email address and password.  I refused, of course.  The system
said it would never send emails from my account - I think it stated that
this was to import my contact list.  This would not have worked for me
anyway, since I have my own mail server which is not a Gmail, Yahoo etc.
account with an address book.  Clearly the LinkedIn system is set up to
work with all the popular commercial web-mail operators, including quite
likely the Microsoft paid-for system which many companies use for all
their employees, due to the difficulty of running their own
web-accessible mail server with even half-way decent security, spam
protection etc.

The LinkedIn system admonished me repeatedly for my some very low score
for how complete my profile was, which I now think of as a badge of
honour.  It asked me to reveal where I went to school, my employment
history, all sorts of stuff - which I of course refused.  Part of my
LinkedIn duncehood is attributable to me not uploading a photo.  Another
cause was my appallingly low number of linked people - initially just one.

After I joined, it became obvious what the significance of the the "give
us your email address and password" was.

Joining opened the floodgates to a larger volume of LinkedIn related
email.  Some of this concerns the forum I want to participate in, which
is fine.  Some of it is link requests from people I have no knowledge
of.  A lot of it is link requests from people who I have communicated
with, including friends of several decades standing, who I regard, in
general, as highly principled and thoughtful in all their business and
social interactions . . . . except one:  ALL THESE PEOPLE GAVE LINKEDIN
THEIR EMAIL ADDRESS AND PASSWORD.

I suspect that LinkedIn keeps accessing their email account
indefinitely, seeking additions to their address book.  Alternatively,
maybe people routinely give their password for LinkedIn to use
immediately, whenever they access their LinkedIn site.  For instance,
after communicating with an individual I did not previously know, within
a day I received a link request to her.  Maybe she manually added my
name and/or email address to her LinkedIn system in some way, but I
can't imagine why she would do so.

Some time in the past, with this computer, I logged into LinkedIn with
my LinkedIn password.  I must have allowed or requested it to set a
cookie.  Now when I went to the site, expecting to have to log in again,
I find I am already logged in.  However, what is presented to me looks a
lot like an account login prompt.  It wants my email address and
password.  But this would be the email account password, not my LinkedIn
account password.

The "Your email" (why not "email address"????) "Your password" form is
preceded by:

   Quickly grow your professional network
   Join X and Y who have found people they already know.

with photos of my two linked people, X and Y.  Below that: "Your email
is safe with us! We will not store your password or email anyone without
your permission."

This is part of the constant pressure to let LinkedIn scrape their
member's email address books.

There's no way that all these people I know would have manually entered
my name into LinkedIn in the hope that one day I would join LinkedIn and
link to them.  So the fact that I get requests to link to these people's
LinkedIn accounts seems only explicable by them giving LinkedIn access
to their email account address books.  Then, I guess, they are either
prompted by the LinkedIn system to send such a request, or the LinkedIn
system automatically sends it.

On the right of my initial page when I access http://www.linkedin.com/
there is a section "PEOPLE YOU MAY KNOW".  Each time I look there is a
different set of three people mentioned there - name, description (for
instance "Music Professional" . . . its all so poncy.  Why not
"musician" or "Music Practitioner" since builders are now "Building
Practitioners"???).  Some of these people I have communicated with by
email, including customers and friends.  Others I have never heard of.
The See More link opens a page of such such people, most with photos.

Like Google Image Search this page just keeps on growing as I scroll to
the bottom.  103 people.  Some I have known, or first knew and
communicated with by email, but have not recently, since 1995.  One I
have known since 1982.  Most of them I have never heard of.

The above explains how LinkedIn presents these people's profiles to me,
inviting me to link to them - my email address was in their email
account address book.  Other recent messages in this thread support this
view.

But what about the rest?  Maybe some of them are real people - but why
would they have manually added my name or address either to their
LinkedIn information set or to their email account address book?

My best guess is that these unknowns are SPAMMERs.

I suspect that spammers collect email addresses in all the usual ways
and pop those into a Gmail etc. account.  Then they join that false
identity, with their Gmail address and Gmail password, to LinkedIn.
This means they will will get some folks linking to them (just to "grow
their professional network, and so get a better score of LinkedIn
excellence, which confirms the liveness and gullibility of those folk
and opens up their address to higher priority spamming, not least
sending messages to their email address in a form which looks like it
came from LinkedIn, but actually came from the spammer's system.

I auto filter any message with "linkedin" in the headers into a single
mailbox.  This includes the stuff I might be interested in from the
forum I joined and everything else.

After I joined there seemed to be an upsurge in spam which purported to
be from LinkedIn, but which was clearly spam due to its links to other
sites, inclusion of zip files etc.

Looking at the messages, which were from LinkedIn, which invited me to
link to people I actually "know" (that is we have exchanged emails at
some time) I found it hard to find a class of people who were not
represented.  However, there is a class, with a one exception who I
won't name: I don't recall seeing anyone who I "know" via the Link list!

Nonetheless, LinkedIn does provide some services of value, such as the
forum.  It would be difficult for most businesses to set up a forum they
can control which most people find easy to read and contribute to, in a
manner which is generally free from spam and complex administration.
LinkedIn is one provider of such forums.

  - Robin            http://www.firstpr.com.au