Here's how they do it. Various times Linkedin provides me with a form to "import" my contacts from my gmail account.<p>This dialog looks very similar to the login form to the site. If you use the same password for both sites (I don't), you might be thinking that you're logging in, when in fact you're bringing in everyone in your address book. Not sure, if they then automatically spam everyone on your list or not.<p>Linkedin clearly has crossed over to the dark side since they went public. They keep reducing their free services and pushing harder and harder to try to get you to sign up for "premium" accounts. It's time for an alternative.
“LinkedIn pretends to be that user and downloads the e-mail addresses contained anywhere in that account to LinkedIn’s servers,” they said. “LinkedIn is able to download these addresses without requesting the password for the external e-mail accounts or obtaining users’ consent.”<p>I am so hoping the case goes to trial so we can see the evidence of this presented.
I'm not sure how LinkedIn does it but their "recommendations" are very spooky.<p>I get some really odd ones like the property manager we pay rent to. I've only ever emailed or called him.<p>I presume he gave LinkedIn access to his email contact list but based on the number of these creepy recommendations a lot of people I email with must do it.<p>Even more spooky are the recommendations to connect with people I don't know but have names that match people I do. Anyone know how they do this?
Here's my 2 cents... maybe they'll settle and walk away with some cash. I too would love to see the evidence of this presented.<p>In today's world - individuals' data is the digital goldmine for any company.<p>LinkedIn is a publicly traded company (LNKD), like any publicly traded company their main goal would be profits, plus assets like customer data, etc.<p>This info can be seen in their financial statements: <a href="http://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=LNKD" rel="nofollow">http://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CI...</a><p>Nowadays it's common practice for our digital footprints and identities to be designed/built/directed so that before we can gain access to a company's services, data or content that we would need to read and agree to the terms & conditions and the privacy policies, etc.<p>This info can be seen in LinkedIn's:<p>Terms and Conditions <a href="http://www.linkedin.com/legal/user-agreement?trk=hb_ft_userag" rel="nofollow">http://www.linkedin.com/legal/user-agreement?trk=hb_ft_usera...</a><p>Privacy Policy <a href="http://www.linkedin.com/legal/user-agreement?trk=hb_ft_userag" rel="nofollow">http://www.linkedin.com/legal/user-agreement?trk=hb_ft_usera...</a><p>Cookie Policy <a href="http://www.linkedin.com/legal/cookie-policy?trk=hb_ft_cookie" rel="nofollow">http://www.linkedin.com/legal/cookie-policy?trk=hb_ft_cookie</a><p>What, you mean I'm supposed to read those things? Yes.
Here's what may have happened: when you go to LinkedIn, you regularly get shown a box (inline) inviting you to do something, like endorse people's skills.<p>One of those boxes invites you to "grow your network". It's not all that explicit as a call-to-action, as in the text may just be a slogan. The main focal point of that box is a login & password form, which looks exactly like the regular login form that users get when they want to do something that requires explicit re-authentication.<p>In other words: it's common to have to enter your login/password on LinkedIn, this looks a bit like one of those cases, so users will blindly start typing. If they use the same email/password combo for their email account as for their LinkedIn account, then they've just given LinkedIn access to that email-account.<p>The box itself is quite deliberately misleading. Unlike the regular invitations to load your addressbook, there are no Google or Yahoo logo's, and no explicit descriptions.<p>I don't know whether there is a more explicit request for permission at the next step before it starts sucking in conctacts, I don't dare entering a valid password.<p>If there is a next step that requires explicit confirmation, than this "trap" (which it quite obviously is) is merely annoying and a bit scummy.<p>If there isn't, I think they have a good case, because this is would basically be phishing in reverse.
LinkedIn provided a pop-up window which, in small print, if you had logged in via Google or Facebook, notified users in legal terms that their e-mail contacts could (potentially, under some circumstances) be accessed.<p>Thus, in legal proceedings, the user was entirely informed of the possibility of this situation arising.<p>For future users, this sets a precedent that users are aware of the terms and conditions (as they have always been), and no further accidental leaks of personal information will occur.
Yet another scummy social media spying site I'm happy to have never signed up/used for anything. The vast majority of jobs I've found were idling in the local hack space IRC room with ~300 developers and engineers who dump openings, joint ventures and paid projects there first before the usual channels.
Would be pretty easy to test. Make an account with an email address pointed at a server you own, tail the logs and wait for the inevitable HELO from LinkedIn with the same credentials. Busted.