LinkedIn is copying the contents of my clipboard on every keystroke

https://twitter.com/doncubed/status/1278757106468806656

by dondonleroy • 6 years ago

928 360 6 years ago

kevsim• 6 years ago

My hunch is these things are more boneheaded than nefarious. Probably looking for URLs to share or something silly like that and just implemented poorly. Obviously not good for the PR, but say sorry and fix the bug. Luckily this shouldn't happen much longer once iOS 14 is properly released.

fsflover• 6 years ago

I wouldn't give the benefit of the doubt to Microsoft...

just-juan-post• 6 years ago

It's intentional and has been happening on other platforms for years.

Give it a few weeks and people will start posting articles about how it happens on PC / Mac platforms too.

skunkworker• 6 years ago

Hanlon’s razor shows up once again.

Though some apps I trust more with how they use the clipboard data or only restrict it to certain types, eg: image data for a photo viewer, urls for a browser, tracking code for a delivery app

lostdog• 6 years ago

A few years ago, linkedin purposefully changed their notification emails to have less information so you're forced to log in and read the notification on their platform. Linkedin is also widely known for when they scraped users contacts and then spammed them.

Call it incompetence if you want, but there's a certain flavor of evil incompetence here.

rkagerer3• 6 years ago

Facebook (including Messenger) does it too.

There might be a thin guise of "security" (i.e. email isn't a secure place to send your top-secret inbound message) but I'm inclined to suspect the main motivation is to drive people back to the platform and drive up their stickiness metrics.

It's user-hostile.

hogFeast• 6 years ago

What I love is Reid Hoffman then going on about that move like he invented the fucking wheel. Like congrats, you stole some e-mail addresses and spammed them...you are now a genius growth expert? Joker.

His book is also staggering insight into how little ability he has an executive and investor (some of the stuff is intern-level mistakes, like maybe juniors who are in their first week and got the job because of daddy...but even then...rare).

victorkab• 6 years ago

I have no dog in this fight, but I was at LinkedIn at the time, on teams that worked closely to this. I can assure you that these changes were not made to force log in. It was a recommendation from the security team.

I know it's Hacker News and it's easy to criticize LinkedIn for shady growth practices and get praise for it. They often deserve it, but assigning malicious/growth intent for every change they make is misguided.

_emacsomancer_• 6 years ago

Microsoft has perfected being both boneheaded and nefarious simultaneously.

thewojo• 6 years ago

Yeah, I tend to agree. There seems like there'd be a ton of noise in clipboard content to actually make use of it.

_bxg17• 6 years ago

Guess I'm never copying and pasting anything sensitive on my phone ever again. Still don't understand why clipboard-sniffing isn't behind a permissions flag.

cryptoz• 6 years ago

I think it's not your phone though in this case, it's the MacBook Pro where the copying is happening

_bxg17• 6 years ago

The screen capture is from an iPad Pro. It's not clear how it was getting the Macbook clipboard; via AirDrop maybe? Really that just makes it even more concerning.

Edit: Apparently it's Just A Thing: https://support.apple.com/guide/mac-help/copy-and-paste-betw...

But you can turn it off by turning off "Handoff", which luckily I already had. Nowhere is it mentioned in the settings UI that this extends to your clipboard.

mcintyre1994• 6 years ago

I’m not sure why they didn’t add a permissions flag for it either to be honest. Most apps are going to stop doing it because of the notifications, and presumably those that continue will make some effort to explain it somewhere so people don’t panic and uninstall their app when they’re told about it. Seems like a permissions flag with the usual app’s explanation of why would work well.

rkagerer3• 6 years ago

Well, once upon a time you trusted the code running on your device.

In Chrome on Android, the flag you want is under Settings | Site Settings | Clipboard | Ask before allowing sites to read text and images from the clipboard, and I think it's on by default.

oblio2• 6 years ago

The question is, does Android itself have that flag?

tomjakubowski2• 6 years ago

Does that setting affect other Android native apps' clipboard access? It wouldn't seem so.

dddddaviddddd• 6 years ago

This would be a great feature for Firefox too! Doesn't look like there's interest though https://bugzilla.mozilla.org/show_bug.cgi?id=1013165

_bxg17• 6 years ago

iOS very early-on took on a model of not trusting the software you install on it, and for good reason. Android and the web followed soon afterward. This is the expectation today. Doubly so given Apple's chest-beating about privacy. This clipboard scandal is unacceptable.

lalos• 6 years ago

Funny how you are promoting Chrome and Android when I've known for a fact that Google Maps has done this since forever because when you open the app immediately if and only if it's an address it suggests whatever is on your clipboard as a destination. This means 1) there's code running somewhere grabbing the clipboard and deciding if it's an address (might ping home) 2) it has to copy the clipboard all the time to do that.

justaguyhere2• 6 years ago

Not a fan of any of the big tech companies, but Apple needs to be applauded for this feature. Can't wait to see how many such behavior is exposed by iOS 14

wackget2• 6 years ago

Or they need to be lambasted for not making it a permission like it should be.

heavyset_go• 6 years ago

iOS isn't free from this kind of snooping[1][2].

[1] "How popular apps can read your phone's clipboard without permission": https://www.mysk.blog/2020/03/10/popular-iphone-and-ipad-app...

[2] "Popular iPhone and iPad Apps Snooping on the Pasteboard": https://www.telegraph.co.uk/technology/2020/03/30/popular-ap...

coronadisaster• 6 years ago

Why should they be applauded if they knew about the problem? notifying you about it is not enough... they need to let you act on it.

pietrovismara• 6 years ago

I would save my claps for people who are really working to improve the world, not for corporations who sometimes accidentally do the right thing while pursuing profit.

ebg135• 6 years ago

Still don't understand why clipboard-sniffing isn't behind a permissions flag.

Screw permissions flags. Clipboard-sniffing is never justified. Moving data out of the clipboard should only ever happen by direct user request via the OS interaction layer.

leephillips8• 6 years ago

This is so obviously, blindingly true that I am amazed it’s even possible for apps to do this.

_bxg17• 6 years ago

I would tend to agree, but a handful of people have a handful of reasons why they like it, and so removing it completely isn't as much of a no-brainer as adding a permission dialog is.

filleduchaos14• 6 years ago

And what, exactly, constitutes "direct user request" that both 1) does not break common programming techniques (e.g. an application rolling its own GUI, or implementing its own modes/keybindings) and 2) is not trivially spoofable by the enterprising developer?

I understand the outrage over apps abusing their access to the clipboard but what I don't understand is the people acting as though the OSes they use on the daily don't have the exact same "flaw".

anticensor3• 6 years ago

TikTok first, then LinkedIn, then what?

cyberbanjo• 6 years ago

I don't feel like they're the first, and I doubt they're the last.

ixvvqktiwl• 6 years ago

I imagine many companies are doing this, only a small number have been caught. Some of them might yank the code before they get caught.

rmrfstar• 6 years ago

If you're a multi-billion dollar company with a "government relations" team, it is better to ask for forgiveness than permission.

If you're a random internet weirdo who uses a public interface in an unexpected way, you face decades in prison. [1]

[1] https://www.wsj.com/articles/SB10001424052748704312104575299...

MathCodeLove• 6 years ago

I'm not going to create an account with the WSJ just to read that article, but from the opening paragraph I don't see how it support your claim. It appears to be talking about something AT&T did?

staller• 6 years ago

If you cannot access the WSJ article, the random internet weirdo has a Wikipedia page that touches on some of it: https://en.wikipedia.org/wiki/Weev

lordofgibbons• 6 years ago

I thought I was safe if I blocked all of the permissions these apps "require" like Contacts on Android.

I'm uninstalling this app from my phone now. This isn't acceptable!

dang• 6 years ago

The TikTok edition:

https://news.ycombinator.com/item?id=23634138

https://news.ycombinator.com/item?id=23691190

asplake• 6 years ago

Does this recurring problem suggest a missing API?

ourcat• 6 years ago

When I saw this video of a lot more apps doing it, I did wonder if it actually might be a commonly used third-party library causing this. It's certainly possible.

https://www.youtube.com/watch?v=pRSWdtoUAjo

shaggyfrog• 6 years ago

Not unless you think PrivacyInvasionFramework should be a thing.

anticensor3• 6 years ago

Make clipboard behave like a channel[+], like GNOME native apps do, additionally require a standard paste command to paste, then this clipboard attack will be impossible to conduct.

[+]:A sample pipe might be a good analogy for this behaviour. You cut or copy the input, send through the sample pipe, and the receiving end unpacks, receiving itself makes the sample disappear for further use. Multiple samples could be sent through the pipe, though the pipe should behave in a LIFO, no sample adding allowed after removal starts, manner if this is desired.

rzzzt• 6 years ago

Alternatively, encrypt the contents of the clipboard at rest.

filleduchaos14• 6 years ago

GNOME is based on X11, which _very_ much grants programmatic access to the clipboard to pretty much any application that asks.

Seriously, has anyone complaining about this actually paid any attention to how clipboards work on their OSes before this?

mcherm• 6 years ago

Yes.

It would all be a lot simpler if browsers and other operating systems just implemented an API call for obtainAllMyPrivateInformation(). That's clearly what developers like LinkedIn (and TicToc, etc.) are looking for.

kmfrk• 6 years ago

LinkedIn has had so many privacy disasters over the years, and it's kinda crazy how we kinda tend to forget most of that eventually. I definitely wouldn't trust them with much of your data.

robmiller2• 6 years ago

One of my hobbies is looking at url strings with GET key/value pairs. Programmers must forget that they're visible to users. LinkedIn has a search workflow that shows "origin=TYPEAHEAD_ESCAPE_HATCH" which I've always found humorous.

thaumasiotes• 6 years ago

Programmers must forget that they're visible to users.

GET parameters aren't usually visible to users; with the deemphasis of the URL bar, you'd have to have an incredibly short URL for that to even be a possbility. Right now I'm looking at

    https://news.ycombinator.com/reply?id=23717577&goto=item%3Fi .......

That's one visible parameter. There's PLENTY OF SPACE for firefox to show the rest of the URL, but it won't; instead, a bunch of icons are unhelpfully crammed into the same horizontal layout.

In the larger sense, where users can see the parameters if they intentionally look for them, despite the fact that they are normally invisible, POST parameters are just as visible.

shostack• 6 years ago

As a marketer, there's valuable competitive info that is sometimes inadvertently included in these around targeting, testing, etc.

pwg• 6 years ago

That's one visible parameter. There's PLENTY OF SPACE for firefox to show the rest of the URL, but it won't; instead, a bunch of icons are unhelpfully crammed into the same horizontal layout.

Right click on the "crammed" icon area, pick "customize", and then you can drag and drop the icons crammed into the space into another bar (or out of the UI entirely if they are icons for things you never use), which should then recover much of the lost space.

NickHoff• 6 years ago

Yeah I noticed that too. If you go to the profile page of someone who has the LinkedIn pro version and hover over the gold "in" symbol next to their name, it links to a URL containing

    upsellOrderOrigin=premium_badge_profile_upsell

leephillips8• 6 years ago

That's pretty funny. It might as well say “sucker”.

SethKinast• 6 years ago

Haha I worked on that flow. It's the escape hatch because we didn't find what you were looking for in the typeahead, so we have to let you escape to the full SERP results page.

robmiller2• 6 years ago

Admittedly, all because I don't want to ding the user that I viewed their profile, but the search results shows enough...

wackget2• 6 years ago

Apple, make clipboard access a permission already.

pezo1919• 6 years ago

Meanwhile as an indie dev I can't sleep because of GDPR... Hah, my shoulder just started ticking. :>

jansan• 6 years ago

All new laws make it harder for indie devs and benefit the megacorps with armies of lawyers.

Nextgrid5• 6 years ago

GDPR is a joke. The spirit of the regulation is good, but nobody is interested in putting any effort into enforcing it.

leephillips8• 6 years ago

Every day I read about another outrage being committed by another garbage app that I do not have and would never install on my phone. Why do people need a LinkedIn app? Even if you think that you need LinkedIn, can’t you access your please-spam-me account through your browser? Isn’t it obvious that every closed-source mystery program that you install increases your attack surface? You wouldn't click on an email attachment from a stranger in Russia, so why install an executable from a company that you already know is unethical?

inetknght3• 6 years ago

Think it's just the app? Hope you don't have your clipboard events enabled in your browser

Edit for those interested:

tl;dr: "asynchronous clipboard API" [0]

Overtly, it's used by shit news sites like WSJ, nytimes, and bloomberg to inject their shit into your clipboard when you copy-paste. A common thing I've noticed is selecting text, copying the text, and then pasting somewhere and seeing a link to the original article instead.

I'm not sure if they're still doing it; there has been several people complaining about this over time [1] [2] [3] [4] [5] [6]. I found this awesome article on the Security StackExchange from 2013 [8].

Also it's not just javascript. You might be forgiven to think that using a command-line interface would spare you. Unfortunately you'd be wrong; mosh, tmux, vi, emacs all support your terminal emulator's clipboard events. [7] [8]

[0] https://www.w3.org/TR/clipboard-apis/

[1]: 4 months ago: https://news.ycombinator.com/item?id=22352674

[2]: 4 months ago: https://news.ycombinator.com/item?id=22446940

[3]: 8 months ago: https://news.ycombinator.com/item?id=21377598

[4]: March 2019: https://news.ycombinator.com/item?id=19384895

[5]: December 2017: https://news.ycombinator.com/item?id=16034854

[6]: September 2015: https://news.ycombinator.com/item?id=10301881

[7]: Three months ago: https://news.ycombinator.com/item?id=22815757

[8] https://security.stackexchange.com/q/39118/47800

leephillips8• 6 years ago

Can you explain this a bit for me here?

methyl• 6 years ago

To read the clipboard, website needs explicit permission to do so, no way to go unnoticed.

Johnjonjoan• 6 years ago

I read something recently that gave the impression browsers didn't allow this and they could only modify the clipboard?

I'm not saying this is true, rather asking if I got the wrong impression.

leephillips8• 6 years ago

Thanks for the details. I agree that it’s obnoxious for sites to interfere with copy. But they still can’t read from the clipboard, which is the topic here. And your [8] seems to be about the user deciding to paste unsafe content — totally different issue, isn’t it?

avs733• 6 years ago

Yeah, but companies are more competent than government and that's what matters

https://news.ycombinator.com/item?id=23716931

right?

dmart• 6 years ago

Perhaps not relevant to LinkedIn specifically, but in general people install these apps because they eventually get fed up with the purposefully crippled mobile website badgering them about it. Ever tried to use Yelp or Reddit's mobile websites? Impossible.

D2187645• 6 years ago

If only there was a app for always on desktop mode.

tomjakubowski2• 6 years ago

I'm a little surprised that iOS content blockers haven't seemed to address nagware.

leephillips8• 6 years ago

Actually, no, I never have. But if I wanted to wallow in these sewers for some reason, and the mobile sites were unusable, I would use my laptop, or just manage to find some way to survive without them. Installing their apps is out of the question.

thesimon• 6 years ago

Ever tried to use Yelp or Reddit's mobile websites? Impossible

The other day I tried to view a subreddit in Safari. It was literally impossible, it was claimed to be only available in the app.

pmontra• 6 years ago

I use my mobile browser to read Reddit threads posted on HN. Not terrible but I don't know in which ways the app is better.

koheripbal• 6 years ago

What I don't understand is why the browsers and OSs aren't preventing this. This is a massive security hole.

An app doesn't need access to the clipboard unless I'm actively pasting to it while it's in focus.

buzzdenver4• 6 years ago

Why does a website or app even need access to the clipboard? I would maybe naively think that the OS could send the characters on the clipboard as if they were typed quickly, end of story.

wool_gather• 6 years ago

You can copy-paste styled text, images, and other kinds of non-plaintext data, so it couldn't be implemented quite that simply.

Nextgrid5• 6 years ago

I wish this wasn't a feature.

Every time I paste something in iOS Mail it will inevitably get pasted as "rich" text where I have to put extra effort to clear that formatting (paste it into a plaintext-only input field, then copy from there).

buzzdenver4• 6 years ago

Agreed, but that still doesn't mean that and app should ever have the query the contents of the clipboard. The OS could send a message to the app with the contents of the clipboard when the user presses CTRL-V.

buildbuildbuild• 6 years ago

Ever copy and paste sensitive data on your laptop? Clear that clipboard before using your iPhone.

Apple's Universal Clipboard may share your clipboard across devices.

_bxg17• 6 years ago

You can disable it by turning off "Handoff" in your iOS settings

runawaybottle• 6 years ago

Let’s just get this one banned from web apis already.

maximente• 6 years ago

hypothesis: "technology" is largely data collection platforms with thin veneers on top (social networking, dating, food delivery, etc)

if you agree with that premise, then it's no surprise that every possible source of data that can be collected upon, will be collected upon.

dredmorbius• 6 years ago

That's a near restatement of Zuboff's Third Law:

Every digital application that can be used for surveillance and control will be used for surveillance and control, irrespective of its originating intention.

Coined in the early 1980s, in The Age of the Smart Machine.

https://en.wikipedia.org/wiki/Shoshana_Zuboff

yalogin• 6 years ago

This is atrocious. LinkedIn isn’t even in for ads.

I wonder if they are using some tracking software and that is doing this. My guess is every tracking software does it.

catalogia3• 6 years ago

LinkedIn is a subsidiary of Microsoft. I know the title of this post is an excerpt from a tweet, not a headline, but I think it's generally appropriate to call out the parent company in cases like this. For instance: "Microsoft's LinkedIn app is copying the contents of my clipboard on every keystroke."

edoceo• 6 years ago

How to discover this kind of activity? Any insight on the technical tools for this discovery?

AnanasAttack• 6 years ago

I always feared sites would do things like this so I clear the clipboard/fill it with garbage after usage

A4ET8a8uTh02• 6 years ago

Very not cool. I am a medium LinkedIn user, but now it is going to be limited strictly to a PC browser, where I have some control. I just uninstalled it from my cell. I got caught in the siren song of convenience.

Now how many other apps do this.

hyko2• 6 years ago

If someone steals your wallet, my advice is don’t let them drive you to the airport.

A4ET8a8uTh02• 6 years ago

I hear you, but I do get some value from LinkedIn ( few prospects, interviews and so on ). In my little corner of the world, it has become defacto online resume. I stand by my initial reaction. I am not sure I am ready to drop it altogether.

harry8• 6 years ago

But the thing is you need to get to the airport and there's no other way without missing your plane and forfeiting money paid for your ticket. Now what?

That's where we are with the market power of the big players. Google, facebook, apple, linkedin etc. Use the competition to linkedin in this space? You lose. The end.

The way we have always dealt with market power abuse in the past is via a combination of breaking up dominant players and regulation. The longer this wild abuse of market power goes on the more likely that this will be done in a bad way with pitchforks rather than a sensible, measured, outcome driven way carefully weighing the competing intrests to get what is best for the wider population in the medium and long term.

Also the fact this is legal at all is another case of everyone in law making, courts and enforcement having their brains fall out of their ears as soon as the words "using computers" are uttered. Do the exact same thing in any business where a computer is not used to do that thing and you are going to jail. It's break and enter. But "using a computer" so it's fine with the laws all no longer applicable.

Topgamer7• 6 years ago

I uninstalled it from my phone years ago when I started getting cold calls, and was told directly they got my information from linkedin (where I never put in my phone number)

hyko2• 6 years ago

Illegal and immoral. How can anyone trust these people with personal data and access to your devices?

We have allowed empires to be built on scummy business practices that are fundamentally user hostile. We are under no obligation to maintain them.

mtgp1000• 6 years ago

The worst is the implicit social shame when you tell people you would prefer to use something like signal or telegram to mitigate risk.

This shit is on literally every platform, it's inescapable, and at this point necessary to participate in society.

Silhouette• 6 years ago

I've actually been reassured by how many of my more thoughtful friends have appeared on Signal (and other less well-known but more trustworthy tools) recently. Sure, lots of people are just using something like Zoom or one of the Facebook-owned privacy invaders, but I get the feeling that with so many more people relying on these tools for both personal and professional reasons because of the virus situation, awareness of the issues is at least in moving-the-needle territory now. It's not much, but it's still progress in the right direction.

alt_f7• 6 years ago

Does anyone remember when Linkedin used to upload your entire phone book, no questions or permissions asked just a few years ago?

That kind of stuff is not beyond them.

DavideNL• 6 years ago

Glad Apple added this feature, it seems to work well as it exposes these issues.

He's typing IN the LinkedIn app though, right? Can apps read the clipboard when running in the background too?

behnamoh2• 6 years ago

Yes they can.

Bedon292• 6 years ago

Discord throws the warning every time you tap on the text box. https://www.reddit.com/r/discordapp/comments/hfcvbu/is_disco... fixed with a single line change. They were trying to determine if the paste button should show up or not.

I am curious what LinkedIn is actually doing with the data. Is it being exfilled somehow? Or is it just doing something in a really dumb way? I don't trust them at all to not be taking the data, but what purpose does it have?

sseneca• 6 years ago

how important is it to have LinkedIn? as somebody just starting their career, I've never really been told to have it but it's as if it's sort of assumed. in general I don't have other social media, and if LinkedIn isn't that important then I'd rather not have it, too.

121789• 6 years ago

I wouldn't say it's necessary, but it has been very valuable for me. I got my previous job through a linkedin posting and I regularly have recruiters reach out for interesting jobs on the platform.

driverdan• 6 years ago

It's nice to have as a resume page. You don't need to use the mobile app or connect with anyone to use it like that.

As a hiring manager it makes looking at work history easier. I can click through to companies I don't recognize to learn more about them. Not having a LinkedIn profile wouldn't be a negative for me, it just makes my life easier.

swiley2• 6 years ago

It’s interesting that GNU/Linux apps don’t seem to have this problem even though there’s limited rather than total curation.

It’s almost like letting the community maintain and control the software results in better user experience.

filleduchaos14• 6 years ago

They do have this _problem_, if you're at all aware of how X11 works.

In fact, Linux literally does not have a built-in system clipboard.

swiley2• 6 years ago

Not this problem. The apps can access the clipboard but almost none of the ones you’ll find in Debian repos are exfiltrating data to a cooperation that way.

These apps have access to everything and don’t abuse that access.

caetris1• 6 years ago

Has anyone replicated the issue described by the Twitter user? It's probably important to verify these kinds of claims before they get upvoted. This looks and feels like disinformation.

DyslexicAtheist3• 6 years ago

why? that is nonsense. they have a history of dark patterns and and are ignorant despite 2 data breaches.

doctoboggan• 6 years ago

You have to imagine the Apple engineers who implemented this new clipboard notification knew this shitstorm was coming.

RandallBrown2• 6 years ago

I'm guessing that's part of the reason they didn't implement a clipboard permission. It would probably have broken a TON of stuff in weird ways.

I expect to see an actual clipboard permission at some point.

DyslexicAtheist3• 6 years ago

a tinfoil hat tip: imagine the shitstorm if Apple would allow proper introspection instead of suing these companies who offer such a service. that storm would be much harder to manage now. if I'd really believe it myself I'd even say controlling the messaging was part of the reason why they sued these companies and instead are providing limited subset of such features themselves.

dewey• 6 years ago

Maybe I'm missing something but a clipboard permission seems to be pretty useless for most apps.

When I want to login I have to paste my password, when I want to paste an email address into a Linkedin chat I need the clipboard.

So everyone would just grant that permission anyway as it makes a lot of apps useless without and they'd just continue their harvesting after that. It would be a very small percentage to selectively enable/disable the clipboard permissions for certain tasks.

jorvi• 6 years ago

Wait what, they show the pop-up, but there is no permission toggle for access?

spideymans• 6 years ago

Part of me wishes they dropped this feature in a random dot release, to give these developers a well deserved public flogging.

Of course, the responsible part of me knows that’s a bad idea. Sigh.

Wowfunhappy5• 6 years ago

tbqh, why would that be a bad idea? It's a minor feature from a technical standpoint.

sneak2• 6 years ago

Now if only they would finally Sherlock Little Snitch for iOS; the amount of spyware embedded in almost every single app in the App Store is astounding. I make a point of knowing about this stuff and even I was flabbergasted the first few times I ran my iPhone via a proxy.

Apple claims that you consented you this when you agreed to the App Store TOS.

faizshah• 6 years ago

Can you share how you did this? I would like to try it.

novok• 6 years ago

There are so-so approximations of it, like the guardian vpn/firewall: https://guardianapp.com/

DyslexicAtheist3• 6 years ago

LinkedIn has a history of acting like a cretin: multiple data breaches, dark patterns where they don't fix their buggy mobile site and just put up a disclaimer "problems with the mobile site - download our app" (just so that they can harvest a wider range of data).

I managed many marketing campaigns on Linkedin over the years and spent thousands each month on the platform as a corporate user. If you think that paying for the service you'd be excluded from their shitty ads and get more granular opt-out features than under a free-subscription model - but nope.

they have literally done nothing to deserve any trust from their users. People still use it because they tell themselves "I might need it one day when I look for a job". That's also wrong - if you're doing it right you build good social connections in the real world because most (if not the only things) you get from LinkedIn is scams.

The only upside where I find LinkedIn useful is for OSINT purposes. It's very easy to find all types of people there and get a rough picture how companies are run (what their employees are working on and what security problems that might imply) and build what the recruiting industry calls talent-maps (competiter analysis) which can be useful in infosec for threat & counter-intel. But it has 0 value for any legitimate purposes (that they advertise the service for).

cheez• 6 years ago

This is true. I've often used it to price services/software once I figure out how big the company is.

slezyr• 6 years ago

they don't fix their buggy mobile site and just put up a disclaimer "problems with the mobile site - download our app"

I would agree with this one most of the time, but even their desktop web is horrible in Firefox. It wouldn't load the pages/header with buttons, wouldn't show new messages from time to time.

Nextgrid5• 6 years ago

Desktop LinkedIn is terrible too, it's absolutely unusable in Safari, lags and stutters constantly and seems to have a memory leak or similar where the page will get even slower (as if it wasn't already slow) proportional with the amount of content you have loaded. It pretty much instantly triggers the "page uses too much energy" warning.

sneak2• 6 years ago

Based on the amount of ads and spyware embedded in modern Windows, I don’t think this problem is exclusive to LinkedIn. It seems to be par for the course for most things Microsoft runs.

_jal• 6 years ago

Ugh, I won't use their phone app, they're way too slimy to live there.

They conveniently forget your mail settings periodically, too, forcing you to opt-out of various garbage again, or to just trash all the mail. They're at least as scummy as FB, if not worse.

My (related) new rule: if your site demands a phone number for an account, I will not create an account on your site.

Moto7451• 6 years ago

I’m not a fan of giving phone numbers out either. When I have to I give one to sites I hold suspect I use a number from the safe fictitious range allowed for use on TV and in movies. It’s like example.org but for phone numbers

https://en.wikipedia.org/wiki/555_(telephone_number)

rxhernandez• 6 years ago

I mean I've definitely been contacted by FAANG companies out of no where and got interviews through that.

throwanem• 6 years ago

Same.

brandall10• 6 years ago

I interviewed with all the FAANGs except Netflix over the last 5 months through internal recruiter contacts on LI.

Probably half the interviews I’ve had over the past decade have come from LI, and I think at least 4 or so jobs (including my last and most recent) started there.

It was largely useless in the aughts for me, but not lately.

herewulf• 6 years ago

I was contacted by Google and interviewed based on my profile page on the crufty, tag soup website of my employer at the time. shrug

MereInterest• 6 years ago

My first interaction with LinkedIn happened when they spammed me using my roommate's name, after getting "permission" through a dark pattern. After such a fantastic first impression, I have no intention of ever using LinkedIn.

gnicholas• 6 years ago

I've recently found that they're really pushing people toward the paid tier. I connected with someone a few weeks ago, and when I look at his contacts, I can only see people who are contacts to him AND other contacts of mine.

Why won't LinkedIn let me see contacts that are 2nd-degree contacts via only him? I have no idea. But this mentor specifically asked me to go through his contacts and look for people I'd like to be introduced to, and I literally can't see a single new person as a result of connecting to him.

Nextgrid5• 6 years ago

You'd think that the paid tier would at least make the platform respect you and not waste your time. But no, LinkedIn will still waste your time with ads and dark patterns all over the place regardless of whether you pay or not.

Wowfunhappy5• 6 years ago

Not LinkedIn; Microsoft.

We should blame the real owner. Maybe they'll pay more attention if these practices become tied to their overall brand.

vosper• 6 years ago

The acquisition was 4 years ago, almost to the day: you're right, it's time to blame the real owner.

lol636363• 6 years ago

LinkedIn had dark patterns on day one. Search posts right here on HackersNews. You will see a lot of shady stuff Linkedin was doing in early 2010s.

rcurry• 6 years ago

I finally gave up - I deleted my existing LinkedIn account and replaced it with one that says “I do not use LinkedIn and will not accept your invites or read any message you send to me. If you’d like to learn more about me or get in touch, please see my personal website at (me).com” I’ve been off social media for years, but for some reason I still maintained a LinkedIn site which never actually delivered any value.

ridgeguy• 6 years ago

I got my current (very well-paid) gig from a cold call from my LinkedIn account. That said, I agree with your view. I feel like taking a shower after each monthly login.

ironman1478• 6 years ago

I've actually gotten my current job and just received an offer from a FAANG due to LinkedIn cold calls. I can't speak to dark patterns, but saying the service has no value is disingenuous.

ianlevesque• 6 years ago

Indeed. In dollar terms it’s provided the most value of any service I’ve ever used.

hijef• 6 years ago

Unfortunately I have to agree. I also had something very similar happen to me. I guess it is a price to pay.

allthecybers• 6 years ago

I also started my FAANG career with someone contacting me on LinkedIn. I hate LinkedIn, but have trouble letting go of being ‘discoverable’ should I need another job.

NalNezumi• 6 years ago

Have to agree to this as well, and add another point of view. I moved country about 1 year ago. Although I speak the language of the destination country I had trouble finding "where to look" for dev(robotics) jobs.

My first job was through recruiter page but my current job I got through a recruiter contacting me on LinkedIn. He even bumped my salary up by 15% from initial offer (because his cut was based on the salary and I also had another offer on the table).

It is a pretty valuable tool for a person moving countries for sure. Although I'm in Asia atm, I even got connected to a startup in SV while I were looking for jobs.

rexarex• 6 years ago

I also have had a lot of luck with LinkedIn. I suppose if you went to Stanford for SE then yeah you already have a good network!

Abishek_Muthian• 6 years ago

When I added phone number for OTP(2FA) couple of years back(No TOTP support then) it got automatically added to my profile and guess what? When mobile number is added to the LinkedIn profile it is made visible to all your contacts. I didn't know it was the case until some random person started messaging me on WhatsApp and told me he saw my number on LinkedIn.

Now, they have support for TOTP apps which we can use without giving LinkedIn our phone number and they claim 'Mobile phone numbers added here won't be displayed on your LinkedIn profile.'; But I'm not willing to test it, not entering my phone number in LinkedIn ever.

NoPicklez• 6 years ago

If you build good relationships with people in the real world this can actually help you on LinkedIn.

I have had many job discussions/offers come through my LinkedIn mailbox from competitor companies.

wanderer2323• 6 years ago

what a one-sided POV. I kept "in touch" with multiple recruiters who "discovered" me via the Linkedin and when the time came I leveraged these connections to land multiple interview loop invites.

It also is a great place to add the colleagues when they or you depart with the same idea to "keep in touch".

blinding-streak• 6 years ago

Sunlight is the best disinfectant.

The more people see this user-hostile practice in action, the faster we'll be rid of it.

ericd• 6 years ago

Their UX dark patterns are incredibly scummy, but I’ve actually found it really useful for quickly reaching the right person for biz dev deals/partnerships.

cookiengineer2• 6 years ago

We were trying to recruit via LinkedIn for our startup but soon realized what a shitty business model LinkedIn has.

We had to pay around ~5,00EUR for each and every click on "Apply" to our job posting, which doesn't mean they even filled out the form.

And now, where LinkedIn is full of Indian scammers (not meant in a racist way, but it is definitely perceived that way) we had costs for a "Local Area" limited job posting for hundreds of people from India because they seem to use LinkedIn via proxy.

When we had costs of over 2800EUR for an ad that was displayed less than 8 days, where literally 100% of people were not even from Europe, we decided to fuck this shit and move on to other platforms.

LinkedIn is absolutely useless. Use University job sites, local meetups (during non COVID times, of course), or open source projects to identify devs that actually care about code.

Also, stackoverflow talents is useless. Their "special startup package" of getting access to the platform for 2500EUR is only for one user, limited per email and phone number, not allowed to login in parallel. Every job posting costs additional 400EUR even if nobody applies for it.

You get nothing, as over 90% of people we have actively talked to are not even looking for a job and never clicked that on any stackexchange platform.

I didn't realize how fucked recruiting is. Srsly, somebody needs to fix this.

flir• 6 years ago

Srsly, somebody needs to fix this

I've lost count of the number of devs I've spoken to, over multiple decades, who are convinced recruitment is ripe for disruption. I'm sure everyone else has the same experience.

And yet, recruitment's still here, more or less unchanged. At this point I'm pretty sure recruitment has always been terrible, and will always be terrible. There's some perverse incentive buried deep in the process that can't be shaken out. Or something.

brtkdotse2• 6 years ago

Same experience here. Wanted to expand my business and posted a LinkedIn job ad. After a week I had spent 200€ and received a bunch of people outside of Stockholm, which I specified as the location. I also received a few job applications from school teachers, car salesmen and county clerks - for a senior dev position.

StreamBright• 6 years ago

Sounds like a great opportunity to build a website for job seekers and companies with a more rational business model.

OJFord3• 6 years ago

full of Indian scammers (not meant in a racist way, but it is definitely perceived that way)

(I'm not Indian but) the non-racist way to say that is 'full of scammers', since the scammers' nationality has nothing to do with your distaste for their behaviour.

yvrev• 6 years ago

"I might need it one day when I look for a job" is not accurate at all for me, it finds jobs for me without me even having to interact with it beyond messaging recruiters back if I'm interested. I wouldn't be at my current employment if not for a recruiter finding me on Linkedin.

lmilcin• 6 years ago

I got my current job that I am happy with through LinkedIn.

I might dislike the platform but it helps me keep contact with my past coworkers and keeps valuable offers come to me for basically no cost.

This is likely why LinkedIn thinks they can be shitty to their users, because their users are motivated to stay.

Traubenfuchs• 6 years ago

Half assed mobile sites for "big providers" is a growing issue. It can also be observed with reddit. Web technologies are at a point where apps often times don't increase the user experience for technical reasons, so companies deliberately castrate their online offers.

jmakov• 6 years ago

So... I can just create an app and take all your private data?

behnamoh2• 6 years ago

Not all; unfortunately you can't access previously stored data.

giarc2• 6 years ago

LinkedIn is actually copying the clipboard while that user types in a different app.

https://twitter.com/DonCubed/status/1278757201310388225

omnipugent• 6 years ago

Reddit is now being implicated for doing the same.

erk__• 6 years ago

I beleive that is actually not what is happening, Discord would show the same, but the reason it happend for them was that they were checking for null value to see if there was a image in the clipbord instead of using a boolean which also is there. https://twitter.com/lolpython/status/1276235830692941829

ob• 6 years ago

No, that is the LinkedIn app. It's the messaging dialog (you can see their custom "send" button at the lower right corner).

giarc2• 6 years ago

I might have linked the wrong tweet, but the user says "Here is LinkedIn copying and pasting from my notes app “Bear”"

flattone• 6 years ago

I deleted linked in. I wish i still had the 'connections' and their kind words about my work. Beyond that it hs mever done anything for me. Well with the exception of fooling me into trying to use it and it never being useful

Looking forward to msft/linkedin employess minusing me into oblivion haha

zimpenfish• 6 years ago

I deleted it years ago but then had to reactivate it because job searching was proving difficult without those contacts. Soon as I've got enough "real"* Go mileage under my belt, I'll delete it again.

* Remember kids, experience only counts if you've done it for realsies at a job, never mind how long you've actually done it.

miguelmota• 6 years ago

Anyone know if the data is going directly to their servers or the reason they're doing this on every keystroke?

jmann99999• 6 years ago

Microsoft Teams does this in the chat box for every keystroke. It says "Pasting from device" on each press. I filed a RADAR with Apple before the TikTok report but now I feel stupid.

Apple is doing the right thing. These other companies appear to have the issue.

nabakin• 6 years ago

Could this be a bot detection feature? If a user types something instantly or pastes a whole comment, good chance it's a bot.

crazygringo• 6 years ago

I've used plenty of software before that offers to do something based on clipboard contents, often when there isn't even anywhere to paste.

E.g. a phone dialer app that asks if you want to dial the number in the clipboard when you start it, an image editor that asks if I want to create a new image size the dimensions of the clipboard, a torrenting program that when I choose to import a torrent automatically grabs it from the clipboard before I even get the choice to pick another option (though I still can).

I would be very surprised if this wasn't originally part of something like that, and maybe the feature was removed but the detection function wasn't.

Because if we put down our pitchforks for a second, LinkedIn is owned by Microsoft, which also owns a major browser and the world's most popular operating system. Microsoft sure as hell doesn't need to sniff your clipboard in LinkedIn, if it wanted to do something for nefarious purposes.

Never attribute to malice that which is adequately explained by stupidity.

koolba• 6 years ago

Because if we put down our pitchforks for a second, LinkedIn is owned by Microsoft, which also owns a major browser and the world's most popular operating system. Microsoft sure as hell doesn't need to sniff your clipboard in LinkedIn, if it wanted to do something for nefarious purposes.

The original report is a combination of iOS and MacOS so Microsoft does not have any kernel level leverage.

I don’t doubt it’s not malicious. More likely a holdover from an older or related feature.

The real story here is how easy it’s been for apps to spy on your clipboard. Seeing it in something by a large company like Microsoft just adds to the sensationalism. The TikTok version of this story is the real deal.

decko• 6 years ago

This is exactly it. I have seen app developers who were "caught" by this use the same explanation. There is a new API that can be used instead that does not trigger the notification (and does not disclose the clipboard content)

catalogia3• 6 years ago

Negligence from a trillion dollar corporation is a form of malice. They have the money to audit their products for quality and privacy issues. Instead they choose to not give a shit unless the media calls them out (and sometimes not even then.)

XenophileJKO• 6 years ago

I feel like many of the people that has this opinion never worked at a big company in a big code base. It's probably a poorly coded feature from an intern that was left in because it had some value but operated in a way it shouldn't. Nobody is ever going to touch it until something like this happens. Then someone will go. "Oh shit we better fix this. Tell the product manager feature x is delayed so we can fix this shit storm."

Mary-Jane• 6 years ago

"Never attribute to malice that which is adequately explained by stupidity.”

This.

DaniloDias• 6 years ago

How's your long July 4th weekend going, linkedin/microsoft?

blackrock• 6 years ago

Wasn’t the same thing reported just 2 days ago about TikTok?

And people immediately jumped to the conclusion that TikTok is some evil company, controlled by the evil China government?

But yet, here, people are giving the benefit of the doubt, that LinkedIn just made some boneheaded decision without thinking things through.

perl4ever• 6 years ago

I am sure it is true that some people think TikTok is evil, and some people are hesitant to assume the worst about LinkedIn.

On a close reading, I don't think you have actually asserted that any person is biased or inconsistent...despite your tone that the climate is biased.

What are you really saying?

Havoc• 6 years ago

And linkedin is probably installed on a hell of a lot of corporate phones...

foxfired• 6 years ago

One little weird trick I found is to use the browser for websites.

All the limitations I found on web pages that asks me to download the app are artificial. What is reddit doing that requires an app? What is facebook doing that requires an app? There is even less reasons now to use the YouTube app.

stjohnswarts• 6 years ago

can't use reddit enhancement suite on mobile browser. however linkedin, amazon, twitter, etc all work well enough on mobile browser.

kreetx• 6 years ago

Can't speak for others, but LinkedIn's web is annoyingly slow on mobile.

sgc5• 6 years ago

You can use res in FF mobile.

fredfjohnsen• 6 years ago

What does the venn diagram look like for [set of people who are crying about LinkedIn app] & [set of people glad about the GitHub acquisition] ???

beervirus• 6 years ago

LinkedIn is a website. It works just fine as a website. Why would anyone install it as an app?

factchecker01• 6 years ago

Could it be the apple clipboard.

chrysoprace• 6 years ago

The potential of this sort of malicious behaviour always makes me nervous when I have to copy a password from password managers (generally I'll rely on Autofill, but when Autofill fails I have to copy my 128+ character passwords).

daniel_iversen• 6 years ago

Could they be doing this as a way to detect scrapers? I think Linkedin has always been a hot target for smart sales tools to scrape for information.

fovc• 6 years ago

This is apparently coming from an open-sourced component called Hakawai.

Somebody had to scramble to remove the clipboard code ASAP: https://github.com/linkedin/Hakawai/commit/fa7e8497040f5c36e...

Edit: Don't do mobile, but seems like it was a hack to distinguish between text that was pasted and text added by autocorrect

jml7c5• 6 years ago

As I understand, it is closed-source code causing the problem described. Erran Berger linked to that Hakawai commit as an example of a different, open-source project under the LinkedIn umbrella that has the same problem.

spicymaki• 6 years ago

After LinkedIn took the contents of my Contacts and uploaded it. I swore I would never install it to another mobile device again.

isignal• 6 years ago

An explanation from LinkedIn:

https://twitter.com/eberger45/status/1278843576638570496

------ Hi @DonCubed . Appreciate you raising this. We've traced this to a code path that only does an equality check between the clipboard contents and the currently typed content in a text box. We don't store or transmit the clipboard contents.

----------

An example of this is in a library we have open sourced, and you can find the fix here [https://github.com/linkedin/Hakawai/ (https://github.com/linkedin/Hakawai/pull/161/files/3881de368...). We will follow up once the fix is live in our app.

-----------

fingerlocks4• 6 years ago

This should be higher, above all of the mobs teething for vengeance. It’s an innocuous comparison of text input to the pasteboard to prevent unwanted autocorrect insertions.[0] Probably the same code used by TikTok too.

the code and and comments are here: [0] https://github.com/linkedin/Hakawai/pull/162/commits/c3f8958...

erikrothoff• 6 years ago

Seeing the mob mentality surrounding this is honestly scary. All the top voted comments have pretty much decided that this is used for nefarious purposes, with absolutely zero evidence. Same goes for TikTok and the DDG favicon saga from yesterday. Whatever happened to Occam’s (edit: Meant Hanlon's) razor?

Lio2• 6 years ago

LinkedIn (Microsoft) is a company that previously used man-in-the-middle techniques to move people's private emails to its servers.[1]

People no longer give them the benefit of that doubt because of the reputational damage these previous violations have caused.

They should stop making "innocent" mistakes with other people's privacy and deal with this more professionally at the highest levels.

If they don't people will continue to jump to the conclusion that this sort of activity resembles criminal behaviour.

[1] http://www.pcwelt.de/news/LinkedIn_liest_Ihre_E-Mails_mit-In...

fit2rule• 6 years ago

Just, no. There is NO possible excuse for accessing my private clipboard buffer without my involvement - as a result of a direct action I have overtly initiated.

yread• 6 years ago

So we should turn our pitchforks on Apple who designed textbox component that needs hacks for autocomplete AND not tested updates with apps to notice this spammy useless notification.

stunt2• 6 years ago

Many other apps are doing this as well. At this point, I think anyone that uses this technique should be very transparent about this and explain it to users or just remove this feature. Otherwise, it's too late when a tweetstorm is out.

Grustaf• 6 years ago

Why would they do this check all the time, rather than just at the moment the text box contents changes?

genoapol• 6 years ago

New fingerprinting technique or clipboard data used to expand a user's shadow profile?

NumberCruncher• 6 years ago

An example of this is in a library we have open sourced, and you can find the fix here

This reads for me like:

As an example of this I go to the shooting range every Friday, just for fun, as you can see it on this picture I published on FB, that's why I didn't shoot my neighbour.

He may be right, but that's not an evidence. And we are talking about a company acting like a con man since ages.

stunt2• 6 years ago

He may be right, but that's not an evidence. And we are talking about a company acting like a con man since ages.

I don't have any reason to not believe their explanation. And I don't think my clipboard is useful to them for anything else. Many other apps are doing it as well and a few of them gave the same explanation.

But, that doesn't mean that copying clipboard is a good idea. I don't like any app to copy my clipboard. I also don't like it that apps/companies don't respect any boundaries unless it's forced/blocked by the OS. They just try too hard to reach where they don't need to reach.

If there wasn't enough restriction from the OS, surely someone has already came up with a "creative" idea to detect spammers using front camera or reading device storage and a lot of apps were using it. I don't like it that companies aren't sensitive about user rights and what users feel about what they are doing.

bobthechef• 6 years ago

Such explanations are not reassuring. The problem for me isn't whether LinkedIn is actually using the clipboard, it's the very fact that they have access to it and can do that in principle. Why do apps even have unrestricted access to the clipboard? Do we give apps unrestricted access to cookies? No.

scarface74• 6 years ago

Actually we do. Any app that uses the in process embedded web view on iOS has access to anything that you enter on the website including passwords and they have access to cookies. You might expect that from Chrome but what about your RSS news reader?

My preferred news reader Feedly uses the out of process embedded WebView so its a moot point.

dpratt• 6 years ago

I’m going to stop referring to these apps as copying the clipboard, and use the proper and accurate terminology: ‘keylogger’

palo3• 6 years ago

Why do all these social sites do things like this? They know that someone is going to find out eventually. I guess they just don't care if they get caught.

rammy1234• 6 years ago

why are you surprised ? Did you pay for the service in the first place ? Then everything you do in their site is valuable. You are the product

mathattack• 6 years ago

This is strange given how sanctimonious Weiner was about caring for people. Maybe the focus on data theft and advertising of why they haven’t improved the product in a decade.

est2• 6 years ago

This is precisely how Chinese authorities track down activists using apps without Location data, it was disclosured few weeks ago.

They patiently read user's clipboard data and wait for a picture taken and copied to clipboard, then extract its EXIF geoloc tags and send the coordinates to the police.

ohnope• 6 years ago

Mind linking to a news source for this? Curious to read more about it.

est2• 6 years ago

I tried but it was lost in my twitter feed.

Damn those non-chronological timelines.

elktea• 6 years ago

Does anyone know if there's a firefox extension to show when a site reads your clipboard?

zelphirkalt• 6 years ago

Considering the abysmal performance of the LinkedIn website and the fact that sometImes it seems to get stuck in some race condition, causing 100% CPU load, my guess is, that they do a lot of other shenanigans, not only every keystroke, but every millisecond. That, or I guess they are farming bitcoins on my machine sometimes. Not sure which one it is.

I try to visit it as little as possible.

smabie• 6 years ago

Can Unix pipes be implemented using a clipboard? Are there any apps that explore this? Every app is so self contained on mobile that they all become useless for all but the most trivial or planned for task.

thdrdt2• 6 years ago

When you install software from JetBrains and have the registration key on your clipboard it will autofill it into the key input field.

There are so many programs using this that it all boils down to trust.

Personally I don't trust LinkedIn so I keep away from them. But in this case they still might have a valid reason for this.

The fix: be more transparent about why the app is doing it. And the browser/OS could show a popup every time an app reads the clipboard to make the user aware of this.

chillfox2• 6 years ago

The OS really shouldn't grant apps access to the clipboard until release by the user in my opinion.

thdrdt2• 6 years ago

Well the moment you allow access because you think the app has good intentions it can misuse it later.

Maybe the popup should not show when the user presses 'paste'. But I believe awareness is the first step.

queuep• 6 years ago

Apple has it's 'rigorous' app approval process, why is this not found in there? I've gotten rejected for all kinds of stuff. But I guess they are not doing any quality checks on the apps during this approval process?

Here I've justified the $100 yearly developer fees in that they have this rigorous checks, but apparently they're not really checking the apps?

This is apple failing us, nothing else.

saos• 6 years ago

When I learnt Tik Tok was doing this I immediately said to myself that LinkedIn is 1000% doing this too. They are awfully sneaky

amelius• 6 years ago

Wait, is it possible to read the clipboard without an explicit paste action by the user?

Sounds like the OS is the root problem here.

greggman3• 6 years ago

I'm glad iOS14 is showing this but IMO it's the wrong solution. I know this is easier said than done but basically the OS should make it impossible for an app to read the clipboard unless the user chooses "PASTE". I have no idea how that would work on iOS. It can work pretty well in the browser. I'm not saying the browser is doing this well, but it is possible for the browser to be made so only a browser level paste gives the current page/iframe the contents of the clipboard so you know the user specifically wanted whatever is in the clipboard passed to that page/app.

bipson• 6 years ago

Even after all explanations and presented use-cases, I fail to understand how full reading access to a users clipboard by random third-party apps was ever considered a good idea - from apps in the background nonetheless! Only in a world were I, the device manufacturer, write all apps exclusively, maybe.

The moment I draft such a feature my head turns red from all the alarm-bells going off. I sincerely fail to follow the though process here.

K0nserv2• 6 years ago

I spent some time today looking at the apps that have been reported to read clipboard data. Details here[0] and here[1].

0: https://twitter.com/K0nserv/status/1279041484688424960

1: https://twitter.com/K0nserv/status/1279015057939148801

jakeogh• 6 years ago

Deliberate problem. Any JS can do it. Fix the browser.

LinkedIn is copying the contents of my clipboard on every keystroke

Related Stories