HN Explorer

Tell HN: Reminder that your LinkedIn profile is fully visible to site members

50 points by ern ↗ HN
I had a bad service experience with a bank employee last week who acted in what can best be described as a slightly deranged way; I was disturbed to receive an email from LinkedIn this week stating that someone from the same bank had searched for me (and presumably viewed my profile anonymously).

I decided to have a look at my profile from that of my spouse (we aren't connections and they don't really use LinkedIn) and I was shocked to see lots of detail fully exposed, despite me setting privacy settings at the maximum.

Unlike Facebook, which has had the ability to lock your profile down for years, LinkedIn still exposes most of your details to potential stalkers. Even Twitter/X has the ability to make your profile private (although who knows how long that will last).

I'm sure most people on HN are aware of this, but if you're in danger of being stalked, and you've locked your socials down, you're still at high risk because your LinkedIn profile is wide open to anyone with an email address who registers on the site.

70 comments

[ 1.8 ms ] story [ 121 ms ] thread
not1ofU
There is an option from linkedin to view your public profile - go to your profile and there is a link labled "Public profile & URL" in the top right corner. I believe it shows a view from perspective of non-logged user, however, the visibility options with in the profile are decent enough (even if they do 'update' from time to time). There are options Public(everyone), linkedin users, your connections, only you. I am no fan of linkedin, but all of these socials "require" (not really, but its good practise) the user to check these things on first setup and periodically just in case of 'updates'.

Although thank you for posting, I never thought to view my profile from a person that I am not connected withs POV.

ern
There's no way to hide your work history, education, recommendations or certifications from any logged-in user.
PennRobotics
I have toggles for all of these things. In fact, you can go more granular and select whether you want current and/or past experience as well as the details or just the summaries.

On the Public Profile settings, this is all under Edit Visibility on the right side.

ern
I have public profile visibility set to off, have had it for years. I'm pretty sure those settings just change how you look to people who are NOT logged in.
ayewo
As you found out, I dont think LinkedIn offers controls to restrict what logged in users can view.

I think they used to, but they slowly removed those privacy-respecting features when they had pressure to grow aggressively (like Facebook).

IIRC, I think it started around when they became a public company and the stock was underperforming.

Nextgrid
Isn't the whole purpose of LinkedIn to show that to potential employers/business connections?

It's kinda like paying for a billboard and then complaining that people actually see the billboard. That's the point.

If people seeing your work history is a security risk for you, don't sign up for LinkedIn to begin with or make up fake details.

NoZebra120vClip
I wonder if a prospective employer views your LI page, sees falsified information, and having made a positive hiring decision based mostly on that, terminates and sues you for misrepresentation.

Is lying on LI akin to lying on your résumé, or is it more like lying on Facebook?

thfuran
>Is lying on LI akin to lying on your résumé

If you've never interacted with the company on linked in, not even remotely.

NoZebra120vClip
Okay so you realize that recruiters and hiring managers use LI all the time, right? That they have paid accounts that can power-search candidates without ever having been sent a résumé or an application, that they can find prospective hires and then reach out to them right away with a connection request or a DM?

So if I've never interacted with 99% of companies and I put some really good whoppers on my profile, and then one of those strangers finds me exactly because of what I put in my LI profile, and then they reach out to me asking for an interview, what's the etiquette on that?

Should I delete/revise the lying liar bullshit immediately? Should I let it ride and tell the HM privately? Should I just let them believe it until I get hired?

I found out about 23 years ago that it's actually not a good idea to lie on social media, even about something trivial. Because you start needing to keep track of how you lied, and who you lied to, to keep the stories straight. And eventually you're the one trapped in a web of lies and everyone says "I told you so."

Why not just fill out your LI profile truthfully in the first place? Is there a downside to that?

ern
There's clearly sufficient demand for them to have settings to lock the profile down from search engines, and non-logged in users. I'd wager that most users who set the privacy settings (heck look at this post) don't realize that random strangers with zero professional interest can see enough detail to cause serious harm if they wanted.
johannes1234321
Well, the question is, whether it's due to demand or to lock-out scrapers and forcing users to register so they can monopolize the data better?
Raed667
There is. You need to go to settings and then privacy. It is a whole bunch of toggles over half a dozen pages but it is all there.
ern
I'd recommend that you actually try that, and then view it with a different logged-in profile. It's all still visible.
mikeyouse
Especially if you pay for LinkedIn - basically gives you God mode to view profiles and meta data.
Raed667
If we're not a connexion, can you see anything on my profile besides name, city, current job?

https://www.linkedin.com/in/xyz-xyz

EDIT: link redacted.

ern
<REDACTED. I think you’ve seen that I provided enough>

It’s all there (I’m trying to not give away too much, we’re not connections, but I can see your education and your work history and your endorsements, let me know if you want more proof).

EDIT: looks like you updated the link. ~Let me know if you want me to delete the info I found.~

Raed667
That is very creepy.

So the privacy settings they have are only valid for not logged in people?

jacquesm
You should definitely file a complaint with the bank, that person is well outside their mandate by stalking you outside of your interaction with the bank. KYC is one thing, stalking your customers prior or after interacting with them is creepy AF.
piker
Maybe get a bit more info before encouraging pitchforks... was it an employee of Bank of America or First-Second Bank of Boise? Most people will likely agree that they get random views all the time. This may be entirely coincidental. The footprint of the bank would provide some context.
ern
Without giving too much away, it's a small bank. My name is not common at all (in fact I'm probably the only person in the world with my first+last name). You wouldn't find me unless you're actively looking.
cryptonym
That person may not have actively searched your name. Recommendation algorithm may find a link in an unexpected way between the two of you. The world is not that big.

That can also be a creep. You cannot know for sure.

kwanbix
How does he know it was that same person?
Raed667
Same thing happened to my girlfriend when she registered at a marathon. A volunteer took note of her name and phone number when she picked her bib and kit.

Then he proceeded to message her on multiple social networks. We reported it to the organizers but we received no follow-up.

breitling
Stalking at a marathon is way too easy.

If you see someone you want to know more about, just look at their bib. Based on the bib number and/or their partial name that's printed, you can check out the results and they give you a full breakdown about their location, age, and full name. You could even get their photos from the race.

Take those details to social media and you'll have a field day.

sixstringtheory
I hate giving out contact info now because of this kind of thing.

Once I verbally told a counter employee my phone number and immediately started receiving dick pics. There were only two other people in the waiting area but it could’ve even been the employee, who knows?

Now I never say it, I’ll write it on paper and take it with me afterwards, but maybe I’ll start saying “I don’t like giving out that info, but if you must have it, I’ll make a trade: I’ll give you mine and you give me yours.”

civilitty
> Now I never say it, I’ll write it on paper and take it with me afterwards, but maybe I’ll start saying “I don’t like giving out that info, but if you must have it, I’ll make a trade: I’ll give you mine and you give me yours.”

That just sounds like a gateway to even more dick pics.

sixstringtheory
I was hoping more for the aha moment where they realize how invasive it is to ask for the information.

Of course this won't matter because the poor counter employee has no control. It's faceless corporations taking this information, the responsibility is too diluted for anyone to turn that ship around.

blueflow
Don't have public profiles (or visibility in general) except when you are able to deal with the stalkers. The problem gets worse the more popular you are.
baking
I'm just going to say it. I have had little difficulty finding all the linkedin profiles for employees in small companies (~100 employees.) Go to the linkedin page for a company and click where it says the number of employees. Click on any employee with a public profile and peruse the "People also viewed" and "People you may know" columns on the right-hand side making sure to click "show more." Keep opening new tabs, rinse and repeat.

For a larger company I once wrote a python script to do the same which helped with avoiding duplication.

If you are stuck trying to find a profile for someone and they have a picture, do a reverse image search with the company and job title and it will usually find them.

I would regard any information you put on LinkedIn as public information no matter what your privacy settings are.

I use a basically new LinkedIn account for my searches.

pevey
I work a lot with startups/small companies, but not necessarily tech savvy ones. They have a hard time understanding at first why they are so targeted with phishing attempts. Often times, leadership comes from big roles at larger companies, and they are anchored in their previous experience at big company. They don't understand why anyone would bother targeting little co.

I try my best to explain why little co is actually a far more ideal target. They are hiring quickly, and unlike at a big company, it is likely that even junior new employees might expect to have some interaction with the CEO. An email supposedly from the CEO at big company would be obvious spam for most employees, but not at a startup. And the information exists to make these targeted emails believable, and IT ALL COMES FROM LINKEDIN.

As soon as a new hire updated their employer to little co on LinkedIn, they would be targeted relentlessly.

leetcrew
ignorant question perhaps, but what makes the CEO of a small company so much juicier a target than a senior manager or director at a large one? both could have access to sensitive info, ability to spend a lot of money before it's noticed, etc.
pevey
At any given level, people in startups tend to have more actual power/authority, with fewer or no processes or procedures already in place to slow them down. This is part of why startups are effective at building/changing things, but it's also a social engineer's dream.
Xcelerate
> I have had little difficulty finding all the linkedin profiles for employees in small companies (~100 employees.) Go to [...]

What does this approach accomplish that the search function doesn't? If I want to see all employees in a company I submit a blank search in the search bar then select the "People" tab, click on "All filters", and then specify the "Current company". From there it seems to list everyone that currently works there.

blensor
I think what the parent post means is that not all actual employees of a company may be listed, but there is a good chance that employees that are listed have some connection to those people anyway
baking
Usually only a portion of the employees have a name and a link, the rest will say "LinkedIn Member" with a picture (if there is one) and a job title and location.
sergiotapia
This is why I use random usernames post tiktok social media, and random profile pictures. I also stopped using Linkedin and keeping it up to date, way too invasive!
dommer
Slightly related. Visible.cx has a free service that reports what an AI would report on your linked in profile.

If anyone is interested in seeing their report sign up: https://www.visible.cx/?r=domini996z

[Full Transparency, that link has my referral id so I can get early access. Drop the query section if you want.]

quest29
if you not using linkedin, hibernate your account. you can reactivate anytime.
_d3Xt3r_
I'm surprised people still use LinkedIn, in spite of knowing how scummy they are. I deleted my account long ago, just prior to the time they got sued for spamming people (and even deleting my account didn't stop the invite spam, so I had to block the domain). But every now and then I stumble upon a LinkedIn profile (when I'm looking up people via a Google search or something) and it's always shocking to see how much info people are sharing willingly - from their profile picture, to their entire work history, all the connections they have - all visible without even needing to login. It's basically Facebook-level of personal detail, minus the drunk and embarrassing photos.

I can understand "normies" using LinkedIn because they don't know any better, but it shocks me that even the so-called privacy conscious and techy people like the ones here on HN are actively supporting such a shitty organization - the same people who wouldn't hesitate to criticize Meta for their privacy violations.

[deleted]
(comment deleted)
dorfsmay
Most potential employers will check your LinkedIn profile before even talking to you.
jehb
In my experience as a hiring manager, I will do a web search. If the LinkedIn result is what I find first that I'm sure is you, I'll click that, but if you have a personal homepage, I'd actually probably rather see that. YMMV, of course.
invalidname
Got lots of jobs and opportunities through there. More than all other channels combined. Without sending out any solicitations or anything. Just posting and having my LinkedIn profile public.

To be fair 96% of the people who contact me aren't relevant. But I still made nice bank on the 4% who were and it just meant answering a message...

dopidopHN
I don’t remember how to find a job without. Do people really use indeed.con and the like ?

Also, this is corporate me. I control every bit of what I wrote there and never actually use the social aspect.

jjav
> I'm surprised people still use LinkedIn, in spite of knowing how scummy they are.

Linkedin is great, at what it's for. As much as I dislike the "you're holding it wrong" argument, if anyone is posting personal information on linkedin and expecting it to be private, they are doing it wrong. That's not the purpose of linkedin.

> the same people who wouldn't hesitate to criticize Meta for their privacy violations

Certainly. The intent of facebook is to post private information about personal life and share it only with friends. Whenever they violate that trust, there's plenty to criticize.

With linkedin the purpose is to post public professional info with the goal of advertising yourself to the world. There's no privacy violation because the goal was to be public.

jmye
What do you think I’m posting on LinkedIn that ought to be private? It’s basically my resume, on a site that allows two-way job searching. I’m unclear why you think “normies”, which should be a highly embarrassing thing to actually say, would use it but “tech” people wouldn’t.

10x engineers who don’t need the networking/recruiter search notwithstanding.

sam0x17
More crucially, HR managers at a lot of startups now have apps that will notify them if you change basically _anything_ on your LinkedIn. I have a friend who took a part-time "CTO" position that was basically a very small startup trying to look better to investors and didn't involve any real work on his part beyond a weekly meeting, who was fired from his main gig _within minutes_ of him adding this line to his LinkedIn.

So yeah, I'm personally all for a LinkedIn replacement that lets the candidate specify broad permissions like "don't show this line to anyone affiliated with X". Heck, I'd even make one if I had the time.

lolinder
That kind of fine-grained permission scheme just gives a false sense of security if signups are open to the public—that HR department would just sign up for another account and avoid linking it to the company.
sam0x17
True, but the problem right now is apps doing this on HR departments' behalf. If you make the site robustly immune to scraping and bots and take active steps to disable such apps (LinkedIn, if anything, probably sees the existence of these apps as a feature that makes businesses like them), you'd see a lot less of this sort of thing in the wild

LinkedIn is business-first, not candidate first, and that's part of the problem.

Like imagine if instead of a global searchable index, you can generate as many unique profiles as you like and give whichever version to whichever company you want and can reasonably expect that only people that company has shown that link to will see it.

Then you can have some anonymized way for businesses to "discover" candidates and they can send a request for a full profile. Heck, if the talent pool is good enough, you could even make _them_ pay to _ask_ the user for a full profile.

If one were to make such a "candidate-first" platform, it would theoretically be a lot easier to get tons of profiles on there, since the scale is tipped in their favor. They (and not businesses) are the majority in this situation, so it's natural that services like this should cater to the real primary user and have businesses foot the bill.

edit: now I want to do it X_X

fakedang
Forget that, what if we could do it for personal profile? There's one inner circle of friends whom I love to spam with shitty jokes or interesting articles, and there's another wider circle where I'm just friendly. Another circle of friends from work, and another circle of friends/acquaintances from my locality.

This is especially a bigger problem for my female friends - almost all of them have their public profiles on all networks private, save for a few of the influencer variety.

I tried exploring this idea, but I figured that it would be extremely difficult to sustain such a network. Not to mention, people are just so locked in to either Tiktok and Instagram (millennial and Gen Z) or Facebook (boomers) or WhatsApp (practically everyone outside the US). It's gonna be hard to migrate people from the incumbents.

pintxo
Did you just describe Googles retired attempt at doing a social network?
sam0x17
Being a FANG sort of removes the "cool" factor that lets a NEW social network really take off imo. Sure they have tons of users and resources so they can actually get off the ground, but then they stagnate, like we're currently seeing with Threads etc.
fakedang
Something like the circles feature, but I think they messed up a lot, by requiring real names tied to an account for instance.
francisofascii
I wonder if this could work in your favor. "Hey, this key individual is updating LinkedIn. Maybe we should consider increasing this person's pay before they leave".
pierat
Not at all surprised.

At my old company, we had a theory that most of our spearphishing was coming from LI. So we tested it.

I had permission to create a completely fake person, fake role, fake experience, etc. And they got a corpo email. It took 2 days from LI profile creation.

After that, our CTO gave out a recommendation to the company to set their current employer to private to prevent spearphishing, and to change it back after leaving the company.

timmb
What does spearfishing mean?
pierat
It's spearphishing, intentional spelling.

And after a very simple 1 word google search: "the fraudulent practice of sending emails ostensibly from a known or trusted sender in order to induce targeted individuals to reveal confidential information"

timmb
Only if you spell it right! I got “Spearfishing is fishing using handheld elongated, sharp-pointed tools such as a spear, gig, or harpoon, to impaling the fish in the body”
HumblyTossed
I love to look at the profiles of my coworkers to see how they describe what they do at work. I don't tend to do a very good job of "selling" myself, so it's pretty enlightening how others do it.
lolinder
That sucks about the bank employee, but I'm surprised that you're surprised that everything is visible. LinkedIn isn't like Facebook or Instagram, where many people would prefer to just interact with people they know—its entire point is to have a public profile that potential employers and recruiters can stumble upon! If you're not interested in that, you probably don't want a LinkedIn profile at all.

Incidentally, this is a large part of why the actual social portion of LinkedIn is so bizarre: everyone is aware that things posted on there are associated with their real name and resume, so it's developed a weird, sanitized, corporate atmosphere.

morkalork
Any company that builds a messaging system then inserts ads into it under the guise of a DM notification is complete trash and has zero respect for its users. Also completely unprofessional from a site that purports itself as a site for professionals.
janosdebugs
Does anyone here derive any value from LI over just sending in a CV? In all my years of having a profile I had never gotten any good job offers. We also ran several experiments among friends on publishing content, got high 5-low 5 digit views and only single or low double digit clickthroughs.
consoomer
I closed mine years ago (self employed, don't need it for jobs, etc).

I reopened it a year ago because potential enterprise customers were sketched out they couldn't find me on LinkedIn (I have a personal site, etc, but they didn't seem to care for that). I guess for them, if it's not on LinkedIn it's not real (what a weird opinion to have).

boringg
I got a job from a cold reach out to a VP at a company but that was 10 years ago before LI got so low quality. My profile probably didn't make a difference -- my guess is that if anything your profile can only disqualify you.
pantsforbirds
I've had pretty good experiences with it. Most of my jobs have come over LinkedIn from recruiters reaching out and my current job (which I really love) came from applying to jobs on LinkedIn.
invalidname
I never send out CVs and haven't in ages. But I get a lot of contacts on LinkedIn with job offers. To be fair, I very rarely take a job offer because I'm so picky (and expensive) but I did get a lot of other opportunities (speaking engagements, writing opportunities etc.).

I might be an outlier though. I wrote a few books and have a big CV with a lot of experience. My kind of background doesn't really fit for most jobs.

leetcrew
I get a lot of cold messages from recruiters inviting me to apply to jobs that are slightly less desirable than my current one. I've never pursued any of these, but I get the impression that are at least serious. nice to have as a backup, I guess?

I also used to get lots of messages from FAANG recruiters, but I never got the impression they would prioritize my application over the general pool.

I mainly use LI as a tool to track where my former coworkers ended up. I find a lot of people that would never bother keeping in touch over email are happy to refer you to their current employer.

consoomer
Once you have kids and meet other parents you will quickly find a whole lot of people you meet are randomly looking you up on LinkedIn...
kwanbix
I don't see any personal information such as address or phone number or even email visible. What information are you referring to?
dorfsmay
LinkedIn is slowly getting worse in order to maximize revenue. A few examples:

- hiding profiles if you're not logged in (I know, for now you can keep reloading)

- preventing you from DM'ing people you are not connected to

- allowing anybody who pays for premium to DM you, even when multiple users have reported that account as a spammer

- literally changing the definition of what spam is to something confusing so that scammers selling "services" to do your work for you and selling overpriced "training" don't match the definition.