I verified my LinkedIn identity. Here's what I handed over

I used to have a LinkedIn account, a long time ago. To register I created an email address that was unique to LinkedIn, and pretty much unguessable ... certainly not amenable to a dictionary attack.

I ended up deciding that I was getting no value from the account, and I heard unpleasant things about the company, so I deleted the account.

Within hours I started to get spam to that unique email address.

It would be interesting to run a semi-controlled experiment to test whether this was a fluke, or if they leaked, sold, or otherwise lost control of my data. But absolutely I will not trust them with anything I want to keep private.

I do not trust LinkedIn to keep my data secure ... I believe they sold it.

I'll note that Persona's CEO responded on LinkedIn [1] pointing out that:

  - No personal data processed is used for AI/model training. Data is exclusively used to confirm your identity.
  - All biometric personal data is deleted immediately after processing.
  - All other personal data processed is automatically deleted within 30 days. Data is retained during this period to help users troubleshoot.
  - The only subprocessors (8) used to verify your identity are: AWS, Confluent, DBT, ElasticSearch, Google Cloud Platform, MongoDB, Sigma Computing, Snowflake

The full list of sub-processors seems to be a catch-all for all the services they provide, which includes background checks, document processing, etc. identity verification being just one of them.

I have I've worked on projects that require legal to get involved and you do end up with documents that sound excessively broad. I can see how one can paint a much grimmer picture from documents than what's happening in reality. It's good to point it out and force clarity out of these types of services.

[1]: https://www.linkedin.com/feed/update/urn:li:activity:7430615...

I really appreciate this write-up.

Was forced to verify to get access to a new account. Like, an interstitial page that forced verification before even basic access.

Brief context for that: was being granted a salesnav licence, but to my work address with no account attached to it. Plus I had an existing salesnav trial underway on main account and didn't want to give access to that work.

So I reluctantly verified with my passport (!) and got access. Then looked at all the privacy settings to try to access what I'd given, but the full export was only sign up date and one other row in a csv. I switched off all the dark pattern ad settings that were default on, then tried to recall the name of the company. Lack of time meant I haven't been able to follow up. I was deeply uncomfortable with the whole process.

So now I've requested my info and deletion via the details in the post, from the work address.

One other concern is if my verified is ever forced to be my main, I'll be screwed for contacts and years of connections. So I'll try to shut it down soon when I'm sure we're done at work. But tbh I don't think the issues will end there either.

Why do these services have to suck so much. Why does money confer such power instead of goodwill, integrity and trust/trustless systems. Things have to change. Or, just stay off the grid. But that shouldn't have to be the choice. Where are the decentralised services. I'm increasingly serious about this.

Somehow the fundamentals of places like linkedin, gmail, google, facebook, etc have eluded people.

1. they are selling you as a target.

2. some people, governments, groups, whatever are willing to pay a lot of money to obtain information about you.

3. why would someone pay good money to target you unless they were going to profit from doing so. are they stupid? no.

4. where does that profit come from? If some one is willing to pay $100 to target you, how are they going to recoup that money?

5. From you.

There is simply no other way this can have worked for this long without this being true.

It is a long causal change, so it is fair to ask whether there is any empirical evidence. If this is true we would expect to see ...? Well how about prices going up? Well how about in general people are less able to afford housing, food, cars, etc.

I'm speculating here, but perhaps it is predictability. There is a common time warp fantasy about being able to go back and guess the future. You go back and bet on a sports game. If I can predict what you are going to do then I can place much more profitable bets.

Do the corporations that participate in this scheme provide mutual economic benefit? Do they contribute to the common wealth or are they parasitical?

No one likes to think they have parasites. But we all do these days.

It seems to me that if you let Persona verify your identity you're essentially providing data enrichment for the US government. In exchange for what? A blue tick from a feeder platform like LinkedIn, Reddit or Discord? No thanks.

On the other hand it can be hard to escape if it's for something that actually matters. Coursera is a customer. You might want your course achievements authenticated. The Canada Media Fund arranges monies for Canadian creators when their work lines up with various government sponsored DEI incentives. If you're in this world you will surely use Persona as required by them. Maybe you're applying for a trading account with Wealthsimple and have to have your ID verified. Or you want to rent a Lime Scooter and have to use them as part of the age verification process.

KYC platforms have a place. But we need legal guarantees around the use of our data. And places like Canada and Europe that are having discussions about digital sovereignty need to prioritize the creation of local alternatives.

Persona do not seem to be competent guardians of such a trove of private information.

https://vmfunc.re/blog/persona

LinkedIn is Tiktokified social media brainrot disguised as serious work. „Hey - you‘re not wasting time, you‘re building your network and gather industry knowledge!“

LinkedIn is full if so called professionals who make a living by leveraging their brand. If you‘re not one of them, leave

From the article:

> Let that sink in. You scanned your European passport for a European professional network, and your data went exclusively to North American companies. Not a single EU-based subprocessor in the chain.

Not sure LinkedIn is a European professional network.

This is the kind of activism in privacy appreciate that we need. I knew I did not want to verify but I did verify on Linkedin recently. The fact that the author also gave an action list if you are concerned about your privacy is just commendable.

Ha. I was reading this and thought "euhhhh, I did not give all of that to verify my account". So I went to LinkedIn to check if I have the shield. I then saw

- that I just have "work email verified" and that there is a Persona thing I was not even aware of

- a post by Brian Krebs at the top of my feed, exactly on that topic: https://www.linkedin.com/posts/bkrebs_if-you-are-thinking-ab...

A good reminder of how things actually work, but the article could use some more balancing…

> Let that sink in. You scanned your European passport for a European professional network, and your data went exclusively to North American companies. Not a single EU-based subprocessor in the chain.

LinkedIn is an American product. The EU has had 20 years to create an equally successful and popular product, which it failed to do. American companies don’t owe your European nationalist ambitions a dime. Use their products at your own discretion.

Of course an American company is subject to American law. And of course an American company will prioritise other local, similar jurisdiction companies. And often times there’s no European option that competes on quality, price, etc to begin with. In other words I don’t see why any of this is somehow uniquely wrong to the OP.

> Here’s what the CLOUD Act does in plain language: it allows US law enforcement to force any US-based company to hand over data, even if that data is stored on a server outside the United States.

European law enforcement agencies have the same powers, which they easily exercise.

I've been getting "Emails aren’t getting through to one of your email addresses. Please update or confirm your email." -- even tho I get messages from them every day. When you press the button to confirm the (working) email it states "Something went wrong".

It happened last week too, I was able to fix it via their chat-help (human). Yesterday, their chat-help (human) was not able fix it and has to open a ticket. I pay for LinkedIn-Premium. So maybe this is just a scam to route me into Verification. Their help documents (https://www.linkedin.com/help/linkedin/answer/a1423367) for verifying emails doesn't match the current user experience.

Then, in a classic tech-paradox, their phone support person told me they would email me -- on the same address their system reports emails are not getting through to. It felt like 1996 levels of understanding.

We need to get back to de-centralised.

Wow that is insane. Persona is even linked to Peter Thiel.

If LinkedIn asks me to verify then I'll just leave. I'd be very happy for it to fall over anyway so there is space for a new more ethical platform. Especially since Microsoft acquired it, all bets are off.

The strange thing about LinkedIn organization verification is that it never seems to be revoked. I have many contacts with verifications from companies they no longer work for - sometimes for a very long time.

On the other hand I see many people posting in official capacity for an organization without verification.

When they actively represent their current company but with a random verification from a previous one it gets pretty absurd.

In its current form LinkedIn verification is pretty worthless as a trust signal.

> If you’ve already verified — like me — here’s what I’d recommend

Did you actually follow through with 1-4 and if so what was the outcome? how long did it take?

So basically 'Their “global network of data partners”' means once you submit that information, it's a free for all.

There's so many angles of grind with this kind of thing that big tech has gradually normalised.

Last year, someone’s experience when LinkedIn required interacting with Persona:

https://news.ycombinator.com/item?id=44435997

I wonder what mongo and snowflake are doing with that data. The table is a little vague.

I was under the impression they just make database products. Do they have a side hustle involving collecting this type of data?

I work in this space for a competitor to Persona, so take my opinion as potentially biased, but I have two points: 1. just because the DPA lists 17 subprocessors, it doesn't mean your data gets sent to all of them. As a company you put all your subprocessors in the DPA, even if you don't use them. We have a long list of subprocessors, but any one individual going through our system is only going to interact with two or three at most. Of course, Persona _could_ be sending your data to all 17 of them, legally, but I'd be surprised if they actually do. 2. the article makes it sound like biometric data is some kind of secret, but especially your _face_ is going to be _everywhere_ on the internet. Who are we kidding here? Why would _that_ be the problem? Your search/click behavior or connection metadata would seem a lot more private to me.

Good write up I guess, but I'm just so tired of all the AI-isms in every damn thing.

"Your European passport is one quiet subpoena away"

Why does the subpoena need to be quiet? If I search my chats with ChatGPT for the word "quiet", I get a ridiculous number of results. "Quietly this, quietly that". It's almost like the new em dash.

There's many others all over this blog post I won't bother calling out.

"Understanding what I actually agreed to took me an entire weekend reading 34 pages of legal documents."

Yeah I'll bet it did. Or it took an hour of back and forth with ChatGPT loaded up with those 34 pages.

I get it, we all use AI, but I'm just so tired of seeing the unmistakable mark of AI language all over every single thing. For some reason it just makes me think "this person is lazy". The CEO of a company my friend works for used Claude to write an important letter to business partners recently and we were all galled at her lack of awareness of how AI-sloppified the thing was. I guess people just don't care anymore.

I am about to talk about "vibes" and "feelings" so please take this with a grain of salt:

Does anyone else get the impression that they feel like the nefarious surveillance state is now real and definitely not for their benefit?

It's been a long running trope of the men in black, and the state listening to your phone calls, etc. Even after Snowdon's leaks, where we learned that there are these massive dragnets scooping up personal information, it didn't feel real. It felt distant and possibly could have been a "probably good thing" that is it was needed to catch "the real bad guys".

It feels different now. Since last year, it feels like the walls are closing in a bit and that now the US is becoming... well, I can't find the words, but it's not good.

How does this work for the myriad banks I've had to prove my identity to in the same way? I'll be attempting steps 1-4 and see what Persona comes back with.

I almost fell for a very sophisticated phishing attack last December and most of the "verifiable" information was from my LinkedIn account.

For each role I had described some of the tasks and accomplishments and this was used in the phishing message.

Since then, I removed my photo, changed my name only to initials and removed all the role-specific information.

It's a bit of a bummer as I'm currently in the process of looking for a new job and unfortunately having a LinkedIn profile is still required in some places, but once I find it, I'll delete my profile.

The deeper issue here is that centralized identity verification creates honeypots. You hand over real identity data to verify yourself, and now that data lives in LinkedIn's systems indefinitely. The alternative direction is zero-knowledge proofs for identity — prove you're a real person without revealing which person. Projects like World ID are going this direction. The irony is that for AI agents, none of this matters: they don't have identities to verify, which is actually a feature.

KYC data is the most dangerous data that can leak right now. If your CC leaks, you will know almost immediately and can revoke it and generally will get your money back. Password leaks can be neutered with 2FA. Medical data leak can perhaps be used in a complex extortion, but generally for most people this data is worthless.

KYC data on the other hand allows third party criminals who have bought your KYC on the black market to perform money laundering in your name (by opening bank accounts) and taking debt in your name. Generally you won't even know this is happening until it's too late and debt collectors come. And it's not like you can revoke your biometrics/liveness check/selfie and who knows if revoking your passport/id card would actually work.

IMO it's much better if a dedicated KYC processor, like Persona, with actual security team/mindset, handles this rather than random website inside their zendesk instance. But there still needs to be extremely strict regulation surrounding this data.

Also while CC data will be getting less dangerous over time due to AI fraud detection and mandated 3DS, KYC data will IMO be getting more dangerous over time because more fintech/govtech will rely on it.

The content is of course 100% true and needs to be repeated over and over, every single day.

The straight-from-LLM writing style is incredibly grating and does a massive disservice to its importance. It really does not take that long to rewrite it a bit.

I hope at least he wrote it on his local Llama instance, else it's truly peak irony.

> Here’s the thing about the DPF: it’s the replacement for Privacy Shield, which the European Court of Justice killed in 2020. The reason? US surveillance laws made it impossible to guarantee European data was safe.

> The DPF exists because the US signed an Executive Order (14086) promising to behave better. But an Executive Order is not a law. It’s a presidential decision. It can be changed or revoked by any future president with a pen stroke.

This understates the reality: the DPF is already dead. Double dead, two separate headshots.

Its validity is based on the existence of a US oversight board and redress mechanism that is required to remain free of executive influence.

1. This board is required to have at least 3 members. It has had 1 member since Trump fired three Democrat members in Jan 2025 (besides a 2-week reinstatement period).

2. Trump's EO 14215 of Feb 2025 has brought (among other agencies) the FTC - which enforces compliance with the DPF - under presidential supervision. This is still in effect.

Of course, everyone that matters knows this, but it doesn't matter, as it was all a bunch of pretend from day 1. Rules for thee but not for me, as always. But what else can we expect in a world where the biggest economy is ruled by a serial rapist.

You can verify yourself using company email address - maybe I am being naive to think that it’s much safer, but it’s way better than handing over your ID data.

I never understand why people supply too much info about themselves for small gains.

People at LinkedIn wants you to believe that your career is safe if you play by their games, but ironically they are one of the main reasons why companies nowadays are comfortable with hiring and firing fast.

Seeing some of my colleagues verify through Persona on LinkedIn, and I can't quite figure out what they're getting out of it.

Every hiring process I've been through already requires proof of identity at some point. Background checks, I-9s, whatever it may be. So you're essentially handing your ID to a third party just to get a badge that doesn't skip any steps you'd have to do anyway.

I hate LinkedIn but need it for a few things, mostly accessing certain clients and projects as a freelancer. Last October my ISP (Vodafone UK) assigned me a datacenter-classified IPv6 address with 80+ abuse reports on reputation databases, for bots, DDoS, crawlers. Before I realized this I started getting locked out, suspended, restricted from just about every web service I use, having to solve captchas for simple Google searches, etc.

I resolved everything except LinkedIn. They required Persona verification to restore access, but I'd already recently verified with Persona, so clicking the re-verification links just returned a Catch-22 "you've already verified with us." LinkedIn support is unreachable unless you're signed into an account. I tried direct emails, webforms, DMs to LinkedIn Help on Twitter, all completely ignored.

Eventually some cooldown timer must have expired, because Persona finally let me re-verify last week. Upon regaining access, I was encouraged me to verify with Persona AGAIN, this time for the verified badge.

I now have a taste of what "digital underclass" means, and look forward to the day when no part of my income depends on horrible platforms that make me desperate for the opportunity to give away my personal data!

Great article, thank you.

Hiding all this very important info (which literally affects the users life) behind an insignificant boring click! Even the most paranoid user will give up in certain use cases, (like with covid 19 which even though didn´t agree, you needed to travel, work making it compulsory). Every company that uses deciving techniques like this should be banned in Europe.

This is a little unnerving because I know I've had to provide similar ID verification somewhere online, but I can't remember where. And based on everything here, it was almost certainly Persona.

I guess I'll just be in the corner crossing my fingers none of it is found in a hostile foreign land or used against me.

Here's what I found the most frightenting:

> Hesitation detection — they tracked whether I paused during the process

> They use uploaded images of identity documents — that’s my passport — to train their AI.

> Persona’s Terms of Service cap their liability at $50 USD.

> They also include mandatory binding arbitration — no court, no jury, no class action.

I don't get the whole idea of treating identity verification as a private enterprise problem. I realize it's easy to just blame LinkedIn or Microsoft here, but the core issue is architectural. We are trying to solve a public utility problem by building private honeypots.

The government should provide an API or interface to validate a user, essentially acting just like an SSO. Instead of forcing users to upload raw passport scans to a third-party data broker, LinkedIn should just hit a government endpoint that returns an anonymized token or a simple boolean confirming "yes, this is a real, unique person." It gives platforms the sybil resistance they need without leaking the underlying PII.

How did they get your MAC address?

This is a good write-up and useful content, but edit-wise it could be simplified significantly. Additionally, phrases like "let that sink in" are characteristic of poor LinkedIn content, which is a bit of an irony :)

>The legal basis? Not consent.

You read and agreed with the terms explicitly stating the data would be used to do those things, and it was not at all necessary for you to do that. What else do you want? It seems like consent isn't the issue. You just don't like what this company does, and still volunteer your data for them to do just that. Now you regret it and write a blog post?

One thing is to be tricked or misled, or for a government to force your face to be scanned and shared with a third party. Another is to have terms explicitly saying this will be done, requiring explicit agreement, and no one forcing you to do it.

Off topic -- the design for that blog is really slick. Added it to my "design swipe file."

Less off topic -- there are some black hat marketers that (I think) buy or create verified profiles with attractive women, then they use the accounts for b2b sales through linkedin DMs. I find that amusing. Neutered corpo bois are apparently big poon hounds. Makes sense when you think about it -- that type of guy is craving female attention and probably does not have the balls to do anything in real life, so a polite DM from a fake linkedin thot would be appealing.

I suddenly had my account locked down unless I provide my government ID, just like https://news.ycombinator.com/item?id=44435997.

Never did LinkedIn state it was Persona carrying out the validation, and in the email they stated the data would be promptly deleted. I'm now learning this is not true; companies removed from LinkedIn store my data for however long they want.

I feel this is solid grounds for a lawsuit, particularly in states such as California.

>Count them. 17 companies. 16 in the United States. 1 in Canada. Zero in the EU.

We regulated innovation out of the market. Why are you surprises that the only companies finding your data valuable are in the US?

LinkedIn is the ultimate intelligence test: if you register, you have lost