One of the other subtle things they do with metadata is their fascination with IP addresses.<p>Intro will enable LinkedIn to have the IP address of all of your staff using it, and thus (from corp Wifi, home locations of staff, popular places your staff go) they will know which IP addresses relate to your staff members (or you individually if you are the only person on a given IP).<p>This means that even without logging onto LinkedIn, if you view a page on their site they can then create that "so and so viewed your profile", which is what they're selling to other users as the upgrade package to LinkedIn.<p>Worse than that, as a company you can pay to have LinkedIn data available when you process your log files, and from that you know which companies viewed your site. And that isn't based on vague ideas of which IPs belong to a company according to public registrar info, this is quality data as the people who visited from an IP told LinkedIn who they were.<p>Think of that when you're doing competitor analysis, or involved in any legal case and researching the web site of the other party.<p>And VPNs won't help you here, as you'd still be strongly identified on your device and leaking your IP address all the time.<p>There are so many reasons why this LinkedIn feature needs to die a very visible and public death, and very few about why it should survive. It's a neat hack for sure, but then so were most pop-up and pop-under adverts and the neatness of overcoming the "impossible" is no reason this should survive.
Giving away email credentials to a third party service, regardless of reason, should be both covered in your internal training materials, as well as be maintained as a firing offense.<p>This is really just a case of well-branded spearphishing. You should already be protecting against that.
Seems like Linkedin have posted an update on <a href="http://engineering.linkedin.com/mobile/linkedin-intro-doing-impossible-ios" rel="nofollow">http://engineering.linkedin.com/mobile/linkedin-intro-doing-...</a>:<p>Update, 10/24/13<p>We wanted to provide additional information about how LinkedIn Intro works, so that we can address some of the questions that have been raised. There are some points that we want to reinforce in order to make sure members understand how this product works:<p>- You have to opt-in and install Intro before you see LinkedIn profiles in any email.
- Usernames, passwords, OAuth tokens, and email contents are not permanently stored anywhere inside LinkedIn data centers. Instead, these are stored on your iPhone.
- Once you install Intro, a new Mail account is created on your iPhone. Only the email in this new Intro Mail account goes via LinkedIn; other Mail accounts are not affected in any way.
- All communication from the Mail app to the LinkedIn Intro servers is fully encrypted. Likewise, all communication from the LinkedIn Intro servers to your email provider (e.g. Gmail or Yahoo! Mail) is fully encrypted.
- Your emails are only accessed when the Mail app is retrieving emails from your email provider. LinkedIn servers automatically look up the "From" email address, so that Intro can then be inserted into the email.
Are Linkedin still working out of Mom's garage? Do they not have a single person on staff capable of looking at the current environment regarding internet privacy and say, "Uh, guys...maybe put this one on ice for a year..?"
This is ridiculous. LinkedIn is offering a feature, optionally, to users who chose to install it. They have been upfront about how it works. If you don't like how it works, don't use it. Problem solved, myopic holier-than-thou rant avoided.
> 1. Attorney-client privilege.<p>Really? I guess you better have your own SMTP server set up then, or hope your email provider is willing to go to bat for your rights...<p>> 8. If I were the NSA…<p>Yeah, it sounds like they definitely have needed it so far...<p>5 other of the things are basically the same point, remade in 5 different ways. This is a really weak list. There are certainly concerns, but most of these problems are symptomatic of our email system as it is. And have we all forgotten how crazy everyone went when we found out google was going to start advertising in Gmail?
I wonder if they called it "intro" to make it impossible to google for so that no one can ever figure out what they're agreeing to when they install it.<p>What does the sig it appends look like? I will have to make sure to never send email to anyone who has the tell-tale "I opt into spyware" flag.
Nicely stated, what I didn't see mentioned was the iframe it introduces into the mail. It can use this iframe to collect all kinds of additional data about you.<p>In the first instance I thought this was an app that was running in the background on your phone, I would have called that <i>doing the impossible</i>. This is just a MITM, and not a very good one at that.
I'm not saying 1 bad turn deserves another, but this is no worse than what any company operating at scale does when they serve https through a gateway service (Scrubbers, CDN, whatever).
This idea is such a disaster I don't even know how it was allowed to see the light of day. The sad fact is that there are untold numbers of people who will install this monstrosity.<p>Serious questions though, if you are an IT shop - how do you defend against this trojan horse app?
Related: <a href="https://news.ycombinator.com/item?id=6430893" rel="nofollow">https://news.ycombinator.com/item?id=6430893</a><p>"LinkedIn Founder says 'all of these privacy concerns tend to be old people issues.'"<p>The bit about privacy starts at the 13 minute mark.
I desperately want to delete LinkedIn, but I am also looking for my first developer jobs in the tech field. In my former field, no one would ever ask for your LI profile. You send a resume, link to a resume, whatever. In the tech field, every single company I've interviewed with so far has looked at my linkedin profile before our interview and specifically requested it. Until the field changes, or I have a stronger status as a developer, I feel I have to be there or get overlooked for someone who is there.
In other news, e-mail is an insecure protocol and most people transmit in the clear and don't have their own e-mail infrastructure anyway.<p>It's interesting this "blog post" came from a professional security company who makes it money from scaring individuals and companies about security threats.<p>Is it just me, or is this firm even worse than LinkedIn?
Well lets take these one-by-one:<p>-------------<p>1. Attorney-client privilege.<p>I'm guessing most law firms use third party email servers, anti-virus, anti-spam and archive/audit systems which this would also apply to. It would also apply if you're using Raportive, Xobni or the like (or integrated time-tracking, billing, crm, etc.).<p>-------------<p>2. By default, LinkedIn changes the content of your emails.<p>Irrelevant. Unless you read your emails in plain text every modern email client changes how email is displayed.<p>-------------<p>3. Intro breaks secure email.<p>Yes. Except iOS mail doesn't support crypto signatures anyway.<p>-------------<p>4. LinkedIn got owned.<p>Yes. LinkedIn adds an extra point of vulnerability.<p>-------------<p>5. LinkedIn is storing your email communications.<p>Well metatdata but yes.<p>-------------<p>7. It’s probably a gross violation of your company’s security policy.<p>Yes. As is using Linkedin itself. Or Dropbox. Or Github. Or Evernote. Or Chrome. Or any enterprise software that uses the bottom up approach.<p>-------------<p>8. If I were the NSA…<p>The NSA has access to your emails if they want them anyway. Email isn't a secure protocol against a well funded adversary.<p>-------------<p>9. It’s not what they say, but what they don’t say<p>This looks like a semantic dispute, but it doesn't look any more vague than say Google's privacy policy. Companies in certain circumstances are legally required to provide access to information.<p>-------------<p>10. Too many secrets<p>These all seem to be questions that can either be answered by testing or ones that LinkedIn would probably be happy to disclose, but unlikely to be major issues to mainstream users.<p>-------------<p>So fundamentally it comes down to two points, granting Linkedin access to your email creates a new point of attack and Linkedin themselves might use your email in ways you find undesirable.<p>So it's essentially a trade-off for the benefits you get from the app versus those risks. For a personal account which you use for private emails, personal banking, etc. the evaluation is obviously going to be very much different from say a salesperson's work account which they use for managing communication with leads.<p>In the later case they may already be trusting LinkedIn with similar confidential information and already use multiple services (analytics, crm, etc.) that hook into their email so the additional relative risk might be smaller.<p>As people with technical expertise we shouldn't use scare-mongering to push our personal viewpoints upon those with less expertise, but rather help people understand the security/benefit trade-offs that they're making so they can decide for themselves whether to take those risks.<p>It's important to treat the wider non-technical community with respect and as adults capable of making their own judgements and not as kids who need to be scared into safety.
The thing that I find interesting is if LinkedIn goes ahead and does this, how many other companies will want to join the bandwagon and then we'll end up with our email being bounced around through a slew of different proxies so everyone can add their spam and ads to it.
seriously? this is what Intro is? how is it not a bigger deal?people get upset over the littlest Facebook changes, but something this big barely shows up?
I'm still not able to believe if I read that right. Does LinkedIn <i>really</i> re-routes your emails to their servers in their entirety? I looked at their announcement and video at <a href="http://blog.linkedin.com/2013/10/23/announcing-linkedin-intro/" rel="nofollow">http://blog.linkedin.com/2013/10/23/announcing-linkedin-intr...</a>. There is NOT even a hint of disclosure that they are doing this. I can imagine 10 ways to achieve the similar user experience without re-routing entire emails. So if this is true, LinkedIn really really fundamentally screwed up with customer trust.
I just can't fathom how something so ridiculous could pass so many engineers at LinkedIn, without raising flags on how bad this is. The moment I saw the word "proxy" I cringed!
I wonder how's Rapportive doing this days. That is, whether this plug-in seats in people's GMail app and sends out data to LinkedIn or not.<p>After all, we are talking about the same team more or less, and surely the same company who owns Rapportive today.<p>If my concerns are real. One might find this is ironic that Rapportive was backed by YC and Paul Buchheit, the creator of Gmail, and now this very company violating GMail users' privacy.
> Intro breaks secure mail.<p>If it's modifying the message, it likely breaks DKIM too. meaning your messages will be more likely to be flagged as spam.<p>More generally, this is the catalyst for me leaving LinkedIn. They've never generated any new business (not even a single lead), and if I'm honest the only reason I use it is more about my ego than anything useful.
That shows that no engineer has any say in what linkedin does. I can't imagine any tech security aware individual would take such responsibility upon himself.<p>How did the C-people even found out such thing is possible? Some intern who just found out how mail works probably was flapping his jaw too much.
Is this claim true? I thought the Feds were claiming that using <i>any</i> hosted email (Gmail, Hotmail, etc), is considered a 3rd party subject to subpoena.<p>> These communications are generally legally privileged and can’t be used as evidence in court – but only if you keep the messages confidential.