LinkedIn Intro: Doing the Impossible on iOS

The first party is on my lawn.

Before every email as yourself "if this email went public, would anyone care?" If I ever answer "yes", I don't send it. I either call or meet in person assuming we're not too remote.

I don't think I've ever gagged quite like that while reading a technical article describing a "neat hack".

At first I'm thinking, oh, I wonder how they convinced Apple to let them use some private APIs, and then... curiosity turns to revulsion as soon as I saw that proxy diagram. Good god... LinkedIn MITM IMAP. That is truly terrifying.

How would you even go about installing that on the user's phone? Oh, that's in there too... they ship a 'configuration profile' which adds a new email account, so your password is leaving the device in cleartext and being used to create the profile server-side which is then shipped back to the phone and installed, how exactly?

This just gets worse and worse if I understand correctly... I'm surprised that configuration profiles can be shipped to an arbitrary device from a third party this way without the user manually installing LinkedIn's certificate as trusted. In other words, it should be a lot harder to "Accept" these profiles outside an enterprise setting, because it sounds exploitable. What else can you configure "so easily" I wonder?

Then you get into how they are hacking CSS and iframes into the email body, to substitute for Javascript, and actually create a workable user interface. Now this is fascinating, impressive, and deserves further study... Without fully understanding exactly what they are doing, however, it sounds highly abusive of the Mail app's rendering capabilities, and points to exploitable paths within the Mail app that probably need to be tightened up by Apple. If LinkedIn can make an email "act" like that without any opt-in on my part, how would Mallory use the same "feature" in their latest SPAM campaign?

Thanks LinkedIn... really, I'm impressed. When exactly did Walter Bishop start working for you?

P.S. I look forward to following your pending class-action lawsuit for violation of US federal wiretapping laws. Cheers!

Fair enough but as I tried (and obviously failed) to caveat, these are not shutdowns I really knew about. I clearly wasn't a user of those products so I didn't feel any pain when they went away.

Perhaps my claim is weak and my knowledge limited but I find it more ridiculous to claim the inevitability of a closure before a product is even being used.

NB I feel I should add that I'm not going to be a user of this product as I won't hand over email access. However, I can imagine many people who don't think the same finding it very useful.

A privacy pledge, how cute! The problem with stuff like this is not knowing the third, fouth, and fifth party uses. Granted most user's don't read these disclosure and even more don't have the technical aspects of how this works. But even if you're ok with one big evil company have access to your inbox, allowing two just seems crazy. What happens when LinkedIn think of a cool way to use your emails from five years ago? By cool I of course mean horrifying.