Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn Intro: Doing the Impossible on iOS

engineering.linkedin.com

Post reply on HN
Print view View original

221–230 of 309 posts

Re: LinkedIn Intro: Doing the Impossible on iOS

#221

Post by onedev »

olegp wrote: post #217
zaroth wrote: post #75

I don't think I've ever gagged quite like that while reading a technical article describing a "neat hack". At first I'm thinking, oh, I wonder how they convinced Apple to let them use some private APIs, and then... curiosity turns to revulsion as soon as I saw that proxy diagram. Good god... LinkedIn MITM IMAP. That is truly terrifying. How would you even go about installing that on the user's phone? Oh, that's in th…

I'm curious: given the negativity of the comments why does the post have so many upvotes? Do people find the technical details interesting despite the privacy concerns? Either way, congrats to Martin, Sam and others on the launch. Getting something out the door to such a wide audience after working on it for over a year must be quite a challenge.

I think people decided that this was something worth discussing. A lot of times I won't necessarily agree with or like the post that I'm upvoting, but I upvote it so that it gets more visibility and then I can read other people's opinions and analysis of the thing at hand.

Re: LinkedIn Intro: Doing the Impossible on iOS

#222

Post by baddox »

freehunter wrote: post #151
baddox wrote: post #84

Earlier quoted context omitted.

The "attack" part of "man in the middle attack" refers to the fact that it is done secretly and generally with ill intentions. LinkedIn is not being secretive (and we can speculate about their intentions). If everything that's in the middle of something is a man in the middle attack, then that would include your home router.

I work in enterprise information security, and my team agreed upon hearing this news that if this was used on our email system, we would consider it a MITM attack . Whether or not the end user opted in, the corporation did not. So, in the context of use in environments where your email address is not fully owned by you, attack would be a valid word. Otherwise, I agree that it's a MITM but not an attack.

I appreciate the data point, but I must admit that sounds very unreasonable, unless you're considering the employer as the attacker. Would the same apply if an employee were using a VPN at work?

Re: LinkedIn Intro: Doing the Impossible on iOS

#223

Post by r0h1n »

olegp wrote: post #217
zaroth wrote: post #75

I don't think I've ever gagged quite like that while reading a technical article describing a "neat hack". At first I'm thinking, oh, I wonder how they convinced Apple to let them use some private APIs, and then... curiosity turns to revulsion as soon as I saw that proxy diagram. Good god... LinkedIn MITM IMAP. That is truly terrifying. How would you even go about installing that on the user's phone? Oh, that's in th…

I'm curious: given the negativity of the comments why does the post have so many upvotes? Do people find the technical details interesting despite the privacy concerns? Either way, congrats to Martin, Sam and others on the launch. Getting something out the door to such a wide audience after working on it for over a year must be quite a challenge.

Even bad/negative stories deserve their moment of sunshine on the HN front page, perhaps even more so. How else would we be having this discussion?

Re: LinkedIn Intro: Doing the Impossible on iOS

#224

Post by arb99 »

dclowd9901 wrote: post #195
nostromo wrote: post #54

This is a truly awesome hack. Good job! The value for LinkedIn to vacuum up my email is immense! They'll know everyone I email and the content of the emails as well. They'll know where I shop and what I purchase. If I send a private email to a friend who has this installed, I've now unknowingly bcc'ed LinkedIn. Not only that, but they know this for the entire history of my email account! The person I stopped emailing…

Maybe we should be discussing Apple's closed-ass OS instead of harping on the only workaround that could possibly exist. Such "creative" measures wouldn't need to be taken if it was simple for a user to augment their email app.

You can't really expect a mobile email client to allow third parties to add their own extensions to it.

If they were that fussed they could have tried to make a clone of a email client and integrate their own features. If it was better than the default client, people would use it (I use Sparrow on my iPhone for email, not touched the default Mail app for years)

Re: LinkedIn Intro: Doing the Impossible on iOS

#225

Post by tekacs »

potatolicious wrote: post #136
Kiro wrote: post #97

Earlier quoted context omitted.

What exactly were you expecting? I think it's a neat hack using some clever tricks.

That LinkedIn not violate one of the simplest, most fundamental notions of security: never ever give your credentials to a third party . Part of being a semi-decent citizen of the internet is also not encouraging users to give third parties their credentials It is a neat hack. I'd love this if it was "here's how we integrate LinkedIn into our email clients internally". It is novel and it does use CSS in weird and new…

To be fair, they specifically mention that they use OAuth for Gmail/GApps.

It seems like they're aware of this but it's hardly their responsibility to avoid building a hack such as this just because Google are the only provider to allow IMAP access with OAuth. If more e-mail providers would allow such authentication, I'm sure LinkedIn would be happy to extend the support.

Re: LinkedIn Intro: Doing the Impossible on iOS

#226

Post by nopassrecover »

tedunangst wrote: post #212
neohaven wrote: post #204

Earlier quoted context omitted.

How are they going to log in to your email account to MITM it, exactly, other than sending your password in cleartext to them? I'm not saying the connection itself is cleartext, but that they will be storing your email password in cleartext(!) to access your account at your email provider...

I think "your password is sent to LinkedIn" sufficiently and accurately describes what's happening. Adding "in cleartext" typically means via an unencrypted channel. Think about. Think about it. Every time you login into a website via password, your browser sends the password to the server. We don't usually call that out for being in plaintext, unless it really is using http.

Interestingly in a world of front-end JS frameworks you could fix this by encoding client-side before submission.

Re: LinkedIn Intro: Doing the Impossible on iOS

#227

Post by codezero »

Also from their FAQ:

"For technical reasons, you can't remove the Intro app icon directly from the iPhone home screen." https://intro.linkedin.com/micro/faq

This is insane. Not only does the whole setup hijack your mail, it is implemented in a way that makes it very hard for users to remove it.

Re: LinkedIn Intro: Doing the Impossible on iOS

#228

Post by Xorlev »

nopassrecover wrote: post #226
tedunangst wrote: post #212

Earlier quoted context omitted.

I think "your password is sent to LinkedIn" sufficiently and accurately describes what's happening. Adding "in cleartext" typically means via an unencrypted channel. Think about. Think about it. Every time you login into a website via password, your browser sends the password to the server. We don't usually call that out for being in plaintext, unless it really is using http.

Interestingly in a world of front-end JS frameworks you could fix this by encoding client-side before submission.

Or, use TLS and get it for free. Crypto on JS is a scary, scary world.

Re: LinkedIn Intro: Doing the Impossible on iOS

#229

Post by hfern »

nopassrecover wrote: post #226
tedunangst wrote: post #212

Earlier quoted context omitted.

I think "your password is sent to LinkedIn" sufficiently and accurately describes what's happening. Adding "in cleartext" typically means via an unencrypted channel. Think about. Think about it. Every time you login into a website via password, your browser sends the password to the server. We don't usually call that out for being in plaintext, unless it really is using http.

Interestingly in a world of front-end JS frameworks you could fix this by encoding client-side before submission.

I believe vBulletin actually does this.

Re: LinkedIn Intro: Doing the Impossible on iOS

#230

Post by chrismsnz »

aianus wrote: post #155
poxrud wrote: post #91

Earlier quoted context omitted.

I do think LinkedIn has ill intentions. In my opinion, their intentions are to collect, analyze, and ultimately profit from their user's email data. All under the guise of offering some marginal benefit.

So they're just like Gmail?

If you consider creating, hosting and managing arguably one of the better email platforms a "guise"... "of marginal benefit".
Post reply on HN