What a huge, ugly crotch.
LinkedIn Intro: Doing the Impossible on iOS
271–280 of 309 posts
Re: LinkedIn Intro: Doing the Impossible on iOS
#272Earlier quoted context omitted.
Interestingly in a world of front-end JS frameworks you could fix this by encoding client-side before submission.
DON'T! Just don't. Encrypting user credentials in JS is probably even worse than parsing HTML with regular expressions: http://stackoverflow.com/questions/1732348/regex-match-open-... Just send it in cleartext, but over properly verified https.
I've read the Matasano whitepaper on why you can't count on Javascript for security, as I imagine you have, and it makes sense. Use https.
That being said, look at something like blockchain.info.
It adds javascript security on top of https, and for (what seems like) excellent reasons.
Re: LinkedIn Intro: Doing the Impossible on iOS
#273The iPhone Mail app allows embedded CSS right? I mean, why not solve this for all mobile devices by adding the top bar to all emails, marking it display: none; and using media queries to show it if it's a mobile resolution? Also, pretty sure the :hover state touch interaction is something anyone who's done any kind of mobile web development knows about.
Oh right, I see they want to add LinkedIn profiles to all emails, not just ones coming from LinkedIn? Well... why!?
Re: LinkedIn Intro: Doing the Impossible on iOS
#274How (and Why) You Should Block LinkedIn Access to your Exchange Server Organization http://exchangeserverpro.com/blocking-linkedin-access-to-you... > I ran some tests with two brand new mailboxes, and it seems that LinkedIn > accesses both the Contacts and the Sent Items. technical details: http://www.adamfowlerit.com/2013/06/02/linkedin-securityinfo...
If LinkedIn changes their User-Agent string then they're right back in again.
Fortunately the technical details of how to determine the user agent to block are included, along with a reference to LinkedIn's own support explaining that 'LinkedInEWS' is the value to add to the blocklist!
Re: LinkedIn Intro: Doing the Impossible on iOS
#275Earlier quoted context omitted.
I believe vBulletin actually does this.
It's a good idea IMO, I don't understand why it gets so much flak. A server who doesn't want to know your secret is more trustworthy than one that does, a MITM might be able to hijack your account but he won't see your favourite password and you don't have to trust that the server is hashing the password at their end. To avoid the "hash is a plaintext password" problem you save double-hashed passwords to your databas…
"A server who doesn't want to know your secret is more trustworthy than one that does" - I totally agree here, in many ways that's why projects like http://openpgpjs.org/ are fundamentally MORE important that more/newer layers of centralized encryption like TLS that are fundamentally bust in that we have to blindly trust the server. yesyes, i know JS on untrusted/leaky browsers isn't totally bingo but at least someone is TRYING!
Re: LinkedIn Intro: Doing the Impossible on iOS
#276Earlier quoted context omitted.
How are they going to log in to your email account to MITM it, exactly, other than sending your password in cleartext to them? I'm not saying the connection itself is cleartext, but that they will be storing your email password in cleartext(!) to access your account at your email provider...
I think "your password is sent to LinkedIn" sufficiently and accurately describes what's happening. Adding "in cleartext" typically means via an unencrypted channel. Think about. Think about it. Every time you login into a website via password, your browser sends the password to the server. We don't usually call that out for being in plaintext, unless it really is using http.
I think what they're getting at is that LinkedIn has a plaintext copy of your email password, not necessarily that it got there via some unencrypted channel. And because LinkedIn needs to be able to log in again, it has to store it in plaintext, which then leads to the possibility of another incident where they leak millions of passwords[0].
[0] http://www.zdnet.com/blog/btl/6-46-million-linkedin-password...
Re: LinkedIn Intro: Doing the Impossible on iOS
#277Earlier quoted context omitted.
Of course. They can send as you too, which given their spammy record is quite a huge issue. They will also be storing your IMAP password in plaintext.
Since they are proxying the request, they don't actually have to store the password at all.
They don't have to store your email password, no.
However, in 2013 it should be clear that it is no way whatsoever safe to just assume that information flowing through a third party's server will not be stored.
Re: LinkedIn Intro: Doing the Impossible on iOS
#278Earlier quoted context omitted.
Not that we should trust anybody, but let's not forget that LinkedIn already has a history of losing user credentials: http://www.pcworld.com/article/257045/6_5m_linkedin_password...
No, they don't, and you keep posting that they do despite being proven wrong several times in the past. They lost hashed passwords which are not user credentials.
You do realize that cracking unsalted SHA1 passwords isn't that hard, right? Perhaps you should educate yourself on the wonderful world of GPU password cracking and the enormous speeds a handful of consumer-grade video cards working in concert can utterly smash through a database like this.
edit: Here's a blog post about being able to brute force 33.1 billion MD5 hashes a second using GPU's: http://blog.zorinaq.com/?e=43
Re: LinkedIn Intro: Doing the Impossible on iOS
#279A friend of mine pointed out that it's surprising that the iOS mail app supports iframes. Isn't that a security issue?
Re: LinkedIn Intro: Doing the Impossible on iOS
#280I don't think I've ever gagged quite like that while reading a technical article describing a "neat hack". At first I'm thinking, oh, I wonder how they convinced Apple to let them use some private APIs, and then... curiosity turns to revulsion as soon as I saw that proxy diagram. Good god... LinkedIn MITM IMAP. That is truly terrifying. How would you even go about installing that on the user's phone? Oh, that's in th…
I think LinkedIn should open source their proxy endpoint to let people use their own server to proxy messages...
p.s. Why Walter Bishop?