The Facts about LinkedIn Intro

I don't think much of this was the issue – the issue was "do you trust LinkedIn with something so vital to your identity". I think it was assumed that the feature would be implemented technically competently.

Bishop Fox is a glorified gossip queen of a security company. What type of engineers, or so called hackers just make stupidly false claims without actually knowing what is going on behind the scenes. This is the software industry, not the Kim Kardashian, Honey Boo boo entertainment industry folks... Get the facts straight, or get a new job.

Your last point nails it. I can't help but think there are a good number of people now angling to build similar hacks in a much less rigorous fashion and then build entire companies around this hack. The next year is already, from my vantage point, lining up to be a year full of "give us OAuth access to your GMail account" products. This adds another vector for this type of product. In any case, users are not going to care about security and just tap "OK", so it's kind of scary that this train is really moving now. Imagine if Facebook (or the Next Facebook) required e-mail access and this was normalized.

I think it may have been a bit short-sighted for LinkedIn to post a developer-focused, "hey look at what we did" kind of post around Intro, regardless of how properly they implemented it behind the scenes.

Why do the billion dollar companies just not get that people can see through double speak now.

Let´s look at the double speak here, which intends to give a statement weight even though it has zero weight. On the left side original statement with zero weight, after the slash how the statement would have weight

1. We isolated Intro in a separate network segment and implemented a tight security perimeter across trust boundaries./ Doesn't say anything at all again

2. REDUCED exposure to third-party monitoring services and tracking/PREVENT exposure to third-party monitoring services and tracking

3. We also had iSEC Partners, a well-respected security consultancy, perform a line-by-line code review of the credential handling and mail parsing/insertion code./ That statement isn't saying anything at all

4. make sure identified vulnerabilities WERE ADDRESSED/ make sure there are NO vulnerabilities

5. we make sure we NEVER persist the mail contents to our systems in an unencrypted form. And once the user has retrieved the mail, the encrypted content is DELETED from our systems./ These two words have weight.

6. MINIMIZE exposure/REMOVE exposure

7. We WORKED TO HELP ENSURE/ We ENSURE

Overall, Linked avoids using terminology that is actually a commitment except for 5. Fortunately, people picked up on double speak and Linkedin has managed to corrupt trust with its users further.

Somebody should fire the person that think sthis kind of "clarification" gets back their user's trust.