LinkedIn Intro: Doing the Impossible on iOS • Hacker News Board

Re: LinkedIn Intro: Doing the Impossible on iOS

#211

Post by ajays » Thu, Oct 24, 2013, 2:23 AM UTC

rahulvohra wrote: post #134

0x0 wrote: post #104

Earlier quoted context omitted.

Wow, it even says right there that if you forward or reply via a different account, the full content remains in the message (of course!). I'd imagine the same thing would happen if you moved the message from a folder in one imap account to a folder in another imap account. Nice.

There are good ways to remove 95%+ of the content even if you forward/reply from a different account. We'll talk about this in an upcoming post.

95% != 100%.

So there's a nontrivial chance that if I'm connected to someone in LinkedIn whose profile is "private", then if I forward a message from him (containing this LinkedIn flair) to some third party (who is not connected to him), then I could expose his profile details to the third party? That's a privacy lawsuit just waiting to happen.

Re: LinkedIn Intro: Doing the Impossible on iOS

#212

Post by tedunangst » Thu, Oct 24, 2013, 2:37 AM UTC

neohaven wrote: post #204

thefreeman wrote: post #194

Earlier quoted context omitted.

Where in the blog post does it say that your credentials are leaving the device in clear text. I know people don't like LinkedIn but I don't think even they would be dumb enough to do this over http.

How are they going to log in to your email account to MITM it, exactly, other than sending your password in cleartext to them? I'm not saying the connection itself is cleartext, but that they will be storing your email password in cleartext(!) to access your account at your email provider...

I think "your password is sent to LinkedIn" sufficiently and accurately describes what's happening. Adding "in cleartext" typically means via an unencrypted channel. Think about. Think about it. Every time you login into a website via password, your browser sends the password to the server. We don't usually call that out for being in plaintext, unless it really is using http.

Re: LinkedIn Intro: Doing the Impossible on iOS

#213

Post by mindprince » Thu, Oct 24, 2013, 2:39 AM UTC

neohaven wrote: post #204

thefreeman wrote: post #194

Earlier quoted context omitted.

Where in the blog post does it say that your credentials are leaving the device in clear text. I know people don't like LinkedIn but I don't think even they would be dumb enough to do this over http.

How are they going to log in to your email account to MITM it, exactly, other than sending your password in cleartext to them? I'm not saying the connection itself is cleartext, but that they will be storing your email password in cleartext(!) to access your account at your email provider...

They won't be storing the email password in cleartext. They would probably be using reversible encryption.

Here's how Mint.com stores your banking credentials: https://www.quora.com/How-do-mint-com-and-similar-websites-a... I assume LinkedIn Intro would be using a similar technique.

Re: LinkedIn Intro: Doing the Impossible on iOS

#214

Post by tedunangst » Thu, Oct 24, 2013, 2:40 AM UTC

brymaster wrote: post #186

tedunangst wrote: post #175

Earlier quoted context omitted.

no, no, no. Reddit's Razor: if a corporation could be doing something evil, they are doing that something.

These "social" big data companies have a history of doing evil (or sometimes, stepping right up to that line) and $LKND certainly isn't in business to be altruistic. Their iphone app used to slurp up your data without authorization: http://arstechnica.com/apple/2012/06/your-iphone-calendar-is... Furthermore: LinkedIn: The Creepiest Social Network https://news.ycombinator.com/item?id=5680680 LinkedIn opts 100 million…

I thank you for providing examples that prove my point. :) That's mostly speculation along the lines of "evil could have been done, therefore evil must have been done".

Re: LinkedIn Intro: Doing the Impossible on iOS

#215

Post by ocrickard » Thu, Oct 24, 2013, 2:40 AM UTC

neohaven wrote: post #204

thefreeman wrote: post #194

Earlier quoted context omitted.

Where in the blog post does it say that your credentials are leaving the device in clear text. I know people don't like LinkedIn but I don't think even they would be dumb enough to do this over http.

How are they going to log in to your email account to MITM it, exactly, other than sending your password in cleartext to them? I'm not saying the connection itself is cleartext, but that they will be storing your email password in cleartext(!) to access your account at your email provider...

It's worth noting that they specifically state that for Gmail they can use OAuth through the refresh/access token system. Hopefully they do this for all other IMAP servers that support OAuth (there are a couple of them now).

However, for traditional IMAP/SMTP servers your point is well taken. They must store your credentials in a restorable state, which, however carefully you do, has difficult security implications.

Re: LinkedIn Intro: Doing the Impossible on iOS

#216

Post by benhamner » Thu, Oct 24, 2013, 2:45 AM UTC

The privacy outrage around this is nonsensical.

Over 500 million people trust Google with complete and indefinite access to their email. The leap from trusting no external email providers to trusting Gmail is much greater than this incremental step of trusting LinkedIn as well. The risk is similar to trusting an established company to automatically backup your emails, and smaller than trusting startups like Greplin (which rebranded and got acquired) to safeguard a dump of all your emails.

This is not to say the privacy and uptime risks are non-existent: the attack surface area is marginally increased and there is another system that could break.

Claiming LinkedIn's doing a "MITM attack on your email" is on the same level as saying "Google is Big Brother." Both statements capture an element of reality, but with an extremely alarmist bent.

Re: LinkedIn Intro: Doing the Impossible on iOS

#217

Post by olegp » Thu, Oct 24, 2013, 2:52 AM UTC

zaroth wrote: post #75

I don't think I've ever gagged quite like that while reading a technical article describing a "neat hack". At first I'm thinking, oh, I wonder how they convinced Apple to let them use some private APIs, and then... curiosity turns to revulsion as soon as I saw that proxy diagram. Good god... LinkedIn MITM IMAP. That is truly terrifying. How would you even go about installing that on the user's phone? Oh, that's in th…

I'm curious: given the negativity of the comments why does the post have so many upvotes?

Do people find the technical details interesting despite the privacy concerns?

Either way, congrats to Martin, Sam and others on the launch. Getting something out the door to such a wide audience after working on it for over a year must be quite a challenge.

Re: LinkedIn Intro: Doing the Impossible on iOS

#218

Post by csarva » Thu, Oct 24, 2013, 2:53 AM UTC

neohaven wrote: post #204

thefreeman wrote: post #194

Earlier quoted context omitted.

Where in the blog post does it say that your credentials are leaving the device in clear text. I know people don't like LinkedIn but I don't think even they would be dumb enough to do this over http.

How are they going to log in to your email account to MITM it, exactly, other than sending your password in cleartext to them? I'm not saying the connection itself is cleartext, but that they will be storing your email password in cleartext(!) to access your account at your email provider...

They need your cleartext pw in order to create a config profile and that's it. Why would they need to store your pw at all? Once the config profile is setup, the IMAP AUTH request gets proxied through them to the original provider and handled as normal. No need to store any pws at the proxy.

Re: LinkedIn Intro: Doing the Impossible on iOS

#219

Post by bhburke » Thu, Oct 24, 2013, 3:00 AM UTC

Retitle this post as "Major security flaws in iOS" and you've done something brilliant. Intro is malware, plain and simple, but this post has exposed some serious holes in Apple's security which will hopefully be fixed ASAP

Re: LinkedIn Intro: Doing the Impossible on iOS

#220

Post by boucher » Thu, Oct 24, 2013, 3:02 AM UTC

baddox wrote: post #89

pisarzp wrote: post #63

I'd be really surprised if Apple will let them use all of these hacks for long... Still great way to get full access to all email from many users.

Which parts would Apple have an issue with? The proxy server is the only part I can think of. Using images, CSS, and iframes in Mail is presumably a very deliberate feature.

I doubt they intended something like this to be possible, but what remains to see is whether or not they'll be OK with it. I wouldn't be surprised if Apple disabled :hover and other interactive CSS features within Mail.app in a future update.