Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn accesses Gmail contacts via ‘auto-authorization’

thestack.com

Post reply on HN
Print view View original

31–40 of 49 posts

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#31

Post by adventurer »

Johnny555 wrote: post #29

If this is true, then any website could use this same method to access Gmail contacts if you happen to have Gmail open in the same browser session. Seems unlikely that it really works this way, it would be a huge security hole - spammers and scammers would be using this all the time to harvest addresses.

I'm also skeptical but believe it isn't coincidental that when I signed up, it recommended some people from my Gmail account. I had my country and city set as Beijing, China. The only other recommendations were from people in that area, I didn't know, because I'm really in the U.S.

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#32

Post by biot »

In previous stories[0] it turned out that LinkedIn was siphoning information via their mobile app. For example, if you're on Android and install LinkedIn you're granting the complete set of permissions the app requires plus automatically granting any new permissions the updated app specifies:

  This app has access to:

  Identity
  -find accounts on the device
  -add or remove accounts

  Calendar
  -read calendar events plus confidential information

  Contacts
  -find accounts on the device
  -read your contacts
  -modify your contacts

  Location
  -precise location (GPS and network-based)

  Photos/Media/Files
  -read the contents of your USB storage
  -modify or delete the contents of your USB storage

  Storage
  -read the contents of your USB storage
  -modify or delete the contents of your USB storage

  Other
  -read sync statistics
  -receive data from Internet
  -view network connections
  -create accounts and set passwords
  -full network access
  -read sync settings
  -control vibration
  -prevent device from sleeping
  -toggle sync on and off

  Updates to LinkedIn may automatically add 
  additional capabilities within each group.
How people can willingly grant device pwnership to apps like this are beyond me.

[0] https://news.ycombinator.com/item?id=12651448

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#33

Post by phkahler »

DanBlake wrote: post #16

If you know about browser security, you know that was is being described is just not possible. Likely that the author had authorized some google importer or something, but simply visiting 2 different websites in 2 tabs would not allow this. Just imagine the insanity if it was possible for another site to read from another tab.

I've seen this happen too. I'm actually under the impression that LinkedIn will log in to your email account if they can. They keep asking me to "confirm" an email address by giving them the password. Sorry, not gonna happen. I believe (without hard proof) that if Alice send Bob an email talking about Cindy, all three will be suggested as people they may know even if none of them have explicitly indicated such to LikedIn. Facebook apparently does some similar things, but LinkedIn is creepy in this regard. And remember, it could be that they didn't rifle through your email, but someone whose contacts include you. Oh, and I'm sure their "app" requires access to your phone contacts for the same reasons.

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#34

Post by ungzd »

DanBlake wrote: post #16

If you know about browser security, you know that was is being described is just not possible. Likely that the author had authorized some google importer or something, but simply visiting 2 different websites in 2 tabs would not allow this. Just imagine the insanity if it was possible for another site to read from another tab.

Only if linkedin tab is opened from gmail via target="_blank". But surely gmail has protection against it.

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#35

Post by shortstuffsushi »

I posted a story asking about this (kind of) a couple years back [0]. I've seen all sorts of weird link in behavior in terms of people bring recommended to me and people "accepting" invitations I didn't send. At least now I know I'm not entirely crazy.

[0] https://news.ycombinator.com/item?id=6105715

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#36

Post by eximius »

Regardless of the technical feasibility of this particular method, I think it is wise to simply abandon LinkedIn. They have proven to be a company I don't want to be associated with. When people ask me for my LinkedIn, I tell them I don't have one and quickly summarize some confirmed cases of things like this.

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#37

Post by djrogers »

Listen - I'm not above accusing LinkedIn of horrible things, but here we are basically taking the word of a call center rep over what we (should) know to be technical limitations of the platform in question.

One of 3 things seems to be possible here:

1) The rep is right and gmail has an XSS vulnerability that LinkedIn is using

2) LinkedIn and Google are in bed and sharing this information based on some fingerprint-foo

3) This guy or his other contacts somehow at some point succumbed to LinkedIn trickery and gave access to his gmail account.

Don't know about you, but #3 seems most likely to me...

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#38

Post by derricgilling »

I agree sounds more like the contacts were imported through app permissions or something, unless LinkedIn found a real venerability in a common browser or leveraged some CSRF or XSS attach, but seems doubtful given it's Google. It's so easy just to accept the laundry list of permissions for common apps.

I'm doing some email outreach through Hubspot which requires access to my gmail so I set up a separate email so they don't have access to my main account. I don't believe Hubspot will do anything with my offline access token, but it's just one more system that has access, so better to follow the whole principle of least privilege.

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#39

Post by xg15 »

phkahler wrote: post #33
DanBlake wrote: post #16

If you know about browser security, you know that was is being described is just not possible. Likely that the author had authorized some google importer or something, but simply visiting 2 different websites in 2 tabs would not allow this. Just imagine the insanity if it was possible for another site to read from another tab.

I've seen this happen too. I'm actually under the impression that LinkedIn will log in to your email account if they can. They keep asking me to "confirm" an email address by giving them the password. Sorry, not gonna happen. I believe (without hard proof) that if Alice send Bob an email talking about Cindy, all three will be suggested as people they may know even if none of them have explicitly indicated such to Lik…

I'm actually under the impression that LinkedIn will log in to your email account if they can.

That seems the most likely scenario to me to explain the article. Maybe they try to log-in with your email and linkedin password on the chance that you used the same password for both services?

Then again, on gmail, this should trigger a "login on new device" warning and shouldn't be possible at all if two-factor-auth is active.

Re: LinkedIn accesses Gmail contacts via ‘auto-authorization’

#40

Post by edoceo »

treve wrote: post #28
askafriend wrote: post #19

groan ... grabs pitchfork But seriously though, why does LinkedIn refuse to learn time and time again? There's a line between being aggressive and being outright dishonest and the line isn't all that hard to determine. Uber is often aggressive but rarely are they dishonest in their practices (at least not egregiously from what I know). But at this point LinkedIn is the leader in practices like this and it's not all t…

I don't think there's a lesson to be learned. Their strategy is wildly successful.

The lesson is for users: be wary, click 'decline'
Post reply on HN