Linkedin WARNING

[icebike]

See this page: LinkedIn Intro: Doing the Impossible on iOS [UPDATED] | LinkedIn Engineering
http://bits.blogs.nytimes.com/2013/10/24/linkedins-new-mobile-app-called-a-dream-for-attackers/?_r=0
And think twice about installing the Linkedin App

Really, this issue should be on the front page but I can't figure out how to send a tip to the editors any more.

 

[kch50428]

...I can't figure out how to send a tip to the editors any more.

news@imore.com

 

[jmr1015]

This has little to do with the LinkedIn app. It is the new LinkedIn Intro service.

https://intro.linkedin.com

Key points from the article you linked:

-You have to opt-in and install Intro before you see LinkedIn profiles in any email.
-Usernames, passwords, OAuth tokens, and email contents are not permanently stored anywhere inside LinkedIn data centers. Instead, these are stored on your iPhone.
-Once you install Intro, a new Mail account is created on your iPhone. Only the email in this new Intro Mail account goes via LinkedIn; other Mail accounts are not affected in any way.
-All communication from the Mail app to the LinkedIn Intro servers is fully encrypted. Likewise, all communication from the LinkedIn Intro servers to your email provider (e.g. Gmail or Yahoo! Mail) is fully encrypted.
-Your emails are only accessed when the Mail app is retrieving emails from your email provider. LinkedIn servers automatically look up the "From" email address, so that Intro can then be inserted into the email.

 

[Trees]

See this page: LinkedIn Intro: Doing the Impossible on iOS [UPDATED] | LinkedIn Engineering
http://bits.blogs.nytimes.com/2013/10/24/linkedins-new-mobile-app-called-a-dream-for-attackers/?_r=0
And think twice about installing the Linkedin App

Really, this issue should be on the front page but I can't figure out how to send a tip to the editors any more.

Is your concern that messages are manipulated via the Proxy Service?

 

[icebike]

The concern is that not only are the messages manipulate by a proxy, but 90% of the people installing this app have no idea that their mail is going through a proxy, and that they are handing over their email credentials to a third party. People simply click through the OK buttons without a thought.

Further, contrary to what JMR1015 posted, this isn't a new mail account, its your REAL mail account on IOS or Gmail or what ever.
(I'm gob-struck he seems so caviler about it. Releasing your email credentials is a Firing Offence at many companies.)

The Intro proxy server speaks the IMAP protocol just like an email provider, but it doesn’t store messages itself. Instead, it forwards requests from the device to your email provider, and forwards responses from the email provider back to the device. En route, it inserts Intro information at the beginning of each message body.

Because they have your email credentials (how else could they intercept your messages) they can also glean a complete list of your contacts.

 

[jmr1015]

Further, contrary to what JMR1015 posted, this isn't a new mail account, its your REAL mail account on IOS or Gmail or what ever.
(I'm gob-struck he seems so caviler about it. Releasing your email credentials is a Firing Offence at many companies.)

I quoted word for word from the link you provided.

The wording may have tripped you up, but it is not saying it is a completely new standalone mail account. It is saying LinkedIn Intro creates a separate mail account on your phone which is the only account tied to LinkedIn Intro. Any other mail accounts you have on your device are not impacted.

So, lets say you have 3 email accounts on your phone. Gmail, Outlook, and Yahoo. You download and setup LinkedIn Intro, and give it the login info for your Gmail. So, LinkedIn Intro creates a 4th email account on your phone, that is just the LinkedIn Intro account that has access to your Gmail.