Hacker News Reader

Comment by Kiro | Hacker News Reader

What exactly were you expecting? I think it's a neat hack using some clever tricks.

That LinkedIn not violate one of the simplest, most fundamental notions of security: never ever give your credentials to a third party.

Part of being a semi-decent citizen of the internet is also not encouraging users to give third parties their credentials

It is a neat hack. I'd love this if it was "here's how we integrate LinkedIn into our email clients internally". It is novel and it does use CSS in weird and new ways. It should also not be a shipping public product. MITM is bad shit.

To be fair, they specifically mention that they use OAuth for Gmail/GApps.

It seems like they're aware of this but it's hardly their responsibility to avoid building a hack such as this just because Google are the only provider to allow IMAP access with OAuth. If more e-mail providers would allow such authentication, I'm sure LinkedIn would be happy to extend the support.

It seems like they're aware of this but it's hardly their responsibility to avoid building a hack such as this...

Is that so? "Fsck the world, we got a business to run?"

How about "the world isn't perfect and whilst it would be great to live up to our every ideal, our primary responsibility is running a business and providing a great experience for our users who, ultimately, in the vast majority regularly engage in such egregious violations of sensible security protocol that most-anything we do is unlikely to affect them and in cases where it would, said users are usually sufficiently literate to wish to avoid this anyway".

That's a pretty long-winded explication of, "it's a race to the bottom."

It's a pretty long-winded explanation of "the world ain't perfect". :P

There is nothing new about this. Putting a proxy into to modify content is as old as the usage of tcp proxies. What is new here is that they have no shame -- I don't expect software from a reputed company to pipe my email through their servers.

To play the devil's advocate, how is this any different morally from what Gmail (and Outlook, and Yahoo) do with their external emails feature? In each case, you give them the credentials for your other account, they pull the mail and display it in their interface (which, presumably, adds some new features that doesn't exist in the other account. Like conversations and tags.) LinkedIn is doing pretty much the same thing.

G-mail/Yahoo: moving your content to your e-mail address.

LinkedIn: moving their content to your e-mail address.

G-mail/Yahoo: Duplicating your content.

LinkedIn: Manipulating your content.

G-mail/Yahoo: E-mail providers.

LinkedIn: Social media provider.

G-mail/Yahoo: uses protocols as intended to provide service.

LinkedIn: uses hacks to provide service.

G-mail/Yahoo: No risk of compromising devices.

LinkedIn: Extreme risk of device compromise. Intentionally circumvents device security features. Multiple potential points of security breach (at proxy server, at web server, through rendering engine).

No comparison, really.

Everything they do differently is irrelevant as long as the user is asking them to do those things. If Gmail starts showing me fetish porn that's bad, if a fetish porn site does the same thing it's fine.

The only relevant difference is security/privacy, in which Google may be more trustworthy but even that is debatable, regardless of which side of the debate you land on.

Oh yes, and if the Linkedin IMAP MITM stops working for some reason I stop getting my emails?

It's a neat hack, but a bad one.

I agree. Imaging computers by dd'ing disk images over the network via netcat isn't secure or a Good Idea, but it is also a neat trick.

This, like dd+nc, has some practical concerns such as security, but that doesn't mean it isn't creative and interesting.

Reply on news.ycombinator.com