LinkedIn offer to man-in-the-middle all your email, for free!
October 25, 2013 5:01 AM Subscribe
LinkedIn offer to man-in-the-middle all of your email, for free! LinkedIn Intro is a new service by LinkedIn, adding inline data to all your iOS emails. "But how can they read my emails?!" you ask: you use the best encryption money can buy! Well, you just need to install one little security certificate... after all, how much of a a bad idea can it be? LinkedIn are well-known for their good security practices!
NSAIn
posted by fearfulsymmetry at 5:09 AM on October 25, 2013
posted by fearfulsymmetry at 5:09 AM on October 25, 2013
It's pretty bad as far as security dispractices go but keep in mind this is something you actively have to sign up for.
posted by Foci for Analysis at 5:15 AM on October 25, 2013 [2 favorites]
posted by Foci for Analysis at 5:15 AM on October 25, 2013 [2 favorites]
Just as long as they never ask me for my Rolodex, I'll tolerate this latest addition to me spa-, I mean 'Updates' tab.
posted by Slackermagee at 5:18 AM on October 25, 2013
posted by Slackermagee at 5:18 AM on October 25, 2013
I can't wait to see who decides to route their work email accounts through LinkedIn. And whether any of them get reprimanded for it.
posted by ardgedee at 5:20 AM on October 25, 2013 [1 favorite]
posted by ardgedee at 5:20 AM on October 25, 2013 [1 favorite]
You have to really love working and linked in in order to derive value from this tool.
I fail on both counts.
posted by Annika Cicada at 5:24 AM on October 25, 2013 [18 favorites]
I fail on both counts.
posted by Annika Cicada at 5:24 AM on October 25, 2013 [18 favorites]
Intro shows you LinkedIn profiles in your iPhone Mail app. Let’s see the difference this makes. You’ve just got an email from David Buchanan, but you don’t yet know who he is
If only there were some way I could embed my own relevant professional information in my outgoing emails. You know, where the signature would go in a letter.
posted by Horace Rumpole at 5:31 AM on October 25, 2013 [36 favorites]
If only there were some way I could embed my own relevant professional information in my outgoing emails. You know, where the signature would go in a letter.
posted by Horace Rumpole at 5:31 AM on October 25, 2013 [36 favorites]
But that won't get you noticed. Studies show that the average Really Important Business Person only spends 1.5 seconds looking at an email which is why you need to put your professional information at the top.
posted by RonButNotStupid at 5:34 AM on October 25, 2013 [1 favorite]
posted by RonButNotStupid at 5:34 AM on October 25, 2013 [1 favorite]
The idea is linkedIn is a trusted third party reputation service.
posted by Annika Cicada at 5:35 AM on October 25, 2013
posted by Annika Cicada at 5:35 AM on October 25, 2013
I put the Rapportive plug-in into my gmail account on one computer which has since been replaced. It was intrusive and pretty unuseful.
posted by chavenet at 5:36 AM on October 25, 2013
posted by chavenet at 5:36 AM on October 25, 2013
My lord, Linkedin is spammy enough as it is.
posted by SPUTNIK at 5:38 AM on October 25, 2013 [1 favorite]
posted by SPUTNIK at 5:38 AM on October 25, 2013 [1 favorite]
LinkedIn seems to have devolved to pure spam at this point. I get messages from recruiters I don't want to interact with and people who don't even know what the acronym means endorsing me for skills that aren't on my list of skills. No, I don't know SAS, people, why would you endorse me for that?
posted by sonic meat machine at 5:38 AM on October 25, 2013 [8 favorites]
posted by sonic meat machine at 5:38 AM on October 25, 2013 [8 favorites]
Well, yeah, as a "reputation service" it is somewhat trusted, but its own reputation is not as a security-conscious company. It's NSA and BlackHat bait, since it will have access to all your incoming and outgoing mail if you do this.
Of course, as the links point out, the privacy policy is pretty poor for what they can do with your mail, it would cause immediate violations of many corporate IT policies, it would endanger legal/medical/religious protections on confidentiality, it might break secure/encrypted mail, and it's just plain annoying. In other words, even if it were NSA-proof, it would still be a bad idea...
posted by mystyk at 5:43 AM on October 25, 2013 [2 favorites]
Of course, as the links point out, the privacy policy is pretty poor for what they can do with your mail, it would cause immediate violations of many corporate IT policies, it would endanger legal/medical/religious protections on confidentiality, it might break secure/encrypted mail, and it's just plain annoying. In other words, even if it were NSA-proof, it would still be a bad idea...
posted by mystyk at 5:43 AM on October 25, 2013 [2 favorites]
No thank you...I'll just sit over here in the corner and enjoy my spam sandwich.
posted by incandissonance at 5:51 AM on October 25, 2013
posted by incandissonance at 5:51 AM on October 25, 2013
I prefer Google to be the only man-in-the-middle on my emails. Oh wait, and the Mailbox iOS apps guys (aka DropBox). But that's it!
posted by smackfu at 5:52 AM on October 25, 2013 [6 favorites]
posted by smackfu at 5:52 AM on October 25, 2013 [6 favorites]
Studies show that the average Really Important Business Person only spends 1.5 seconds looking at an email
That is the exact amount of time required to reply to a multiple-choice question with the single word "ok".
posted by griphus at 5:53 AM on October 25, 2013 [51 favorites]
That is the exact amount of time required to reply to a multiple-choice question with the single word "ok".
posted by griphus at 5:53 AM on October 25, 2013 [51 favorites]
That is the exact amount of time required to reply to a multiple-choice question with the single word "ok".
My favorite is when you present an argument and defend it in an email conversation, three of the managers in the email agree, and the one who doesn't escalates it yet another level, and that manager says "i think we need a mtg re this"
NO NO WE DO NOT. WE NEVER NEED A MEETING RE ANYTHING.
posted by sonic meat machine at 6:00 AM on October 25, 2013 [25 favorites]
My favorite is when you present an argument and defend it in an email conversation, three of the managers in the email agree, and the one who doesn't escalates it yet another level, and that manager says "i think we need a mtg re this"
NO NO WE DO NOT. WE NEVER NEED A MEETING RE ANYTHING.
posted by sonic meat machine at 6:00 AM on October 25, 2013 [25 favorites]
Heh, LinkedIn is about to know a lot about the personal and business lives of recruiters.
posted by ignignokt at 6:06 AM on October 25, 2013 [7 favorites]
posted by ignignokt at 6:06 AM on October 25, 2013 [7 favorites]
Someday, 99% of LinkedIn's activity will be recruiters connecting to each other. It'll be like a dating site that's almost entirely heterosexual dudes emailing the other heterosexual dudes that don't have pictures up and asking if they're women.
posted by ignignokt at 6:09 AM on October 25, 2013 [40 favorites]
posted by ignignokt at 6:09 AM on October 25, 2013 [40 favorites]
...
posted by tilde at 6:12 AM on October 25, 2013 [1 favorite]
posted by tilde at 6:12 AM on October 25, 2013 [1 favorite]
...if only there was a way I could enter the name "David Buchanan" into a website and look up who he was, maybe along with a key word such as his purported company's name.
I suspect they approached GMail with this too, and the ensuing laughter was audible from Berkeley.
(That may be why Apple let them in, though. One less Google search per mystery mail contact probably sounds like a good deal to Apple, because reasons?)
posted by seyirci at 6:20 AM on October 25, 2013
I suspect they approached GMail with this too, and the ensuing laughter was audible from Berkeley.
(That may be why Apple let them in, though. One less Google search per mystery mail contact probably sounds like a good deal to Apple, because reasons?)
posted by seyirci at 6:20 AM on October 25, 2013
That may be why Apple let them in, though
Apple didn't let them in. Apple's restrictive ecosystem is what lead them to implement this infantile man-in-the-middle scheme instead of just developing a simple client-side plugin that adds their shiny banners to local emails.
posted by RonButNotStupid at 6:30 AM on October 25, 2013 [4 favorites]
Apple didn't let them in. Apple's restrictive ecosystem is what lead them to implement this infantile man-in-the-middle scheme instead of just developing a simple client-side plugin that adds their shiny banners to local emails.
posted by RonButNotStupid at 6:30 AM on October 25, 2013 [4 favorites]
WE NEVER NEED A MEETING RE ANYTHING.
How else are managers supposed to feel important?
posted by Steely-eyed Missile Man at 6:32 AM on October 25, 2013 [1 favorite]
How else are managers supposed to feel important?
posted by Steely-eyed Missile Man at 6:32 AM on October 25, 2013 [1 favorite]
Of course, what everyone ignores is that there already is someone capable of doing a Man-in-the-Middle attack on your email: your provider.
I was briefly tempted by a similar service that promised to get rid of all my spam advertising emails. Then Gmail went to the new tabbed inbox and saved me the trouble and stupidity.
posted by anotherpanacea at 6:32 AM on October 25, 2013 [1 favorite]
I was briefly tempted by a similar service that promised to get rid of all my spam advertising emails. Then Gmail went to the new tabbed inbox and saved me the trouble and stupidity.
posted by anotherpanacea at 6:32 AM on October 25, 2013 [1 favorite]
This is like the "free texting" services I've been seeing some of my less technologically adept co-workers get jazzed up about. They don't like it when I tell them its free because the company is somehow selling the content of their private conversations in association with their email address for marketing purposes.
Of course, I use iMessage, so who am I to talk...
posted by snuffleupagus at 6:34 AM on October 25, 2013
Of course, I use iMessage, so who am I to talk...
posted by snuffleupagus at 6:34 AM on October 25, 2013
Of course, what everyone ignores is that there already is someone capable of doing a Man-in-the-Middle attack on your email: your provider.
No, people aren't ignoring that. It's just that with this service, both your provider and LinkedIn are in the middle. While the former might be a necessary evil, the latter has no right to be there at all.
posted by RonButNotStupid at 6:37 AM on October 25, 2013
No, people aren't ignoring that. It's just that with this service, both your provider and LinkedIn are in the middle. While the former might be a necessary evil, the latter has no right to be there at all.
posted by RonButNotStupid at 6:37 AM on October 25, 2013
NO NO WE DO NOT. WE NEVER NEED A MEETING RE ANYTHING.
-fused.
posted by Mister Moofoo at 6:42 AM on October 25, 2013
-fused.
posted by Mister Moofoo at 6:42 AM on October 25, 2013
NO NO WE DO NOT. WE NEVER NEED A MEETING RE ANYTHING.
Hm. Thanks for forwarding this to me. This is an interesting point that needs to be pursued. OK, let's hold a meeting to determine if we're holding too many meetings.
posted by happyroach at 6:52 AM on October 25, 2013 [5 favorites]
Hm. Thanks for forwarding this to me. This is an interesting point that needs to be pursued. OK, let's hold a meeting to determine if we're holding too many meetings.
posted by happyroach at 6:52 AM on October 25, 2013 [5 favorites]
Hm. Thanks for forwarding this to me. This is an interesting point that needs to be pursued. OK, let's hold a meeting to determine if we're holding too many meetings.
Hold on there Tex, we're going to need to get together and coordinate our calendars to see if we have time for the meeting. Let's book the 3rd floor meeting room for the week of November 5th, then we can do a follow-up conference call on the 14th to determine if we should go ahead with your proposed meeting schedule.
posted by blue_beetle at 7:00 AM on October 25, 2013 [5 favorites]
Hold on there Tex, we're going to need to get together and coordinate our calendars to see if we have time for the meeting. Let's book the 3rd floor meeting room for the week of November 5th, then we can do a follow-up conference call on the 14th to determine if we should go ahead with your proposed meeting schedule.
posted by blue_beetle at 7:00 AM on October 25, 2013 [5 favorites]
I'll be out of the office the afternoon of the 14th...can we bump that up to 7 pm?
posted by mittens at 7:01 AM on October 25, 2013 [3 favorites]
posted by mittens at 7:01 AM on October 25, 2013 [3 favorites]
Heh, LinkedIn is about to know a lot about the personal and business lives of recruiters.
When I was looking for a job, I ended up at a recruiting firm to try to get placed but ended up interviewing there instead. It was one of the most bizarre interviews I had ever been part of. Most of the interview with the lower manager who was, like, straighta outta Jersey Shore (unless you're from NYC, in which case this guy was straight outta Bay Ridge or maybe Staten Island) and the interview consisted of him trying to ascertain how much of a bro I could be. I could not be very much of a bro, unfortunately. He told me they were looking for someone who could grab beers with clients and "drop the f-bomb" and it took me all the restraint I had to not immediately reply "what the fuck are you talking about?"
Then I met the company owner who asked my my GPA and wrote it down on my resume. I'm not sure how he would have checked that because he did not ask me for my transcript and FERPA would prevent him from calling up my college and asking if I was lying. So I guess it was some sort of test as to whether I was a good liar?
I did not get the job.
posted by griphus at 7:01 AM on October 25, 2013 [7 favorites]
When I was looking for a job, I ended up at a recruiting firm to try to get placed but ended up interviewing there instead. It was one of the most bizarre interviews I had ever been part of. Most of the interview with the lower manager who was, like, straighta outta Jersey Shore (unless you're from NYC, in which case this guy was straight outta Bay Ridge or maybe Staten Island) and the interview consisted of him trying to ascertain how much of a bro I could be. I could not be very much of a bro, unfortunately. He told me they were looking for someone who could grab beers with clients and "drop the f-bomb" and it took me all the restraint I had to not immediately reply "what the fuck are you talking about?"
Then I met the company owner who asked my my GPA and wrote it down on my resume. I'm not sure how he would have checked that because he did not ask me for my transcript and FERPA would prevent him from calling up my college and asking if I was lying. So I guess it was some sort of test as to whether I was a good liar?
I did not get the job.
posted by griphus at 7:01 AM on October 25, 2013 [7 favorites]
MITM attacks are LinkedIn's entire business model, though. Before I give it away: how do you think they make money?
(Answer: They sell aggregated, per-company behavioral data to hedge funds. When X% of the top executives or Y% of the top engineers at a company start surfing LinkedIn more or suddenly updating their resumes, that's market information. LinkedIn's real business model is crowdsourced insider trading. This is actually just a logical and not-all-that-much-more-scummy extension of that.)
posted by mhoye at 7:13 AM on October 25, 2013 [49 favorites]
(Answer: They sell aggregated, per-company behavioral data to hedge funds. When X% of the top executives or Y% of the top engineers at a company start surfing LinkedIn more or suddenly updating their resumes, that's market information. LinkedIn's real business model is crowdsourced insider trading. This is actually just a logical and not-all-that-much-more-scummy extension of that.)
posted by mhoye at 7:13 AM on October 25, 2013 [49 favorites]
Of course, what everyone ignores is that there already is someone capable of doing a Man-in-the-Middle attack on your email: your provider.
... and the rest of the internet. Where did anyone get the idea that email had the slightest shred of privacy or security? Unless you're using S/MIME or PGP/GPG and encrypting your messages -- and let's face it, you're not -- every email you send is just floating around out there waiting to be read, just like any web page that you visit without TLS.
posted by Rhomboid at 7:15 AM on October 25, 2013 [1 favorite]
... and the rest of the internet. Where did anyone get the idea that email had the slightest shred of privacy or security? Unless you're using S/MIME or PGP/GPG and encrypting your messages -- and let's face it, you're not -- every email you send is just floating around out there waiting to be read, just like any web page that you visit without TLS.
posted by Rhomboid at 7:15 AM on October 25, 2013 [1 favorite]
I use the Rapportive Gmail plugin and find it remarkably useful. It does a great job of telling me who someone is in my email, a quick summary of their LinkedIn title, Twitter account, Facebook, etc. It's great for answering the "who the hell is this?" question, and I like the way it just sits to the side of my email.
It's definitely intrusive and a security risk though. Without having thought about it carefully, I'm OK with a Gmail plugin (with Facebook and LinkedIn credentials) but I'm not OK with LinkedIn actually rewriting my email. The TechCrunch article points out the underlying problem is that the iOS mail app is not extensible. There's no way to hook it to do something like this. Mobile Safari is similarly closed and it's a huge pain in the ass, particularly if you use a password manager on desktops.
(LinkedIn is the only web service I use that has a special filter in my email to shitcan everything they send me. I'm religious about unsubscribing and disabling email notifications, but I was never able to get LinkedIn to stop spamming me. Now they can never email me again.)
posted by Nelson at 7:17 AM on October 25, 2013 [2 favorites]
It's definitely intrusive and a security risk though. Without having thought about it carefully, I'm OK with a Gmail plugin (with Facebook and LinkedIn credentials) but I'm not OK with LinkedIn actually rewriting my email. The TechCrunch article points out the underlying problem is that the iOS mail app is not extensible. There's no way to hook it to do something like this. Mobile Safari is similarly closed and it's a huge pain in the ass, particularly if you use a password manager on desktops.
(LinkedIn is the only web service I use that has a special filter in my email to shitcan everything they send me. I'm religious about unsubscribing and disabling email notifications, but I was never able to get LinkedIn to stop spamming me. Now they can never email me again.)
posted by Nelson at 7:17 AM on October 25, 2013 [2 favorites]
What's funniest to me about the idea of this is that I would only need it internally. I know everybody outside of the office who I deal with -- it's the people at the company I work for who I keep forgetting.
posted by MCMikeNamara at 7:19 AM on October 25, 2013 [2 favorites]
posted by MCMikeNamara at 7:19 AM on October 25, 2013 [2 favorites]
mhoye, is that (very plausible) speculation or is this documented?
posted by ignignokt at 7:19 AM on October 25, 2013 [7 favorites]
posted by ignignokt at 7:19 AM on October 25, 2013 [7 favorites]
LinkedIn once got ... uh ... a friend of mine to let them scan his or her address book for people they knew on LinkedIn. It then sent out LinkedIn invites to every single email address it found.
So: mailing lists, coworkers, several dead people, and many, many more.
It sucked and my friend not only felt like an idiot, but looked like an idiot to their employer, manager, and coworkers.
posted by zippy at 7:42 AM on October 25, 2013 [1 favorite]
So: mailing lists, coworkers, several dead people, and many, many more.
It sucked and my friend not only felt like an idiot, but looked like an idiot to their employer, manager, and coworkers.
posted by zippy at 7:42 AM on October 25, 2013 [1 favorite]
My favorite is when you present an argument and defend it in an email conversation, three of the managers in the email agree, and the one who doesn't escalates it yet another level, and that manager says "i think we need a mtg re this"I once had a manager who responded to our team's complaints about too many meetings by scheduling all the meetings for one day a week. It wasn't a bad idea in theory. If we're losing productivity from "context switching" during the week, why not avoid that loss of focus by making a Meeting Day when only meetings happen? Then the other four days are Do Work Days. Unsurprisingly, it didn't work because nobody paid attention during the giant eight-hour marathon meeting. But I appreciated the visibility around just how much time was wasted in meetings, that we were actually burning a whole day every week just sitting in a room talking.
NO NO WE DO NOT. WE NEVER NEED A MEETING RE ANYTHING.
posted by deathpanels at 7:42 AM on October 25, 2013 [3 favorites]
That is the exact amount of time required to reply to a multiple-choice question with the single word "ok".
?
posted by mittens at 7:46 AM on October 25, 2013 [1 favorite]
?
posted by mittens at 7:46 AM on October 25, 2013 [1 favorite]
Of course, what everyone ignores is that there already is someone capable of doing a Man-in-the-Middle attack on your email: your provider.
This is less of an issue with work email, as it is accepted that the company are already aware of the secrets and are likely to run their own servers.
posted by jaduncan at 7:47 AM on October 25, 2013
This is less of an issue with work email, as it is accepted that the company are already aware of the secrets and are likely to run their own servers.
posted by jaduncan at 7:47 AM on October 25, 2013
For years now, I've been supplementing my income performing MTM for Mefite commenters, reposting comments posters would otherwise be too embarrassed to make.
posted by klarck at 7:53 AM on October 25, 2013
posted by klarck at 7:53 AM on October 25, 2013
This is like the "free texting" services I've been seeing some of my less technologically adept co-workers get jazzed up about. They don't like it when I tell them its free because the company is somehow selling the content of their private conversations in association with their email address for marketing purposes.
Of course, I use iMessage, so who am I to talk...
posted by snuffleupagus at 10:34 PM on October 25
But that's a feature of a product you, as the end user, had to pay money for, rather than an entire business's main offering funded with Mystery Profits.
posted by DoctorFedora at 7:56 AM on October 25, 2013 [1 favorite]
Of course, I use iMessage, so who am I to talk...
posted by snuffleupagus at 10:34 PM on October 25
But that's a feature of a product you, as the end user, had to pay money for, rather than an entire business's main offering funded with Mystery Profits.
posted by DoctorFedora at 7:56 AM on October 25, 2013 [1 favorite]
Rhomboid: "... and the rest of the internet. Where did anyone get the idea that email had the slightest shred of privacy or security? Unless you're using S/MIME or PGP/GPG and encrypting your messages -- and let's face it, you're not -- every email you send is just floating around out there waiting to be read, just like any web page that you visit without TLS."
Virtually every e-mail system of any size implements STARTTLS for SMTP traffic. I routinely check my e-mail headers for hops traversing the general Internet that lack TLS (why, yes, I am an e-mail aficionado) and the percentage of e-mails I get that aren't encrypted at the SMTP conversation when flowing over the tubes is in the mid single digits these days.
posted by fireoyster at 7:58 AM on October 25, 2013 [3 favorites]
Virtually every e-mail system of any size implements STARTTLS for SMTP traffic. I routinely check my e-mail headers for hops traversing the general Internet that lack TLS (why, yes, I am an e-mail aficionado) and the percentage of e-mails I get that aren't encrypted at the SMTP conversation when flowing over the tubes is in the mid single digits these days.
posted by fireoyster at 7:58 AM on October 25, 2013 [3 favorites]
This is less of an issue with work email,
Certainly a good point. I bet some Corporate IT departments are freaking out right now.
posted by smackfu at 8:06 AM on October 25, 2013
Certainly a good point. I bet some Corporate IT departments are freaking out right now.
posted by smackfu at 8:06 AM on October 25, 2013
It then sent out LinkedIn invites to every single email address it found.
The same thing happened to mathowie.
Why didn't they just make the IMAP and SMTP proxy run locally on the phone? Still breaks PGP and whatnot, but doesn't have the massive privacy issue.
iOS background applications have tons of restrictions. Their behavior must fall into a certain set of allowed activities (playing/recording audio, working with an external device, receiving notifications, etc.) I don't you're allowed to act as a local proxy server for other applications. The takeaway here should be about how Apple's draconian restrictions lead to all kinds of non-ideal outcomes.
Virtually every e-mail system of any size implements STARTTLS for SMTP traffic.
That doesn't really mean anything in terms of security, since there's no guarantee that it was used at every hop. Being optional also means that if you're in a non-passive situation all you have to do is edit out the STARTTLS response keyword from the server and everything will fall back to plain text. Or you could just interpose yourself as an intermediate hop and speak TLS to both ends, but you'll still have a plaintext copy of the message yourself. Because there are no certificates involved, there's no way to detect this.
posted by Rhomboid at 8:10 AM on October 25, 2013
The same thing happened to mathowie.
Why didn't they just make the IMAP and SMTP proxy run locally on the phone? Still breaks PGP and whatnot, but doesn't have the massive privacy issue.
iOS background applications have tons of restrictions. Their behavior must fall into a certain set of allowed activities (playing/recording audio, working with an external device, receiving notifications, etc.) I don't you're allowed to act as a local proxy server for other applications. The takeaway here should be about how Apple's draconian restrictions lead to all kinds of non-ideal outcomes.
Virtually every e-mail system of any size implements STARTTLS for SMTP traffic.
That doesn't really mean anything in terms of security, since there's no guarantee that it was used at every hop. Being optional also means that if you're in a non-passive situation all you have to do is edit out the STARTTLS response keyword from the server and everything will fall back to plain text. Or you could just interpose yourself as an intermediate hop and speak TLS to both ends, but you'll still have a plaintext copy of the message yourself. Because there are no certificates involved, there's no way to detect this.
posted by Rhomboid at 8:10 AM on October 25, 2013
Get email from linkedin which is so easy.
posted by Alexsandra at 8:17 AM on October 25, 2013
posted by Alexsandra at 8:17 AM on October 25, 2013
That is the exact amount of time required to reply to a multiple-choice question with the single word "ok".
?
y
posted by griphus at 8:18 AM on October 25, 2013
?
y
posted by griphus at 8:18 AM on October 25, 2013
> ?
To: mittens
From: ardgedee
Subject: Thrombitz demo
mittens --
The CEO from Thrombitz is coming this afternoon and we still haven't decided on which strategy to pitch for the demo. You're the keyholder on this account and we need to know which pitch we're going with.
_______________________________________________________________________
To: ardgedee
From: mittens
Subject: Re: Thrombitz demo
ok.
As a reminder, I'm heading to the semiannual managerial fishing retreat. No wifi or phone. See you all next week and good luck on the demo!
--mittens
posted by ardgedee at 8:27 AM on October 25, 2013 [7 favorites]
To: mittens
From: ardgedee
Subject: Thrombitz demo
mittens --
The CEO from Thrombitz is coming this afternoon and we still haven't decided on which strategy to pitch for the demo. You're the keyholder on this account and we need to know which pitch we're going with.
_______________________________________________________________________
To: ardgedee
From: mittens
Subject: Re: Thrombitz demo
ok.
As a reminder, I'm heading to the semiannual managerial fishing retreat. No wifi or phone. See you all next week and good luck on the demo!
--mittens
posted by ardgedee at 8:27 AM on October 25, 2013 [7 favorites]
Because there are no certificates involved, there's no way to detect this.
What? No. TLS uses certificates.
posted by nave at 8:31 AM on October 25, 2013
What? No. TLS uses certificates.
posted by nave at 8:31 AM on October 25, 2013
You're the keyholder on this account and we need to know which pitch we're going with.
That isn't a problem, that is a opportunity.
Whenever somebody says "that isn't my job" I hear "I like being stuck where I am"
Something something around to it.
Thank you, I am available for corporate fishing events.
posted by Ad hominem at 8:34 AM on October 25, 2013 [3 favorites]
That isn't a problem, that is a opportunity.
Whenever somebody says "that isn't my job" I hear "I like being stuck where I am"
Something something around to it.
Thank you, I am available for corporate fishing events.
posted by Ad hominem at 8:34 AM on October 25, 2013 [3 favorites]
The idea is linkedIn is a trusted third party reputation service.
That is the funniest single joke comment I have ever read in the history of MetaFilter. You did mean that as a joke, didn't you? Because from the first day I heard of LinkedIn, I came to the conclusion that it would exist as a data collection system for 'professional' victims. And nothing about it I have seen since has contradicted that conclusion.
posted by oneswellfoop at 8:37 AM on October 25, 2013
That is the funniest single joke comment I have ever read in the history of MetaFilter. You did mean that as a joke, didn't you? Because from the first day I heard of LinkedIn, I came to the conclusion that it would exist as a data collection system for 'professional' victims. And nothing about it I have seen since has contradicted that conclusion.
posted by oneswellfoop at 8:37 AM on October 25, 2013
Someone above mentioned the purpose of LinkedIn is to sell their own data to hedge funds and I think this project is just an extension of that. I mean, LI deals in information, and the emails you're sending and receiving are very valuable information (for the market, or to sell to competitors).
Personally, the only thing I use LinkedIn for is "endorsing" my friends for the most bizarre things possible, which is surprisingly easy because they autosuggest things as you type. For example, I just endorsed someone for Paintless Dent Repair and Dim Mak.
posted by antonymous at 8:38 AM on October 25, 2013 [4 favorites]
Personally, the only thing I use LinkedIn for is "endorsing" my friends for the most bizarre things possible, which is surprisingly easy because they autosuggest things as you type. For example, I just endorsed someone for Paintless Dent Repair and Dim Mak.
posted by antonymous at 8:38 AM on October 25, 2013 [4 favorites]
What? No. TLS uses certificates.
It uses ad-hoc/self-signed certificates. There is no chain of trust like there is with https, which means there is no way to know that a mail server is who it claims to be. STARTTLS is not real security, it's a stop-gap measure that prevents only the most casual sort of attack. That is why you must use actual end-to-end encryption with your email if you want security.
posted by Rhomboid at 8:47 AM on October 25, 2013 [2 favorites]
It uses ad-hoc/self-signed certificates. There is no chain of trust like there is with https, which means there is no way to know that a mail server is who it claims to be. STARTTLS is not real security, it's a stop-gap measure that prevents only the most casual sort of attack. That is why you must use actual end-to-end encryption with your email if you want security.
posted by Rhomboid at 8:47 AM on October 25, 2013 [2 favorites]
LinkedIn is an anagram of DinkLine.
It's always struck me as the Pro version of Classmates.com.
posted by Sys Rq at 9:03 AM on October 25, 2013 [3 favorites]
It's always struck me as the Pro version of Classmates.com.
posted by Sys Rq at 9:03 AM on October 25, 2013 [3 favorites]
Nave: http://en.wikipedia.org/wiki/TLS-PSK
(not saying linkedin does this, but certs are not required)
posted by Annika Cicada at 9:05 AM on October 25, 2013
(not saying linkedin does this, but certs are not required)
posted by Annika Cicada at 9:05 AM on October 25, 2013
It uses ad-hoc/self-signed certificates. There is no chain of trust like there is with https, which means there is no way to know that a mail server is who it claims to be.
Well, first, you said there were no certificates. Second, self-signed certificate acceptance is entirely dependent on the level of trust required by the connecting parties and is not an inherent weakness of STARTTLS any more than it is for any public certificate scheme (e.g. HTTPS). The difference is that browsers are configured to reject self-signed certificates (well, display a warning) while MTAs are (generally, unfortunately) not. But it's a political rather than a technical limitation, and frankly I suspect one much easier to solve than having every end user switch to PGP.
That is why you must use actual end-to-end encryption with your email if you want security.
I don't disagree with this, but fireoyster's comment was disputing the conception that email is just flowing across the internet exclusively in plain text rather than that things were perfectly secure.
(not saying linkedin does this, but certs are not required)
Per Rhomboid's followup, the distinction was between CA-signed certificates or self-signed certificates. While pre-shared keys are a possibility, they are not very feasible for public internet services.
posted by nave at 9:28 AM on October 25, 2013 [1 favorite]
Well, first, you said there were no certificates. Second, self-signed certificate acceptance is entirely dependent on the level of trust required by the connecting parties and is not an inherent weakness of STARTTLS any more than it is for any public certificate scheme (e.g. HTTPS). The difference is that browsers are configured to reject self-signed certificates (well, display a warning) while MTAs are (generally, unfortunately) not. But it's a political rather than a technical limitation, and frankly I suspect one much easier to solve than having every end user switch to PGP.
That is why you must use actual end-to-end encryption with your email if you want security.
I don't disagree with this, but fireoyster's comment was disputing the conception that email is just flowing across the internet exclusively in plain text rather than that things were perfectly secure.
(not saying linkedin does this, but certs are not required)
Per Rhomboid's followup, the distinction was between CA-signed certificates or self-signed certificates. While pre-shared keys are a possibility, they are not very feasible for public internet services.
posted by nave at 9:28 AM on October 25, 2013 [1 favorite]
Oh yes. Obviously this is Apple's fault.
(Or perhaps Apple's "draconian restrictions" are there to help protect users from scum like LinkedIn. Nah that can't be it.)
posted by schwa at 9:38 AM on October 25, 2013 [1 favorite]
(Or perhaps Apple's "draconian restrictions" are there to help protect users from scum like LinkedIn. Nah that can't be it.)
posted by schwa at 9:38 AM on October 25, 2013 [1 favorite]
There would be no point to going to all of the trouble of establishing a web of trust for SMTP certificates, because the negotiation to begin STARTTLS happens in plaintext and will therefore always be susceptible to attacks. And there will always be hops that don't support TLS at all, which means that all MTAs are required to support regular plaintext delivery, so it's not like you can just turn that off. To dismiss this as just politics is like saying that all our doors have deadbolts, but nobody has keys so they are never used.
Email that is not encrypted with S/MIME or PGP/GPG is insecure, period. It may or may not be in plaintext on the wire, but that's irrelevant. Encryption without authentication doesn't equal a secure system, it only prevents one type of casual attack while doing nothing to prevent other types.
posted by Rhomboid at 10:04 AM on October 25, 2013 [1 favorite]
Email that is not encrypted with S/MIME or PGP/GPG is insecure, period. It may or may not be in plaintext on the wire, but that's irrelevant. Encryption without authentication doesn't equal a secure system, it only prevents one type of casual attack while doing nothing to prevent other types.
posted by Rhomboid at 10:04 AM on October 25, 2013 [1 favorite]
Or perhaps Apple's "draconian restrictions" are there to help protect users from scum like LinkedIn.
If the goal was to protect users from scummy people, then the result is a failure -- the scummy people found a way to be scummy without violating the draconian restrictions. I don't see how you can spin this as a triumph for draconian measures.
posted by Rhomboid at 10:08 AM on October 25, 2013 [1 favorite]
If the goal was to protect users from scummy people, then the result is a failure -- the scummy people found a way to be scummy without violating the draconian restrictions. I don't see how you can spin this as a triumph for draconian measures.
posted by Rhomboid at 10:08 AM on October 25, 2013 [1 favorite]
NO NO WE DO NOT. WE NEVER NEED A MEETING RE ANYTHING
My dad worked for GM for years. He had a boss who hated meetings but had to hold a mandatory status meeting every Monday, and it would drag on and on. To solve the problem of too-long meetings, he'd have some admins take all the chairs out of the room. And no leaning was allowed, nor was sitting on the furniture.
My dad said the meetings went down to about ten minutes, tops.
posted by disclaimer at 2:16 PM on October 25, 2013 [3 favorites]
My dad worked for GM for years. He had a boss who hated meetings but had to hold a mandatory status meeting every Monday, and it would drag on and on. To solve the problem of too-long meetings, he'd have some admins take all the chairs out of the room. And no leaning was allowed, nor was sitting on the furniture.
My dad said the meetings went down to about ten minutes, tops.
posted by disclaimer at 2:16 PM on October 25, 2013 [3 favorites]
How else are managers supposed to feel important?
I was recently in a meeting with a very tall manager who reached up to the ceiling to turn on the projector, then said "that's the most value I've added to anything today"
posted by russm at 8:04 PM on October 25, 2013 [1 favorite]
I was recently in a meeting with a very tall manager who reached up to the ceiling to turn on the projector, then said "that's the most value I've added to anything today"
posted by russm at 8:04 PM on October 25, 2013 [1 favorite]
"the scummy people found a way to be scummy without violating the draconian restrictions"
By tricking the user into using a man-in-the-middle IMAP server?
"I don't see how you can spin this as a triumph for draconian measures."
What the ever? How does that even make any sense? The only thing this is a "triumph" for is LinkedIn for finding a way past Apple. It's not good for end-users and it's not good for Apple. Apple can (probably) stump this trick by blacklisting the certificate used to sign the profile that LinkedIn needs the user to use.
But of course - far easier to blame Apple for anything that 3rd parties get up to on their platform.
posted by schwa at 8:30 PM on October 25, 2013
By tricking the user into using a man-in-the-middle IMAP server?
"I don't see how you can spin this as a triumph for draconian measures."
What the ever? How does that even make any sense? The only thing this is a "triumph" for is LinkedIn for finding a way past Apple. It's not good for end-users and it's not good for Apple. Apple can (probably) stump this trick by blacklisting the certificate used to sign the profile that LinkedIn needs the user to use.
But of course - far easier to blame Apple for anything that 3rd parties get up to on their platform.
posted by schwa at 8:30 PM on October 25, 2013
far easier to blame Apple for anything that 3rd parties get up to on their platform.
Under a more open model, they could have implemented this properly, as a plugin to the native mail reader application. There would be no need to send everything through LinkedIn's servers, no privacy concerns about what they are doing with all that data, no cause for concern about their security track record, no need to install a dubious certificate, no need to invalidate signatures by rewriting messages, etc. And it could operate under an opt-in model, e.g. by only fetching the information after you click on a name, such that only names that you are actually interested in are fetched without leaking the names of every person you communicate with. All of the evil bad stuff about this plan stems from the fact that you can't just write a plugin/userscript -- this could have been a very reasonable and privacy-respecting feature were that not the case.
posted by Rhomboid at 10:13 PM on October 25, 2013 [1 favorite]
Under a more open model, they could have implemented this properly, as a plugin to the native mail reader application. There would be no need to send everything through LinkedIn's servers, no privacy concerns about what they are doing with all that data, no cause for concern about their security track record, no need to install a dubious certificate, no need to invalidate signatures by rewriting messages, etc. And it could operate under an opt-in model, e.g. by only fetching the information after you click on a name, such that only names that you are actually interested in are fetched without leaking the names of every person you communicate with. All of the evil bad stuff about this plan stems from the fact that you can't just write a plugin/userscript -- this could have been a very reasonable and privacy-respecting feature were that not the case.
posted by Rhomboid at 10:13 PM on October 25, 2013 [1 favorite]
There are a lot of other mailbox apps, though- perhaps some are extensible? Perhaps some might even be worth purchasing by LinkedIn? Or perhaps LinkedIn might even try writing their own? I mean, it's not like the App Store forbids mailbox apps.
posted by Apocryphon at 10:50 PM on October 25, 2013
posted by Apocryphon at 10:50 PM on October 25, 2013
That's a good point. Certainly they could have tried that before going the nuclear route. Is there some reason that people might not want to switch away from the stock app, if a replacement was nearly on par feature-wise?
posted by Rhomboid at 11:11 PM on October 25, 2013
posted by Rhomboid at 11:11 PM on October 25, 2013
That's a good point. Certainly they could have tried that before going the nuclear route. Is there some reason that people might not want to switch away from the stock app, if a replacement was nearly on par feature-wise?
Pretty much every single mail app out there is better than mail app. I still use mail app. I can't be arsed to set up another email program with like 3 accounts again I guess? Also I suspect that an install base of 100% is like pretty compelling when designing a new software thing.
posted by grizzly at 1:23 AM on October 26, 2013
Pretty much every single mail app out there is better than mail app. I still use mail app. I can't be arsed to set up another email program with like 3 accounts again I guess? Also I suspect that an install base of 100% is like pretty compelling when designing a new software thing.
posted by grizzly at 1:23 AM on October 26, 2013
Why anyone would use the Apple mail app when you could use Gmail, I do not know. If you can't use gmail because your work email won't let you IMAP or pop3 into gmail, then I'm sorry. But in that case, you definitely shouldn't be using LinkedIn.
posted by anotherpanacea at 6:53 AM on October 26, 2013
posted by anotherpanacea at 6:53 AM on October 26, 2013
/. "LinkedIn's New Mobile App Called 'a Dream For Attackers'"
posted by JoeXIII007 at 7:25 AM on October 26, 2013
posted by JoeXIII007 at 7:25 AM on October 26, 2013
« Older "I've been coasting on 'great idea' costumes for... | People Dying Like Marion Cotillard Newer »
This thread has been archived and is closed to new comments
posted by R. Mutt at 5:06 AM on October 25, 2013