Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Monday, 20 March, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

LinkedIn defends Intro over man-in-the-middle claims

by The Gurus
November 22, 2013
in Editor's News
Share on FacebookShare on Twitter

LinkedIn has defended itself after it was criticised over its Intro product and accused of using “man in the middle” tactics.

In this time of heightened awareness around surveillance, and after a scathing report by security firm Bishop Fox which pointed out that upon downloading it, all IMAP and SMTP data is sent through LinkedIn’s servers, the social network has responded by calling the assertions “inaccurate”.
When it was announced last week, it was described as a “ rich, interactive, application-like experience” whose function was to add a person’s name and job title to an email header with support offered for Gmail, Google Apps, Yahoo! Mail, AOL Mail, and iCloud — all in the iPhone Mail app.
However the Bishop Fox report claimed that this was effectively a man-in-the-middle tactic, as all emails are monitored, the rules were not clear as “the privacy policy is ambiguous and vague”. It also pointed out that it unsecures email, stores email communications and “it is probably a gross violation of your company’s security policy”.
In response, LinkedIn’s Cory Scot
t said that what had been said generally were “
not correct or are purely speculative”. He said: “When the LinkedIn Security team was presented with the core design of Intro, we made sure we built the most secure implementation we believed possible. We explored numerous threat models and constantly challenged each other to consider possible threat scenarios.”
Scott said in advance of the launch of Intro it performed hardening of the externally and internally-facing services and reduced exposure to third-party monitoring services and tracking, and had its internal team of experienced testers penetration-test the final implementation, and make sure the right monitoring was in place to detect any potential attacks, react quickly, and immediately minimise exposure.
In terms of secure communications, it uses SSL/TLS at each point of the email flow between the device, LinkedIn Intro and the third-party mail system, he said, and when mail flows through the LinkedIn Intro service, LinkedIn made sure that it never persists the mail contents to its systems in an unencrypted form. Also once the user has retrieved the mail, the encrypted content is deleted from our systems.
In a direct comment to the Bishop Fox report, Scott said that it “simply adds an email account that communicates with Intro” and it does not change the device’s security profile in the manner described by Bishop Fox. “We worked to help ensure that the impact of the iOS profile is not obtrusive to the member,” he said.
He said that LinkedIn takes privacy very seriously and product design decisions and subsequent implementation are reviewed against its policies by its security and legal teams.
He concluded by saying that it welcomes and encourages an open dialogue about the risks but it felt it necessary to “correct the misperceptions” in this case.
FacebookTweetLinkedIn
ShareTweetShare
Previous Post

EU authorities regularly targeted by cyber attacks

Next Post

Carriers say smartphone ‘kill switch’ would be a juicy target for hackers

Recent News

Nominations are Open for 2023’s European Cybersecurity Blogger Awards

Nominations are Open for 2023’s European Cybersecurity Blogger Awards

March 20, 2023
TikTok to be banned from UK Government Phones

TikTok to be banned from UK Government Phones

March 17, 2023
New AT&T Cybersecurity USM Anywhere Advisors Service Helps to Establish and Maintain Threat Detection and Response Effectiveness

Should Your Organization Be Worried About Insider Threats?

March 17, 2023
Guild Education controls API abuse with Salt Security

Guild Education controls API abuse with Salt Security

March 16, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information