4 ms·

I'd still like to know whats technically going on. There are bold accusations in another thread (https://news.ycombinator.com/item?id=6425444)for https://news.y

by chopin 13y ago

I'd still like to know whats technically going on. There are bold accusations in another thread (https://news.ycombinator.com/item?id=6425444)for https://news.ycombinator.com/item?id=6425444)for which I do not understand how they are accomplished technically. Both XSRF and simply OAuth seem possible. The latter can't go on unnoticed, imho.

msandford 13y ago
What happens is that when you click on a "This person wants to connect with you..." link in an email LinkedIn's website connects you automatically. BUT they throw up a page that looks a HELL OF A LOT like a "you're not logged in yet page" that has a password form on it which SEEMINGLY prompts you to login to their site. What it's actually doing is prompting you to give them your email password so that they can login and scrape contacts. I know this because I've nearly fallen for it myself in the last couple of months. Thankfully I have some internet savvy. The folks who are suing probably saw "please enter a password" and entered one and just happened to use the same password for LinkedIn as their email; LinkedIn thus "hacked" their emails. I think LinkedIn should have to face some heat for this for deceiving people, though I don't believe what they're doing is technically hacking.
- tonfa 13y ago
  > I don't believe what they're doing is technically hacking Social engineering is often considered hacking.
  - msandford 13y ago
    Yeah I would agree with that. It's "unauthorized access" for nearly all reasonable definitions of "unauthorized". I guess when I said "not technically hacking" what I meant was that I don't believe they're doing XSS or brute-force or SQL injection or something along those lines.
- lukeschlather 13y ago
  Legally, there's no definition of hacking. LinkedIn does seem to be guilty of violating the same statute most "hackers" are prosecuted under, making it a felony to access a computer without authorization. Really, what they're doing is textbook password phishing.

by chopin 13y ago

msandford 13y ago

What happens is that when you click on a "This person wants to connect with you..." link in an email LinkedIn's website connects you automatically. BUT they throw up a page that looks a HELL OF A LOT like a "you're not logged in yet page" that has a password form on it which SEEMINGLY prompts you to login to their site. What it's actually doing is prompting you to give them your email password so that they can login and scrape contacts. I know this because I've nearly fallen for it myself in the last couple of months. Thankfully I have some internet savvy. The folks who are suing probably saw "please enter a password" and entered one and just happened to use the same password for LinkedIn as their email; LinkedIn thus "hacked" their emails. I think LinkedIn should have to face some heat for this for deceiving people, though I don't believe what they're doing is technically hacking.

tonfa 13y ago
> I don't believe what they're doing is technically hacking Social engineering is often considered hacking.
- msandford 13y ago
  Yeah I would agree with that. It's "unauthorized access" for nearly all reasonable definitions of "unauthorized". I guess when I said "not technically hacking" what I meant was that I don't believe they're doing XSS or brute-force or SQL injection or something along those lines.
lukeschlather 13y ago
Legally, there's no definition of hacking. LinkedIn does seem to be guilty of violating the same statute most "hackers" are prosecuted under, making it a felony to access a computer without authorization. Really, what they're doing is textbook password phishing.