4 ms·

Wouldn't this essentially allow them access to read/analyze/archive all of your email for any account you set up?

by cag_ii 13y ago

madoublet 13y ago
I would like to hear more about the security around this. Given LinkedIn's reputation, this is a bit scary.
nwh 13y ago
Of course. They can send as you too, which given their spammy record is quite a huge issue. They will also be storing your IMAP password in plaintext.
- timdorr 13y ago
  Since they are proxying the request, they don't actually have to store the password at all.
  - philsnow 13y ago
    It took me a moment to understand what you're saying, which (correct me if I'm wrong) is that they could just forward the credentials along to the imap server they're proxying for, and not store those credentials themselves.
  - michaelmior 13y ago
    Good point :)
  - SideburnsOfDoom 13y ago
    They don't have to store your email password, no. However, in 2013 it should be clear that it is no way whatsoever safe to just assume that information flowing through a third party's server will not be stored.
- michaelmior 13y ago
  Anyone can send email as anyone else anyway. That lack of security is inherent in the way email currently works. Not sure I see how giving IMAP access makes things worse since IMAP doesn't have a mechanism for sending messages. I would also hope they're not storing passwords in plaintext. Obviously they need access to the plaintext password to auth with your mail server, but I would hope this is still stored encrypted.
  - nwh 13y ago
    > Anyone can send email as anyone else anyway. Many emails are signed with DKIM now, which does help with verifiability. > but I would hope this is still stored encrypted Encryption is pointless when the keys for decryption are on the same server. Given their hack in 2012, I doubt there's any protection at all.
    - michaelmior 13y ago
      Which is why the key should be physically given to the system when it is started and then only stored in memory. The key file should not be available on any network-attached machine. Of course there's still potential for exploits in this scenario, but it does help minimize the attack surface.
      - nwh 13y ago
        Given their response several parents up, it's being stored on disk permanently.
- rahulvohra 13y ago
  We don't store passwords or emails. Checkout our pledge of privacy: https://intro.linkedin.com/micro/privacy https://intro.linkedin.com/micro/privacy
  - nwh 13y ago
    According to the linked document: • passwords are stored for a minute, maybe up to two hours • emails are stored for a few minutes, maybe a few hours Most clients will poll for emails every few minutes, which means that the storage of the passwords is for all intents; permanent.
  - cstrat 13y ago
    I am sure you do store sender/recipient information and relationships between recipients - even if they are not connected...

Wouldn't this essentially allow them access to read/analyze/archive all of your email for any account you set up?

by cag_ii 13y ago

Wouldn't this essentially allow them access to read/analyze/archive all of your email for any account you set up?

madoublet 13y ago

I would like to hear more about the security around this. Given LinkedIn's reputation, this is a bit scary.

nwh 13y ago

Of course. They can send as you too, which given their spammy record is quite a huge issue. They will also be storing your IMAP password in plaintext.

timdorr 13y ago
Since they are proxying the request, they don't actually have to store the password at all.
- philsnow 13y ago
  It took me a moment to understand what you're saying, which (correct me if I'm wrong) is that they could just forward the credentials along to the imap server they're proxying for, and not store those credentials themselves.
- michaelmior 13y ago
  Good point :)
- SideburnsOfDoom 13y ago
  They don't have to store your email password, no. However, in 2013 it should be clear that it is no way whatsoever safe to just assume that information flowing through a third party's server will not be stored.
michaelmior 13y ago
Anyone can send email as anyone else anyway. That lack of security is inherent in the way email currently works. Not sure I see how giving IMAP access makes things worse since IMAP doesn't have a mechanism for sending messages. I would also hope they're not storing passwords in plaintext. Obviously they need access to the plaintext password to auth with your mail server, but I would hope this is still stored encrypted.
- nwh 13y ago
  > Anyone can send email as anyone else anyway. Many emails are signed with DKIM now, which does help with verifiability. > but I would hope this is still stored encrypted Encryption is pointless when the keys for decryption are on the same server. Given their hack in 2012, I doubt there's any protection at all.
  - michaelmior 13y ago
    Which is why the key should be physically given to the system when it is started and then only stored in memory. The key file should not be available on any network-attached machine. Of course there's still potential for exploits in this scenario, but it does help minimize the attack surface.
    - nwh 13y ago
      Given their response several parents up, it's being stored on disk permanently.
rahulvohra 13y ago
We don't store passwords or emails. Checkout our pledge of privacy: https://intro.linkedin.com/micro/privacy https://intro.linkedin.com/micro/privacy
- nwh 13y ago
  According to the linked document: • passwords are stored for a minute, maybe up to two hours • emails are stored for a few minutes, maybe a few hours Most clients will poll for emails every few minutes, which means that the storage of the passwords is for all intents; permanent.
- cstrat 13y ago
  I am sure you do store sender/recipient information and relationships between recipients - even if they are not connected...