6 ms·
Linkedin's Response to My "Phishing with Intro" Post
- mfkp 13y agoSeems like they handled this very well. Maybe more security teams are being especially cautious after the Yahoo security reporting fiasco. While I still don't agree with the basic concept behind Intro, I think they handled this appropriately.
- chimeracoder 13y ago> he made it immediately clear that he didn’t call to ask me to take down the post – “Linkedin isn’t that kind of company”. I'm very glad to hear this. Disappointed (in general) that this even needs to be noted, but glad to hear it. Unfortunately, this is not something that can be taken for granted.
- clienthunter 13y agoIf LinkedIn sent me this box of self-aggrandising cruft I'd be geniunely pissed at them for imposing onto me the responsibility for its disposal.
- sutterbomb 13y agoIt's like the Mitch Hedberg bit: "Whenever I walk, people try to hand me out flyers. And when someone tries to hand me out a flyer, it’s kinda like they’re saying, 'Here—you throw this away.'"
- kcen 13y agoI assume when Jordan gave them his address they knew he would actually want the stuff...
- tptacek 13y agoSomeone's obviously champing at the bit to write the comment about t-shirts versus bug bounties. Before they write that, they should consider that a company that doesn't already have a bounty can't simply create one on the spot; those programs need to be reviewed by counsel. I think it's inevitable that most tech companies are going to end up offering formal bounty programs, but you should remember that only a select few do today.
- krallin 13y agoEven if they did, would they actually award the bounty even though the bug was directly taken to a blog post, and not reported to them first? I may be mistaken, but I was under the impression that there generally was a tacit agreement that you only get the bounty if you don't go public with it before it's fixed.
- cddotdotslash 13y agoYou're right - I don't think you qualify for a bounty if you write a blog post and then the team contacts you. Usually there are strict requirements including a responsible disclosure to the company directly.
- x0x0 13y agoplease don't parrot nonsense like "responsible" disclosure; it mangles language to normalize behavior these companies want (what's the opposite of responsible? Not letting companies sit around and procrastinate while users are or may be being exploited is therefore irresponsible.) I'm not necessarily saying people shouldn't disclose first, but labeling it as responsible is grating.
- icelancer 13y ago>I'm not necessarily saying people shouldn't disclose first, but labeling it as responsible is grating. Absolutely. That kind of language marginalizes people who are public whistleblowers who have no faith in the internal systems in which they reside.
- tptacek 13y agoI loathe the term too, but am steeling myself to concede it, since it's rapidly becoming an industry standard.
- pgeorgi 13y agoso it's optimistic disclosure? assume that the vendor will respond responsibly.
- usaphp 13y agoI would prefer an actual check or some sort of evaluation of the time he spent on the phone/email trying to explain the fix to linked in. Sending him a bunch of advertising materials with logos all over them is kind of disrespectful I think.
- hobs 13y agoThe guy could certainly have just ignored the phone call, just because the company contacts you does not mean you need to help them (even if they are being nice). While I think that a bug bounty is the RIGHT thing to do in this scenario, the security guy likely couldn't just decide on his own to give out thousands of dollars, so something is better than nothing, and if the expectation was nothing, then well, sounds decent to me.
- tptacek 13y agoI think that is literally true; that is, I think that a security person at a large company would be in serious trouble if they paid someone for reporting a security vulnerability out of their own pockets. There are legal implications to opening up a bug bounty.
- mintplant 13y agoIs there a reason why LinkedIn couldn't have run the IMAP proxy on the device itself, instead of having email pass through their remote servers?
- ceejayoz 13y agoApps can't elect to be started up when the phone boots, nor can they count on avoiding being killed if the user is running a graphically intense game or something.
- victorf 13y agoExcept VoIP apps, since we want all apps with that capability to start on boot even if we only use them once a month, and we don't want any others to start on boot even if we use them daily. iOS regulations are so stupid.
- victorf 13y agoBackgrounding the app closes all its sockets, or you cannot rely on them to stay open except for VoIP apps.
- shaggyfrog 13y ago> "Linkedin isn’t that kind of company" But it is the kind of company that set up this massive MITM hole in the first place, and thought it was a good idea to "offer" this "feature" to unsuspecting targets, er, "users". They may have fixed this "bug", but the bug that is the feature itself remains, and it can only be fixed in one way...
- TheBiv 13y agoI get the snark. But using their own words against them is very disingenuous. Recognizing people for being good people, as the author did, should be completely separate from a product that you believe is a bad product.
- mehwoot 13y agousing their own words against them is very disingenuous. How is that disingenuous? Was the accusation not sincere?
- TheBiv 13y agoDisingenuous meaning not truthful, which it was not.
- mehwoot 13y agoThat's not what the word means. 1. Not straightforward or candid; insincere or calculating 2. Pretending to be unaware or unsophisticated; 3. Unaware or uninformed; naive. Generally it is used to mean untruthful on purpose, with an intent to deceive, usually by acting as if you're unaware of something.
- laureny 13y agoSo they rewarded you by sending you merchandising for their company. I was hoping that at the very least, they'd offer you a job.
- jkrems 13y ago1. Finding one security problem is not necessarily enough to qualify for a job offer 2. They sent him a trophy. It wasn't just any ball pen with the company logo but a nice, topical t-shirt As someone else pointed out - he disclosed the vulnerability publicly before informing LinkedIn. Most companies wouldn't have given him anything.
- cmac2992 13y agoThis is the way a business should be run. LinkedIn gets a +1 in my book
- acosmism 13y agoagreed, a+
- xacaxulu 13y agoEveryone makes mistakes. It looks like LinkedIn's team handled this in a professional manner. I can dig it.
- avenger123 13y agoI don't want to be cynical but when I read small token of appreciation, I thought it would be something more than just branded stuff from the company. You could argue that all they could send was LinkedIn marketing material but it just rubs me the wrong way when companies put out their branded trinkets as "gifts". Please just give me the money. I'll decide which companies I will do free advertising for.
- wiml 13y agoMeh, that's why it's a token of appreciation. If I were the guy, I'd be more offended by money than by some marketing trinket; sending me money implies they thought my involvement was worth that amount of money, and it's unlikely they would send enough to correspond to a reasonable hourly rate. Sending a trinket with no monetary value makes no such implication; it's purely a social gesture, not an economic one. On the other hand, if some company wants to thank me for something in the future with something more than tradeshow swag, I would not turn down a nice bottle of whisk[e]y, just sayin'.
- avenger123 13y agoYou have a point.
- eridius 13y agoI missed the original "Phishing with Intro" post. After reading it now, and the update, from the description it sounds like all they did was randomize the ids to make it hard to target the LinkedIn content with CSS. But surely it's still possible, no? The content is injected at the head of the body, so just target it using sibling selectors. You can't override any !important style this way (as the ID selector takes precedence), but maybe you could find a non-!important-specified style that can still be used to affect it. Heck, maybe just set a -webkit-transform that collapses the height to 0.
- vladtaltos 13y agoThey should have paid the guy - not send cheap trinkets. And also no chump change as well. He went out of his way to even help them roll-out the hot fix. Don't be a 'cheap kind of company' linkedin. Pay up.
- jmcgough 13y agoI've never really liked Linkedin's product that much, but they addressed this issue in a very mature way - instead of rebuking it in a press release or arguing with him, they fixed the issue and thanked him. I'm impressed.
- saravanaj 13y agoBollocks.
- nicholassmith 13y agoThat's a pretty awesome tshirt, least LinkedIn security did a good job with their response and some awesome swag.