4 ms·

What an incredibly irresponsible post by Yahoo Tech. No disclaimer, and it is written as a how-to! Am I the only one that thinks that the people at Yahoo Tech

by chavesn 13y ago

What an incredibly irresponsible post by Yahoo Tech. No disclaimer, and it is written as a how-to! Am I the only one that thinks that the people at Yahoo Tech should know better than to make de-facto recommendations to their users to install such kind of hacks that are as dangerous to users as they are in violating the TOS of the website target?

danielweber 13y ago
It's a cluster-fudge alright. The reporter should have, er, reported on what they did and what results they saw. And it left the really big question open: how does this "app" pull the email address? If it's sitting there in the source of the page somehow, this is just a pretty wrapper around a critical LinkedIn bug. If it's doing something else . . . well, I would be really interested in knowing what else it was doing.
- eli 13y ago
  No, not on the page. The extension appears to be making a request to "app.sellhack.com" to look up the LinkedIn member. EDIT: And it's stealing your friends' contact details! Don't install it! https://news.ycombinator.com/item?id=7505728 https://news.ycombinator.com/item?id=7505728
- deleted 13y ago
  [deleted]
- flylib 13y ago
  it's easy to know what it is doing, it isn't using any LinkedIn exploits, it's scraping the name, url and company from the LinkedIn page then constantly running every possible combination against Rapportive and checking to see if it gets any returns and then compares the linkedin url of each return to the linkedin url it got from scraping. Rapportive is ironically a LinkedIn owned company so basically he is just dogfooding LinkedIn to exploit them Identical to something like this but with with a few added steps http://www.emailfinder.io http://www.emailfinder.io
dpweb 13y ago
Reads like a sponsored post.
unreal37 13y ago
I couldn't believe it while reading it. Simply download this extension and you can "Hack In" LinkedIn! How easy!

by chavesn 13y ago

danielweber 13y ago

It's a cluster-fudge alright. The reporter should have, er, reported on what they did and what results they saw. And it left the really big question open: how does this "app" pull the email address? If it's sitting there in the source of the page somehow, this is just a pretty wrapper around a critical LinkedIn bug. If it's doing something else . . . well, I would be really interested in knowing what else it was doing.

eli 13y ago
No, not on the page. The extension appears to be making a request to "app.sellhack.com" to look up the LinkedIn member. EDIT: And it's stealing your friends' contact details! Don't install it! https://news.ycombinator.com/item?id=7505728 https://news.ycombinator.com/item?id=7505728
deleted 13y ago
[deleted]
flylib 13y ago
it's easy to know what it is doing, it isn't using any LinkedIn exploits, it's scraping the name, url and company from the LinkedIn page then constantly running every possible combination against Rapportive and checking to see if it gets any returns and then compares the linkedin url of each return to the linkedin url it got from scraping. Rapportive is ironically a LinkedIn owned company so basically he is just dogfooding LinkedIn to exploit them Identical to something like this but with with a few added steps http://www.emailfinder.io http://www.emailfinder.io

dpweb 13y ago

Reads like a sponsored post.

unreal37 13y ago

I couldn't believe it while reading it. Simply download this extension and you can "Hack In" LinkedIn! How easy!