LinkedIn’s iOS app transmits names, emails, and calendar notes, in plain text

http://thenextweb.com/insider/2012/06/06/linkedins-ios-app-collects-and-sends-names-emails-and-meeting-notes-from-your-calendar-back-in-plain-text/

by Kenan • 14 years ago

84 40 14 years ago

thenextweb.com

philip1209• 14 years ago

I don't believe that this is an egregious error.

davidmp• 14 years ago

At least it's opt-in.

rjsamson6• 14 years ago

This is off topic, but the next web really needs to make an effort to properly credit images. They've been called out on this a number of times before, but the way they credit image sources is just plain wrong. In this article, for example, at the very bottom of the page is a generic link that says SOURCES: IMAGE CREDIT. With this particular image, the photographer very clearly says "please, kindly credit me (Nan Palmero) with the photo and link back here" - nowhere do they credit him by name. A quick check of all of the other publications using her photo do properly credit her by name, but the next web can't be bothered.

If the author of this article is reading - PLEASE CREDIT THE PHOTOGRAPHER

madrona• 14 years ago

TNW rips off more than just pictures.

rjsamson6• 14 years ago

Agreed (although this article appears to contain some original reporting), but their neglect for proper image attribution is especially egregious. It is most bothersome to me because all they have to do is mention the guy's name and they get to use his image free of charge, but instead they resort to some sort of half-hidden generic link-back.

richiezc• 14 years ago

sort of off topic but I used to work at LinkedIn and created the foil wrapped logo'd chocolates being photographed. we used them as a giveaway back at CES in 2010 in the blackberry booth.

its cool that the images is offered under CC license and has been included in so many articles about LinkedIn, he should get a photo credit

rjsamson6• 14 years ago

That's pretty cool actually - small world!

damncabbage• 14 years ago

And if the photographer is reading - PLEASE FILE A DMCA TAKEDOWN NOTICE.

(Companies aren't going to pay attention to you as a little guy until you kick them in the pants. Have at it.)

uptown• 14 years ago

Here's everywhere that's using that photo: http://www.tineye.com/search/3dab4395c0ce1c3e010b2fa699cfbfb...

nanpalmero4• 14 years ago

Thank you very much for looking out. It appears that this has been going on a bit. Matthew, can you help with the following pieces that also do not have my name attached to them, please? Doing so on both the desktop and mobile version would be greatly appreciated!

http://thenextweb.com/location/2011/08/01/foursquare-reporte...

http://thenextweb.com/insider/2011/05/14/milestone-foursquar...

http://thenextweb.com/apps/2011/03/17/agora-helps-you-meet-n...

http://thenextweb.com/insider/2011/10/24/linkedin-fixes-bug-...

http://thenextweb.com/apps/2011/08/16/linkedin-launches-slic...

http://thenextweb.com/socialmedia/2011/01/13/32-of-my-friend...

http://thenextweb.com/mobile/2010/08/31/mtv-to-reward-std-ch...

http://thenextweb.com/insider/2011/03/25/foursquare-plans-to...

http://thenextweb.com/insider/2011/01/27/linkedin-files-its-...

@Richiezc what a cool chocolate wrapper, thank you for making such a fun piece.

rjsamson6• 14 years ago

Wow - I knew they were bad at image attribution, but that's just plain awful. And these are just the photos from one photographer that have been improperly used! TNW clearly has a large gap in their reporting standards that needs to be corrected.

cletus• 14 years ago

This is only tangentially related but I really don't understand why anyone cares so highly about their contact list. Does it really matter? Why does it matter?

Concerns about spam seem anachronistic (in that you have to deal with spam and services like Gmail have become pretty good at countering it). Is it just privacy? If so, I'm confused.

MiguelHudnandez• 14 years ago

Perhaps it is a trust issue. When I get someone's contact information, I expect to be consciously aware any time I give that information to someone else.

"Would Alice want Bob to have her contact information? She gave it to me, but that doesn't give me the right to share it with others--it's hers."

It seems like asking an assistant to go through your contacts to prepare for a meeting, and while he's at it, he copies them all to his computer so he can do a better job. A little creepy and maybe acceptable. At best it's not what you asked for.

mark242• 14 years ago

While this is not a direct violation of California law SB1386, it is not a long distance to be able to argue that the companies in question are acquiring unauthorized personal information. While we're not talking SSN, driver's license, etc etc., the definition of PII is only going to expand over time.

Basically, if I don't have a personal contract with LinkedIn, it is extremely thin ice for them to be collecting my e-mail address just because I was invited to one of your meetings.

gurkendoktor2• 14 years ago

Out of principle, an app must not collect what it doesn't need. If the programmer thinks nothing sensitive should be in there, it's still not ok. Unrelated example because you mention the contact list - people who put passwords in there as phone numbers.

What really got to me though are notes. Notes! Of course no user should write "make that fat ass invest in us" in their appointment notes, but that is not how privacy works.

gurkendoktor2• 14 years ago

Not to mention meeting notes that are under a strict NDA.

harlanlewis• 14 years ago

The personal contact info of other individuals is not mine to share. They've entrusted me with their privacy, but it's theirs to continue to hide or share as they will.

saurik• 14 years ago

First off, I will point out: this is not a leak of your contact list, it is a leak of your calendar. You might have a very different perspective of the kind of information you store in your calendar, as it includes (explicitly from the article) meeting notes (in which I can imagine someone even having stored a bunch of sensitive corporate information) and the date/time and location of your upcoming whereabouts.

That said, I will also attempt to answer your question as asked, partly as everyone else is responding to you under the guise "LinkedIn should not get this data", yet, I, generally agree with you: for most people that is the worry of someone who is paranoid. That said, I /can/ come up with legitimate (but unlikely) situations where I'd fear for someone's life based on an address book being accessible from LinkedIn.

However, to me the key problem here is "in plain text": it is one thing for a service that already knows too much about me and the people I work with to know a little more about them, or think about people hacking into LinkedIn (again unlikely), but it is an entirely different thing for everyone sharing the WiFi network I'm on to have my entire contact list: these are people who are actually in a position to take action.

It might be your ex-husband who has been stalking you ever since the divorce, or it might be the creepy guy that hangs out at the comic book shop who seems to have taken slightly too much of an interest in you. It could even be someone running a scam: they go to conferences, intercept as many address books as possible, and try to use the result for some kind of social engineering hack or even identity theft.

If you haven't yet, I thereby implore you to consider "what could I learn about my best friend if I had their entire contact list": looking at it from the vaguely mischievous and voyeuristic stance of it being someone else's data might make it simpler to envision why that person might not want you to know all of that information. If that fails, then try to think about it from the perspective of a thief or an evil employer.

chubot2• 14 years ago

Will you post your email and cell contacts to this thread now? If not, why not?

I'm confused that you're confused. There are a hundred scenarios I can think of. Gmail being good at spam detection is your defense? For one, I get text message spam all the time now. I dont want people having my number who don't need it.

nodata2• 14 years ago

@cletus: would be interesting to see your response to the parent.

bobsy• 14 years ago

> Will you post your email and cell contacts to this thread now? If not, why not?

Well that is completely different to what LinkedIn is doing.

Sending information via plain text is bad but is fairly unlikely to be read in transit. (This isn't to say that it shouldn't be changed)

LinkedIn shouldn't be collecting the data. At the same time it isn't making the data public. It is somewhat unclear what they are doing with it. It is unlikely though that is for some evil scheme.

Compare this to posting a tonne of personal information on what is essentially a public forum. Completely different.

Bjoern• 14 years ago

Why would they choose to transmit the data in plaintext rather than use SSL? Lazy?

MehdiEG2• 14 years ago

Putting aside the issue that much of this data shouldn't have been sent anywhere in the first place, I'll never understand why, in 2012, SSL is still not used by default when sending any sensitive or private data across the network.

It's even more puzzling when we're talking about background data upload when the potential SSL handshake latency isn't going to pose any UX issue. This has boggled my mind for years actually. Why?

0x02• 14 years ago

Maybe it's not an issue for LinkedIn, but the iOS app submission process requires developers to do a lot of paperwork with several governments (US, France) for export compliance when using any kind of crypto.

I can easily see smaller developers deciding to go for HTTP instead of HTTPS just to avoid dealing with all that bureaucracy.

MehdiEG2• 14 years ago

I should go back and take a look at the exact wording of the Apple App Store rules but I never had problems submitting apps that use SSL.

There's one step of the submission process that asks about the use of cryptography and I've always picked the option that doesn't require submitting any additional paperwork - never had problems. I forgot the exact wording but I always worked under the assumption that SSL isn't what Apple is talking about when they ask about the use of cryptography.

If developers had to file paperwork with various governments just to use SSL in their app, then simply using one of the many third party APIs that require SSL (e.g. the Foursquare API) or even just embedding a web browser view that may end up loading an https URL would require the developer to go through the paperwork route to get their app approved. That wouldn't make sense.

jen_h• 14 years ago

Going through CCATS is pretty painless; can't imagine that a public company with a good legal team like LinkedIn would have any issue getting through it if mom & pop shops can DIY without issue.

There are even handy tutorials that other devs have compiled to help the rest of us through it, like http://blog.theanimail.com/iphone-encryption-export-complian... and http://zetetic.net/blog/2009/8/3/mass-market-encryption-ccat....

To this day, LinkedIn's web site still doesn't appear to use SSL by default (I haven't used the mobile app in years after not only snooping my own proxy to see that everything was in clear-text but also finding that it recommended bunches of contacts it shouldn't have; Support was not cooperative in helping me determine why/how they acquired that contact info or how to stop it--I assume the culprit was a surreptitious Address Book siphon). Clear-text access to the Web site is a fantastic feature for employers who want to know what their employees are up to on LinkedIn all day, among other things...I would love to know why they still haven't implemented site-wide SSL by default.

malpern• 14 years ago

We've just posted a response about what we do and don't do. http://blog.linkedin.com/2012/06/06/mobile-calendar-feature/

Important point, all data is shared of SSL.

nodata2• 14 years ago

> Important point, all data is shared of SSL.

What does that mean?

Since comments are disabled on your blog, can you tell us which data was _not_ sent over SSL? (and if that has been fixed now)

89a• 14 years ago

Why would anyone be shocked at this?

They already spam anyone unfortunate to be in the Address Book of someone who signs up for this awful service and connects with their gmail whatever.

brudgers• 14 years ago

What I find interesting is how Linkedin's approach to their mobile app was treated as technological savvy a month ago.

http://venturebeat.com/2012/05/02/linkedin-ipad-app-engineer...

http://news.ycombinator.com/item?id=3920368

gshakir• 14 years ago

I am deeply disturbed by this. Now I know how the connection suggestions show up like they have a fancy algorithm.

LinkedIn’s iOS app transmits names, emails, and calendar notes, in plain text

Related Stories