It’s only been a day since we first introduced you to LinkedIn’s new Intro app for the iPhone that gives emails a more professional edge – in a nutshell, all it does is provide Mail app users an extended introduction to a person sending them messages by showing their LinkedIn bio – but already, some security experts are calling shenanigans, claiming that the new product actually “hijacks” your email.
According to security consulting firm Bishop Fox, LinkedIn Intro actually reconfigures your device so that all your emails go through LinkedIn’s servers. “Once you install the Intro app, all of your emails, both sent and received, are transmitted via LinkedIn’s servers. LinkedIn is forcing all your IMAP and SMTP data through their own servers and then analyzing and scraping your emails for data pertaining to … whatever they feel like,” the company wrote on their blog.
The post went on to enumerate a list of reasons why installing Intro is a big mistake, some of them related to the possible repercussions of unwittingly surrendering the contents of your email to a third-party participant. If you use your work email on your phone, you may be unintentionally violating your company’s policy by using the plug-in; if you regularly correspond with people who usually offer confidentiality in correspondences – like your doctor, lawyer, or therapist – using the feature may relinquish certain legal privileges.
To address these security concerns, LinkedIn added an update to their blog post announcing the new service to ensure that people know at least two important things: That users have to opt into the service before any email encryption happens and that LinkedIn does not store any user emails on its servers.
Researchers were quick to refute LinkedIn’s claims, saying that “in order for LinkedIn to stick changes into an e-mail, they have to decrypt it and then encrypt it again en route to its recipient, adding a new layer of insecurity to e-mail in transit.”
Considering LinkedIn’s seemingly bad reputation when it comes to user data security – 6.5 million usernames and passwords were leaked to a Russian hacker website, and they suffered a major lawsuit because of it – this latest development does not bode well for the social career site. Unless LinkedIn offers a more acceptable and transparent explanation of how Intro works that security experts accept, it almost doesn’t seem worth it to enable the new feature – just go to LinkedIn if you really want to find out more about people on a professional capacity.
