With twin security breaches – one of which was self-inflicted – LinkedIn suffered a brutal one-two punch to its reputation on Wednesday.
But analysts who watch the online privacy space caution to expect lapses like this to become more and more routine.
"This is just the latest data mismanagement fiasco," said Kris Tuttle, an analyst at Research 2.0. "To be honest, we get one of these breaches or another every other day. I think you're going to see this for a long time to come."
The social network site for professionals said it is looking into reports that a hacker posted 6.5m of its users' passwords online.
That news came just hours after two Israeli researchers revealed that LinkedIn is scraping user data from their calendars in mobile Apple devices, sending private information back to LinkedIn's servers.
"This will be a pervasive problem for the next 10 years. As long as there are human beings involved you're going to have a prevalence of these privacy and security breaches," said Tuttle.
"If they were an advisory client, I would say: 'You should make a CEO level commitment to spend the money on the best resources you can get and be the best practices leader in the area.' And they could. IBM is one phone call away and you're set."
Tuttle points out that as companies like LinkedIn or Facebook go through redesigns or overhauls, as they often do, privacy default settings often change without users realizing it.
But it's only going to get worse, he said, as everything from social networks to banks to any other service that trades in private information go through systemic upgrades.
"As companies are totally refreshing security infrastructure, it's going to remain a problem, this inconvenience of people having to change their data and update their passwords," he said.
"It's virtually impossible to pay attention to everything. One thing I would say is make sure you don't put too much of your privacy at risk."
A Russian forum user claimed Tuesday that he had hacked the professional social network, uploading 6,458,020 encrypted passwords (without usernames) as proof. That is a small fraction of LinkedIn's 150 million users, but still a significant breach.
LinkedIn encrypts its passwords using an algorithm called SHA-1, a hashing algorithm. ZDNet readers and several Twitter users have reported finding their passwords in the posted list of leaked info.
The company announced that it was "looking into reports of stolen passwords" on Wednesday morning, and experts advised users to change their passwords immediately.
Still, the news comes at an awkward time for LinkedIn. Just hours earlier, two researchers from Tel Aviv University revealed that the company's iOS app collects private information from calendar entries – including meeting notes – and sending them back to the company's servers without the knowledge of LinkedIn's customers.
"When it comes to social networks – particularly business social networks – trust is an important factor," said industry analyst Michael Gartenberg. "This morning you have two strikes against the company."
Calendar notes can often contain highly private information such as conference call login information, contact information of colleagues and even passwords.
"This is really hard to justify without explicit user permission. It's a major breach of trust," said Gartenberg. "It will be interesting to see how people react."
So far people are reacting with jokes.
LinkedIn does not have the sexy reputation of a younger-skewing social network like Facebook or Tumblr. Comedian Rob Delaney tweeted of the password leak Wednesday morning:
And finance journalist Felix Salmon slyly referred to the fact he is at a loss as to what his password was in the first place.
Others poked fun at the relentless reminder emails LinkedIn sends its users about unanswered invitations to connect.
But LinkedIn has been one of the more successful tech IPOs of the post-dotcom bubble era (or second bubble era, depending on your point of view). It has become a vital life insurance policy for people who find themselves looking for work, a good place to network, and an invaluable sales and human resources tool.
The company went public in May, trading at $93 a share. The shares hit an intraday low of $91.60 on Wednesday on the double blast of bad news.
"LinkedIn worked hard and established trust," said Gartenberg. "This is about a bad a one-two punch as it can get for a social network."
LinkedIn did not immediately return calls seeking comment.
The company posted a lengthy statement to its website Wednesday morning:
For those not familiar with our calendar feature, with your permission, we sync with your mobile device's calendar to provide information about the people you are about to meet by showing you their LinkedIn profile.
In order to provide our calendar service to those who choose to use it, we need to send information about your calendar events to our servers so we can match people with LinkedIn profiles. That information is sent securely over SSL and we never share or store your calendar information.
Not everyone was won over by LinkedIn's response.
"If that's the case – if you'd 'never use it' – why were you taking it? Why weren't you asking for permission," asked Gartenberg.
"If companies say 'We would never do anything with this information,' I always think there's an implicit 'today'. They won't use it now, but what happens when the company gets sold or something happens?"
Source: http://www.guardian.co.uk/technology/us-news-blog/2012/jun/06/linked-in-privacy-breach-hack
Note:
But analysts who watch the online privacy space caution to expect lapses like this to become more and more routine.
"This is just the latest data mismanagement fiasco," said Kris Tuttle, an analyst at Research 2.0. "To be honest, we get one of these breaches or another every other day. I think you're going to see this for a long time to come."
The social network site for professionals said it is looking into reports that a hacker posted 6.5m of its users' passwords online.
That news came just hours after two Israeli researchers revealed that LinkedIn is scraping user data from their calendars in mobile Apple devices, sending private information back to LinkedIn's servers.
"This will be a pervasive problem for the next 10 years. As long as there are human beings involved you're going to have a prevalence of these privacy and security breaches," said Tuttle.
"If they were an advisory client, I would say: 'You should make a CEO level commitment to spend the money on the best resources you can get and be the best practices leader in the area.' And they could. IBM is one phone call away and you're set."
Tuttle points out that as companies like LinkedIn or Facebook go through redesigns or overhauls, as they often do, privacy default settings often change without users realizing it.
But it's only going to get worse, he said, as everything from social networks to banks to any other service that trades in private information go through systemic upgrades.
"As companies are totally refreshing security infrastructure, it's going to remain a problem, this inconvenience of people having to change their data and update their passwords," he said.
"It's virtually impossible to pay attention to everything. One thing I would say is make sure you don't put too much of your privacy at risk."
A Russian forum user claimed Tuesday that he had hacked the professional social network, uploading 6,458,020 encrypted passwords (without usernames) as proof. That is a small fraction of LinkedIn's 150 million users, but still a significant breach.
LinkedIn encrypts its passwords using an algorithm called SHA-1, a hashing algorithm. ZDNet readers and several Twitter users have reported finding their passwords in the posted list of leaked info.
The company announced that it was "looking into reports of stolen passwords" on Wednesday morning, and experts advised users to change their passwords immediately.
Still, the news comes at an awkward time for LinkedIn. Just hours earlier, two researchers from Tel Aviv University revealed that the company's iOS app collects private information from calendar entries – including meeting notes – and sending them back to the company's servers without the knowledge of LinkedIn's customers.
"When it comes to social networks – particularly business social networks – trust is an important factor," said industry analyst Michael Gartenberg. "This morning you have two strikes against the company."
Calendar notes can often contain highly private information such as conference call login information, contact information of colleagues and even passwords.
"This is really hard to justify without explicit user permission. It's a major breach of trust," said Gartenberg. "It will be interesting to see how people react."
So far people are reacting with jokes.
LinkedIn does not have the sexy reputation of a younger-skewing social network like Facebook or Tumblr. Comedian Rob Delaney tweeted of the password leak Wednesday morning:
And finance journalist Felix Salmon slyly referred to the fact he is at a loss as to what his password was in the first place.
Others poked fun at the relentless reminder emails LinkedIn sends its users about unanswered invitations to connect.
But LinkedIn has been one of the more successful tech IPOs of the post-dotcom bubble era (or second bubble era, depending on your point of view). It has become a vital life insurance policy for people who find themselves looking for work, a good place to network, and an invaluable sales and human resources tool.
The company went public in May, trading at $93 a share. The shares hit an intraday low of $91.60 on Wednesday on the double blast of bad news.
"LinkedIn worked hard and established trust," said Gartenberg. "This is about a bad a one-two punch as it can get for a social network."
LinkedIn did not immediately return calls seeking comment.
The company posted a lengthy statement to its website Wednesday morning:
For those not familiar with our calendar feature, with your permission, we sync with your mobile device's calendar to provide information about the people you are about to meet by showing you their LinkedIn profile.
In order to provide our calendar service to those who choose to use it, we need to send information about your calendar events to our servers so we can match people with LinkedIn profiles. That information is sent securely over SSL and we never share or store your calendar information.
Not everyone was won over by LinkedIn's response.
"If that's the case – if you'd 'never use it' – why were you taking it? Why weren't you asking for permission," asked Gartenberg.
"If companies say 'We would never do anything with this information,' I always think there's an implicit 'today'. They won't use it now, but what happens when the company gets sold or something happens?"
Source: http://www.guardian.co.uk/technology/us-news-blog/2012/jun/06/linked-in-privacy-breach-hack
Note:
Delta Ray is experienced web scraping consultant and writes
articles on Yellow
Pages Data Scraping, Screen
Scraping Services, Linkedin
Email Scraping, Amazon Product Scraping, Website Harvesting, IMDb Data
Scraping, Yelp Review Scraping, Screen Scraping Services, Yelp Review Scraping
and yellowpages data scraping.
No comments:
Post a Comment