LinkedIn Intro: Doing the Impossible on iOS
I don't think I've ever gagged quite like that while reading a technical article describing a "neat hack".<p>At first I'm thinking, oh, I wonder how they convinced Apple to let them use some private APIs, and then... curiosity turns to revulsion as soon as I saw that proxy diagram.  Good god... LinkedIn MITM IMAP. That is truly terrifying.<p>How would you even go about <i>installing</i> that on the user's phone? Oh, that's in there too... they ship a 'configuration profile' which adds a new email account, so your password is leaving the device in cleartext and being used to create the profile server-side which is then shipped back to the phone and installed, how exactly?<p>This just gets worse and worse if I understand correctly... I'm surprised that configuration profiles can be shipped to an arbitrary device from a third party this way without the user manually installing LinkedIn's certificate as trusted. In other words, it should be a lot harder to "Accept" these profiles outside an enterprise setting, because it sounds exploitable.  What else can you configure "so easily" I wonder?<p>Then you get into how they are hacking CSS and iframes into the email body, to substitute for Javascript, and actually create a workable user interface. Now this is fascinating, impressive, and deserves further study... Without fully understanding exactly what they are doing, however, it sounds highly abusive of the Mail app's rendering capabilities, and points to exploitable paths within the Mail app that probably need to be tightened up by Apple. If LinkedIn can make an email "act" like that without any opt-in on my part, how would Mallory use the same "feature" in their latest SPAM campaign?<p><s>Thanks LinkedIn... really, I'm impressed. When exactly did Walter Bishop start working for you?</s><p>P.S. I look forward to following your pending class-action lawsuit for violation of US federal wiretapping laws. Cheers!