LinkedIn ‘Intro’duces Insecurity
Well lets take these one-by-one:<p>-------------<p>1. Attorney-client privilege.<p>I'm guessing most law firms use third party email servers, anti-virus, anti-spam and archive/audit systems which this would also apply to. It would also apply if you're using Raportive, Xobni or the like (or integrated time-tracking, billing, crm, etc.).<p>-------------<p>2. By default, LinkedIn changes the content of your emails.<p>Irrelevant. Unless you read your emails in plain text every modern email client changes how email is displayed.<p>-------------<p>3. Intro breaks secure email.<p>Yes. Except iOS mail doesn't support crypto signatures anyway.<p>-------------<p>4. LinkedIn got owned.<p>Yes. LinkedIn adds an extra point of vulnerability.<p>-------------<p>5. LinkedIn is storing your email communications.<p>Well metatdata but yes.<p>-------------<p>7. It’s probably a gross violation of your company’s security policy.<p>Yes. As is using Linkedin itself. Or Dropbox. Or Github. Or Evernote. Or Chrome. Or any enterprise software that uses the bottom up approach.<p>-------------<p>8. If I were the NSA…<p>The NSA has access to your emails if they want them anyway. Email isn't a secure protocol against a well funded adversary.<p>-------------<p>9. It’s not what they say, but what they don’t say<p>This looks like a semantic dispute, but it doesn't look any more vague than say Google's privacy policy. Companies in certain circumstances are legally required to provide access to information.<p>-------------<p>10. Too many secrets<p>These all seem to be questions that can either be answered by testing or ones that LinkedIn would probably be happy to disclose, but unlikely to be major issues to mainstream users.<p>-------------<p>So fundamentally it comes down to two points, granting Linkedin access to your email creates a new point of attack and Linkedin themselves might use your email in ways you find undesirable.<p>So it's essentially a trade-off for the benefits you get from the app versus those risks. For a personal account which you use for private emails, personal banking, etc. the evaluation is obviously going to be very much different from say a salesperson's work account which they use for managing communication with leads.<p>In the later case they may already be trusting LinkedIn with similar confidential information and already use multiple services (analytics, crm, etc.) that hook into their email so the additional relative risk might be smaller.<p>As people with technical expertise we shouldn't use scare-mongering to push our personal viewpoints upon those with less expertise, but rather help people understand the security/benefit trade-offs that they're making so they can decide for themselves whether to take those risks.<p>It's important to treat the wider non-technical community with respect and as adults capable of making their own judgements and not as kids who need to be scared into safety.