|
It appears that the developers at LinkedIn may not have had encryption training on their own resumes. Two stories about potential user data leakage at the networkingcompany trickled out late Tuesday and early Wednesday. Onesuggested that the LinkedIn iOS app may leak personal data from your calendar to the LinkedIn website;the second report indicates that a Russian hacker may have posted6.5 million LinkedIn passwords on the Web. First, the iOS app issue: As initially reported by The Next Web , Skycure Security says that when you use the LinkedIn app s calendar feature, whichoptionally accesses your iOS calendar details so that it can findLinkedIn profiles for the folks you re meeting with. Skycure saysthat rather than solely access information on calendar attendees,the app instead passes the complete details from your calendarentries including the meeting title, organizer, location, time,and any notes you ve added. In a response on its own blog , LinkedIn clarifies that the data it sends to its servers fromyour calendar is sent over SSL, which means it uses a secureconnection that third parties can t peek at while your data is intransit between your phone and LinkedIn s servers. The companyalso says that it doesn t store your calendar information or shareit with others, and stresses that it only accesses your calendardata at all if you explicitly ask it to do so. LinkedIn adds that the next version of its iOS app will no longersend data from the meeting notes section of your calendar event, and it will add a link to provide more information about how yourcalendar data is being used which it says is simply to findcontacts by name or email address who have profiles on LinkedIn. The leaked password issue, however, is perhaps even moreconcerning. As Mashable reports , a Russian hacker claims he successfully stole data from LinkedIn,and has uploaded 6.5 million passwords from the site as proof. Thepasswords aren t linked to usernames, but Finnish security company Cert-Fi says that it s likely the hacker has access to the usernames aswell. Mashable says that though the passwords are encrypted with theSHA-1 hash function, they aren t salted. In plain English, thatmeans that it s easier for an enterprising hacker to figure outwhat passwords the encrypted hashes represent through trial anderror; a salt adds a significantly more complicated degree ofencryption, but apparently wasn t in use by LinkedIn. LinkedIn said on Twitter that it s investigating the potential password hack. In themeantime, it's another good reminder to use a different passwordfor each of your different Web services; if you have a LinkedInaccount and use the same password elsewhere, you may want to startchanging some of those passwords now. I am an expert from nmgzsw.com.cn, while we provides the quality product, such as China Wifi Enabled Phone , Wifi Enabled Phone, Wifi Enabled Phone,and more.
Related Articles -
China Wifi Enabled Phone, Wifi Enabled Phone,
|
