LinkedIn Intro? No thanks. My email security is too important

LinkedIn wants iPhone users to sign-up for a new service called Intro. My advice? Don’t.

LinkedIn Intro extends the standard iOS Mail app in ways that Apple never intended to be possible, injecting HTML code into the top of the emails you receive so you can view someone’s LinkedIn profile alongside their message.

In a fairly self-congratulatory blog post entitled “LinkedIn Intro: Doing the Impossible on iOS”, LinkedIn engineers explain just how clever they have been.

And yes, to give them credit, from the engineering point of view it is pretty nifty. But from the security and privacy point of view it sends a shiver down my spine.

Rather than your iPhone connecting directly to your email provider’s servers (Gmail, Yahoo, etc), it will be connecting via LinkedIn’s proxy server instead – which will act as a middle-man in your email communications.

LinkedIn will then look at your email messages, and insert Intro information into each one.

In case you’ve forgotten, LinkedIn is the company which lost the passwords of over six million users last year.

LinkedIn also scooped up the contents of users’ iOS calendars, including sensitive information such as confidential meeting notes and call-in numbers – which they then transmitted in plain text, not encrypted.

LinkedIn is also, currently, the subject of a lawsuit alleging that they hacked into email accounts, in an attempt to mine address books.

Whether you believe that that lawsuit has merit or not, it’s clear that LinkedIn doesn’t have a spotless record when it comes to security and privacy.

I’m not suggesting that it has created LinkedIn Intro with any malicious intentions (unless you consider them injecting an advertisement for their its brand in every email malicious), but clearly security is not part of the company’s DNA – and that troubles me.

Furthermore, I find it hard to imagine any security-conscious firm being comfortable with its employees handing LinkedIn access to its emails.

And *why* do you even *need* LinkedIn Intro anyway?

If you receive a business email from someone, don’t they normally have a sig at the bottom explaining who they are, and who they work for?

What *real* advantage are you getting by having LinkedIn rifle through every email you receive? Is it just that they put it at the top of the message, rather than require you to scroll to the bottom?

The company says that you can trust them with LinkedIn Intro:

LinkedIn Intro integrates with your email, and we understand that this carries great responsibility. We respect the fact that your email may contain very personal or sensitive information, and we will do everything we can to make sure that it is safe..

Well, the first thing to do if you want to keep your very personal or sensitive information safe is to reduce the chances of a breach. Adding another link in the privacy chain which could be potentially exploited is not the direction you should be going in.

Don’t use LinkedIn Intro.

Found this article interesting? Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.