LinkedIn Mobile App Lock Delay: A Subtle Security Risk I Identified




Affected Feature

LinkedIn mobile app's app lock feature. This requires password or biometric authentication whenever you reopen the app to protect your data.

How to Reproduce

  1. Open LinkedIn mobile app with app lock enabled
  2. Click any link inside the app that opens externally in Chrome (like a profile link)
  3. Browse in Chrome for a bit
  4. Switch back to LinkedIn
  5. The app lock doesn't trigger - you have full access for up to a minute without any authentication

The delay gives you a window where the app stays unlocked even though it should require immediate re-authentication.

Company Response

Reported to LinkedIn but marked as duplicate.

Comments

Post a Comment

Popular posts from this blog

When an AI Search Engine Forgot Who It Was: A Bug Report That Changed Perplexity AI’s Identity

Image
Affected Feature Perplexity AI's conversational response system across both Chrome extension and mobile app. When users ask comparative questions about Perplexity itself, the system should respond from its own identity as a search engine. How to Reproduce Open Perplexity AI (Chrome extension or mobile app) Ask: "Are you better than Google?" The response compares ChatGPT to Google instead of Perplexity to Google Perplexity acts like it's ChatGPT, completely ignoring its own identity as a search engine Same bug happened on both the extension and app - identical confused responses about ChatGPT vs Google. Impact This is a product logic bug that creates an identity crisis. Users asking about Perplexity get answers about ChatGPT, making them think Perplexity is just a ChatGPT wrapper instead of its own search engine. The LLM powering Perplexity couldn't recognize that "you" in the question meant Perplexity itself. It associated "better than Google...
Read more

Understanding Android’s One-Time Permissions and Their Privacy Implications

Image
You know that moment when you carefully set an app's permissions to "Ask every time"? When you go into Settings, find that app, and make sure it only gets access to your microphone or camera when you explicitly allow it? You feel good about it. You're in control, right? Yeah, about that. I've been testing Android's one-time permission system, particularly with apps like WhatsApp. I set the microphone permission to "Ask every time" because I wanted tight control over when the app could listen. But what I discovered was something that doesn't quite match what Android's documentation promises. Guess what? There's a gap. A small one, but it matters. Wait, How Does This Work? Here's the thing most people don't know: when you close an app after granting one-time permission, Android doesn't always revoke it instantly. Think about it. You finish a WhatsApp call, swipe the app away from your recent apps, and assume that's it...
Read more

Your Android Phone's Dirty Little Secret - Gemini

Image
You know that moment when you're careful about app permissions? When you go into Settings, find that sketchy app, and revoke its access to your camera, location, or files? You feel good about it. You're in control, right? Yeah, about that. I've been using Google Gemini since it launched. I gave it access to pretty much everything - camera, files, location, the works. Recently, I decided to clean things up. Went into Android settings, revoked all of Gemini's permissions, deleted the app, and reinstalled it fresh. Guess what? Gemini still had access to everything. Wait, How Is That Even Possible? Here's the thing most people don't know: Gemini doesn't actually need your permission if you've already given it to the Google app. Think about it. The Google app comes pre-installed on almost every Android phone. During setup, you probably granted it a bunch of permissions without thinking twice. Camera, microphone, location, files - whatever it asked for,...
Read more