Creepy visitor tracking using Linkedin

A few days ago I performed an experiment and added the following code to my blog:

<img src="https://www.linkedin.com/profile/view?authToken=zRgB&authType=name&id=98261032" />

Link in the code snippet points to my Linkedin profile and those familiar with web security will recognize the CSRF here (and the token apparently isn't validated correctly).

So how did the experiment unfold? Anyone who visited my blog also involuntary visited my Linkedin profile. It turns out that around 35% of blog visitors were also logged in to their Linkedin accounts while browsing the Web and my Linkedin profile received more than 800 "profile views" with details about these visitors:

So a little advice - if you prefer privacy don't forget to sign out of your Linkedin account before browsing the Web.

Microsoft's internal subdomains

Outlook.com webmail service has a nice feature - it highlights potentially incorrect e-mail addresses in the "To" field. But what happens if we try to use some obscure subdomains? Well, it looks like the auto-correct feature works just as well for Microsoft's internal subdomains:

As you can see both citrix.corp.microsoft.com and aol.corp.microsoft.com are recognized as valid e-mail addresses, however blabla.corp.microsoft.com is considered an invalid one. Here are some of the subdomains that auto-corrector recognizes as valid ones are:

google.corp.microsoft.com

rally.corp.microsoft.com

citrix.corp.microsoft.com

vmware.corp.microsoft.com

aol.corp.microsoft.com

cirrus.corp.microsoft.com

cisco.corp.microsoft.com

bluephoenix.corp.microsoft.com

twitter.corp.microsoft.com

qualys.corp.microsoft.com

blizzard.corp.microsoft.com

alliance.corp.microsoft.com

amber.corp.microsoft.com

api.corp.microsoft.com

apple.corp.microsoft.com

arm.corp.microsoft.com

ascent.corp.microsoft.com

asml.corp.microsoft.com

aspen.corp.microsoft.com

axt.corp.microsoft.com

blackbox.corp.microsoft.com

cabot.corp.microsoft.com

caci.corp.microsoft.com

cai.corp.microsoft.com

carbonite.corp.microsoft.com

cavium.corp.microsoft.com