Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How LinkedIn detects browser extensions

github.com

Post reply on HN
Print view View original

51–60 of 113 posts

Re: How LinkedIn detects browser extensions

#51

Post by tylerhou »

tnolet wrote: post #41
345tw4erfd wrote: post #37

Calling this "nefarious-linkedin" when it's obvious that LinkedIn is trying to protect itself from unauthorized data collection shows that the developer is either seeking for attention or didn't really look into the purpose of those extensions ( https://github.com/dandrews/nefarious-linkedin/pull/1 )

But how is this data accessible to the extension? I ‘m not an expert, but it seems that this data has to publicly available for an extension to find and parse it. Extensions don’t have magic Auth rights or credentials.

Extensions have the same auth rights as your logged-in account (the ability to see people who are out of network, for example). It’s against LinkedIn’s ToS to scrape data.

Re: How LinkedIn detects browser extensions

#52

Post by leni536 »

xg15 wrote: post #38

> Furthermore, there's no good reason to use web accessible resources in an extension! You can always find a solution to your problem that does not require them. How would I e.g inject an extension-provided image into a web page without using web accessible resources? The only ways I can think of would be copying the image to a blob or drawing it on a canvas - both seem significantly more complex than just injecting…

I'm not familiar with writing browser extensions, but data URI comes to mind.

Re: How LinkedIn detects browser extensions

#53

Post by peteretep »

superfrank wrote: post #47
tnolet wrote: post #31

I don’t get it. How can a browser extension mine data that otherwise is inaccessible? This should be covered by basic RBAC. Or are they just convenient scrapers, saving time but otherwise not accessing privileged information. If so, the LinkedIn story about “protecting our users” seems a bit shaky.

The extensions are basically bots to collect info for the user with the extension installed, not steal info from that user. Most are either scraping email, names, and job titles as quickly as a bot can, or mass sending out messages to users based on some criteria. Here's a video for one of the extensions https://www.youtube.com/watch?v=2XvtuZjblCc (Warning: loud music)

> The extensions are basically bots

No, most appear to be plugins for ATS/CRMs, which allow recruiters -- having found a lead on LinkedIn -- to then add them to their CRM. This is profoundly differently.

Re: How LinkedIn detects browser extensions

#54

Post by peteretep »

[deleted] wrote: post #28

[deleted]

> but I do know the intention is unequivocally to protect the PII of our members

The first item from the block list is "Daxtra", who make a very widely used ATS.

Please could you explain the difference from Microsoft's GDPR perspective from when a recruiter accesses this information via a normal browser and manually enters the data into Daxtra vs when someone with the Daxtra plugin accesses it, and uses that to pull the data over?

Re: How LinkedIn detects browser extensions

#55

Post by eastendguy »

Buge wrote: post #22
gkoberger wrote: post #17

Earlier quoted context omitted.

Here's the full list; they're all spammy recruiting/sales extensions (nothing legit like uBlock or LastPass): daxtra SalesloftProspector SalesLoftCadence discoverly Ecquire Ebstabullhorn EbstaSalesforce ProspectHive talentbin Entelo Nimble amazinghiring colabo extension StepWells(colabo) found.ly datananas Linkedin-Hubspot Connector dux-soup(fixed) data Scraper aevy Lusha Lead Generator Candidate.ai Email Hunter Pros…

iMacros is a legit extension. But yeah, I guess there are recruiters using it to spam people.

Agree. iMacros is a completely fine macro recorder. Similar extensions like Kantu and Selenium IDE are not in the list.

Re: How LinkedIn detects browser extensions

#56

Post by peteretep »

superfrank wrote: post #46

For anyone who is asking what/who LinkedIn are protecting with this, it's not the users with the extensions installed, it's to protect the other users on the sites. I poked through some of the listed extensions and most are basically bots that you can turn on that will crawl through LinkedIn pages very quickly and either collect info (like email addresses) or send out messages to other LinkedIn users. I found this vi…

> I poked through some of the listed extensions and most are basically bots that you can turn on that will crawl through LinkedIn pages very quickly and either collect info (like email addresses) or send out messages to other LinkedIn users.

I'm going to take the top ten from the list as an example:

daxtra -- Nothing like what you've described, plugin for a CRM

SalesloftProspector/SalesLoftCadence -- I don't see any crawling capability at all

discoverly -- Nothing like what you've described -- more like rapportive

Ecquire -- Nothing like what you've described, plugin for a CRM

Ebstabullhorn / EbstaSalesforce -- Nothing like what you've described -- plugins for Bullhorn and Salesforce CRMs only

ProspectHive -- apparently defunct, no idea

talentbin -- this is a social media aggregator

Entelo -- ATS plugin

Re: How LinkedIn detects browser extensions

#58

Post by kiallmacinnes »

dawnerd wrote: post #48

Ignoring everything else, it seems a bit weird a page can make requests to an extension's assets without originating from that extension.

I guess this comes down to extensions that inject code / modify the page.

Extensions can choose if their assets are public or private, and if they reference the asset from injected code - it needs to be public.

It sounds like a better solution might be to track the injected / modified code, and only allow it to read the assets. But I'll bet there is some tradeoff i've no clue about preventing that from happening.

Re: How LinkedIn detects browser extensions

#59

Post by peteretep »

gkoberger wrote: post #20
kodablah wrote: post #19

Earlier quoted context omitted.

Can you link to where they say that? I would figure someone doing something so helpful for users would at least document it. There's no reason to be surreptitious when doing such a favor. One wonders if they'll start offering a LinkedIn AntiVirus download with such an altruistic approach towards protecting users from what they have installed.

I think you're misunderstanding. LinkedIn isn't protecting the people with the extensions installed; they're protecting users FROM the people with the extensions.

Where they'll happily throw the same people under the bus if the user with the extensions installed is paying for an expensive recruiter license. Curious!

Re: How LinkedIn detects browser extensions

#60

Post by guitarbill »

[deleted] wrote: post #28

[deleted]

I'm failing to see how these extensions "circumvent the privacy of our members", but normal use of the website doesn't. Either you're safeguarding the information properly, or you aren't.

I am fine with huge GDPR fines to teach companies that data is a liability as well as an asset, and needs to be protected appropriately (which this measure doesn't seem to do, since it is trivial to bypass).

I'm not so sure I'm OK with you probing my browser to detect ToS violations/scraping, but not transparently mentioning it makes it worse.

Post reply on HN