Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How LinkedIn detects browser extensions

github.com

Post reply on HN
Print view View original

91–100 of 113 posts

Re: How LinkedIn detects browser extensions

#91

Post by crankylinuxuser »

Buge wrote: post #23
kodablah wrote: post #21

Earlier quoted context omitted.

Ah, as an anti-scraper/anti-bot method, every user has all these local network requests made? Maybe it's the true reason, maybe not. Transparency is key here to assume anything more than the worst. Of course any of the rest of us with a modicum of smarts would just side load a custom extension via CLI args (or we'd just browser automate, headless if not detected). Even given the most generous justification, it reeks…

I think it's a cat and mouse game. The more that Linkedin publishes about their anti-spam techniques, the more information spammers have to try to evade those anti-spam techniques.

Why do we accept this argument of obscurity, when discussing security vulnerabilities proper doesn't elicit the same response?

Why is obscurity OK in these situations? Wouldn't we all benefit with removing scammers if everyone legitimate worked together in the public? Its easy to defeat a single adversary. Its mighty hard to defeat a cooperating team.

Re: How LinkedIn detects browser extensions

#92

Post by osozg »

gkoberger wrote: post #6

The repo says "A look at how LinkedIn spies on its users" I'm not convinced this is LinkedIn spying on users... rather, it's them protecting its users from the spammy people using these extensions. There's not a single extensions on that list that doesn't result in someone getting an unsolicited email.

In my mind I am associating this with LinkedIn's failed attempt to keep scrapers off their website by suing them (ref: https://arstechnica.com/tech-policy/2017/08/court-rejects-li...)

Other companies are making money with these extensions on LinkedIn's website and LinkedIn is not happy about it

Re: How LinkedIn detects browser extensions

#93

Post by dividuum »

tinus_hn wrote: post #64
dawnerd wrote: post #48

Ignoring everything else, it seems a bit weird a page can make requests to an extension's assets without originating from that extension.

Imagine an extension modifying a page and adding an image. How would it allow the image to load if that wasn’t possible?

I would have hoped for some shared secret approach where the extension can generate one-time use urls for their bundled resources on demand and use those instead of easily predictable urls.

It seems that extensions like ad blockers that are explicitly targeted by such detection methods have ways for work around that (see https://github.com/gorhill/uBlock/blob/master/src/web_access...). I honestly would have expected for that to be the enforced default behavior.

Re: How LinkedIn detects browser extensions

#94

Post by jsnell »

crankylinuxuser wrote: post #91
Buge wrote: post #23

Earlier quoted context omitted.

I think it's a cat and mouse game. The more that Linkedin publishes about their anti-spam techniques, the more information spammers have to try to evade those anti-spam techniques.

Why do we accept this argument of obscurity, when discussing security vulnerabilities proper doesn't elicit the same response? Why is obscurity OK in these situations? Wouldn't we all benefit with removing scammers if everyone legitimate worked together in the public? Its easy to defeat a single adversary. Its mighty hard to defeat a cooperating team.

Security vulnerabilities tend to be pretty binary. Either the vulnerability is there and it's exploitable, or it isn't. And once there's a fix, deploying that fix will permanently solve that problem.

Fighting abuse is different. The abusers are using the same request endpoints that the real users are, but just in a way that the service provider doesn't approve of. (Whether it's sending spam, payment fraud, scraping, or something else). There's no single hole to plug, unless you block all the requests outright which also affects real users. Instead you have to classify the incoming traffic, find out the abusive subset, and then act on it appropriately. But unlike with vulnerabilities this doesn't solve the problem permanently.

The moment attackers find out which signals are used by a site, they can start faking them or working around the signals. As a simple example, early email spam classifiers worked by simple matching against a blacklist of highly spammy terms. So the spam adapted to using creative mis-spellings like "v1agra".

Re: How LinkedIn detects browser extensions

#95

Post by sangnoir »

michaelt wrote: post #75
guitarbill wrote: post #60

Earlier quoted context omitted.

I'm failing to see how these extensions "circumvent the privacy of our members", but normal use of the website doesn't. Either you're safeguarding the information properly, or you aren't. I am fine with huge GDPR fines to teach companies that data is a liability as well as an asset, and needs to be protected appropriately (which this measure doesn't seem to do, since it is trivial to bypass). I'm not so sure I'm OK w…

If LinkedIn has a 'delete profile' button that works, and extensions let recruiters scrape profiles and thus keep records on deleted users, who do you think is in the wrong?

Who's in the wrong - the scraper, obviously. Why would you think LinkedIn would be on the hook - it's not like their "Delete Profile" button can wipe Google's/Internet Archives[1] cache.

1. I haven't read their robots.txt, but nothing I've read in GDPR remotely suggests "Right to be forgotten" features that attempt to erase data internet-wide.

Re: How LinkedIn detects browser extensions

#96

Post by guitarbill »

michaelt wrote: post #75
guitarbill wrote: post #60

Earlier quoted context omitted.

I'm failing to see how these extensions "circumvent the privacy of our members", but normal use of the website doesn't. Either you're safeguarding the information properly, or you aren't. I am fine with huge GDPR fines to teach companies that data is a liability as well as an asset, and needs to be protected appropriately (which this measure doesn't seem to do, since it is trivial to bypass). I'm not so sure I'm OK w…

If LinkedIn has a 'delete profile' button that works, and extensions let recruiters scrape profiles and thus keep records on deleted users, who do you think is in the wrong?

If they have a "delete profile" button that works, then recruiters shouldn't be able to scrape that. It doesn't really matter, the country I live in has robust anti-spam and privacy laws. When I lived in the US, I was spammed often (CAN-SPAM is pretty weak compared to GDPR and CASL), but you don't see LinkedIn campaigning for better privacy laws in the US.

Apart from campaigning for GDPR-style protections, there are enough other solutions. For example, GitHub has a nice email forwarding feature to preserve user's privacy/email address.

LinkedIn could provide a similar option where when I opt-in, my email address is replaced by an address they provide. They could even go a step further and make it look like a real email address. Any emails to that address are forwarded to my real address, and after the initial forwarding I could reply from my real email address. Meanwhile LinkedIn could do analysis of who is sending what to these email canaries (like they transparently said they would when you opt in), and catch scrapers that way. For users, if I'm getting too much spam, I can simply request a new canary email address from them.

This is what a user-focussed solution would look like. Not some weird semi-legal hack they are doing now.

Re: How LinkedIn detects browser extensions

#97

Post by tracker1 »

tracker1 wrote: post #10
mirimir wrote: post #2

OK, but why does LinkedIn scan extensions?

More metadata to shape information... do you have ublock, authy, lastpass, bitmoji, etc. Could be anything from metrics, to useful interactions. Got the dropbox extension, show an option to upload your resume from dropbox directly. etc. Blocking ads, show integrated ads through a secondary channel.

I really don't understand the downvotes.

Re: How LinkedIn detects browser extensions

#98

Post by kerouanton »

peter_retief wrote: post #36

I am really in two minds about Linkedin, I cancelled my account years ago after getting spammed by recruiters, this could be an attempt to clean up but looking quite sinister in the attempt

Linkedin has been an issue for years for me, because they simply disclosed your email to anyone connected. This enables some people and/or corporations to scrap profiles and build spam email databases. After being annoyed about this, I started to change my linkedin dedicated email address frequently, 4-5 times a year. The conclusion was obvious: less than a few days after the change, I began receiving spam and proposals on this new dedicated email address, thus confirming the email scraping problem.

Yesterday I went back to Linkedin to reconfigure a new email address, and found that the account settings now incorporate a setting to hide your email address to anyone (inactive by default...). I've enabled it and changed again to a new dedicated email address, to see if it is true. I hope this time Linkedin did things right.

Re: How LinkedIn detects browser extensions

#99

Post by mirimir »

tracker1 wrote: post #97
tracker1 wrote: post #10

Earlier quoted context omitted.

More metadata to shape information... do you have ublock, authy, lastpass, bitmoji, etc. Could be anything from metrics, to useful interactions. Got the dropbox extension, show an option to upload your resume from dropbox directly. etc. Blocking ads, show integrated ads through a secondary channel.

I really don't understand the downvotes.

LinkedIn's reputation isn't so great. Primarily because they harvest user mailboxes, and spam endlessly about Mirimir (for example) inviting recipients to join their associate at LinkedIn. And it's not just annoying. Sometimes it hurts people's careers.

Re: How LinkedIn detects browser extensions

#100

Post by derefr »

baxtr wrote: post #25
gkoberger wrote: post #6

The repo says "A look at how LinkedIn spies on its users" I'm not convinced this is LinkedIn spying on users... rather, it's them protecting its users from the spammy people using these extensions. There's not a single extensions on that list that doesn't result in someone getting an unsolicited email.

Well, another good reason for LinkedIn to thi is to protect their revenues. I heard of headhunters who don’t want to pay their (high) monthly subscription fees and instead “hack” their system. I guess “hacking” includes using these extensions.

Right. I once worked for a company that was trying to perform a business “matchmaking” service. We considered, as part of the implementation possibility-space, scraping people’s connections from LinkedIn in order to enhance our results. But LinkedIn has many advanced anti-scraping heuristics in their backend; this is just one of many. So we scrapped that option (before ever getting around to considering the ethics of it.)
Post reply on HN