Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn checks for 2953 browser extensions

github.com

Post reply on HN
Print view View original

71–80 of 263 posts

Re: LinkedIn checks for 2953 browser extensions

#71

Post by rchaud »

cbsks wrote: post #44

Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif... On Firefox, web accessible resources are available at "moz-extension:// /myfile.png" is not your extension's ID. This ID is randomly gener…

And they said that using a browser with sub-5% market share would cause us to miss out on the latest and greatest in web technology!

Re: LinkedIn checks for 2953 browser extensions

#72

Post by cxr »

bryanrasmussen wrote: post #24
rdoherty wrote: post #15

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

from the code doesn't look like they do anything if they have a match, they just save all the results to a csv for fingerprinting?

"The code" here you're referring to (fetch_extension_names.js[1]) isn't and doesn't claim to be LinkedIn's fingerprinting code. It's a scraper that the researcher behind this repo wrote themselves in order to create the CSV of the data that they're publishing here.

LinkedIn's fingerprinting code, as the README explains, is found in fingerprint.js[2], which embeds a big JSON literal with the IDs of the extensions it probes for. (Sickeningly enough, this data starts about two-thirds of the way through the file* and isn't the culprit behind the bulk of its 2.15 MB size…)

* On line 34394; the one starting:

    const r = [{
                id: "aacbpggdjcblgnmgjgpkpddliddineni",
                file: "sidebar.html"
1. https://github.com/mdp/linkedin-extension-fingerprinting/blo...>

2. https://github.com/mdp/linkedin-extension-fingerprinting/blo...>

Re: LinkedIn checks for 2953 browser extensions

#74

Post by unstatusthequo »

I’m probably on the list. I made a LinkedIn Redactor that allowed you to add keywords and remove posts from your thread that included such words. It’s the X feature but for LinkedIn. Anyway, got a cease and desist from those lame fucks at LI. So I removed from the chrome store but it’s still available on GitHub.

Re: LinkedIn checks for 2953 browser extensions

#75

Post by dumbo23 »

rdoherty wrote: post #15

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

[dead]

Re: LinkedIn checks for 2953 browser extensions

#76

Post by triceratops »

awesome_dude wrote: post #70
cbsks wrote: post #44

Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif... On Firefox, web accessible resources are available at "moz-extension:// /myfile.png" is not your extension's ID. This ID is randomly gener…

This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"

It's not a naive question. This comment says it's not possible to do that: https://news.ycombinator.com/item?id=46905213

Re: LinkedIn checks for 2953 browser extensions

#78

Post by dana321 »

rchaud wrote: post #71
cbsks wrote: post #44

Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif... On Firefox, web accessible resources are available at "moz-extension:// /myfile.png" is not your extension's ID. This ID is randomly gener…

And they said that using a browser with sub-5% market share would cause us to miss out on the latest and greatest in web technology!

chrome was made by ex-firefox devs, chrome is still not as good!

Re: LinkedIn checks for 2953 browser extensions

#79

Post by awesome_dude »

triceratops wrote: post #76
awesome_dude wrote: post #70

Earlier quoted context omitted.

This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"

It's not a naive question. This comment says it's not possible to do that: https://news.ycombinator.com/item?id=46905213

Oh, it's (re)randomised upon each restart, whew, thanks for the heads up

edit: er, I think that that also suggests that I need to restart firefox more often...

Re: LinkedIn checks for 2953 browser extensions

#80

Post by [deleted] »

awesome_dude wrote: post #70
cbsks wrote: post #44

Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif... On Firefox, web accessible resources are available at "moz-extension:// /myfile.png" is not your extension's ID. This ID is randomly gener…

This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"

[deleted]
Post reply on HN