Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

61–70 of 836 posts

Re: LinkedIn is searching your browser extensions

#61

Post by al_borland »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

> I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.

Expecting and accepting this kind of thing is why everyone feels the need to run an ad-blocker.

An ad-blocker also isn’t full protection. It’s a cat and mouse game. Novel ideas on how to extract information about you, and influence behavior, will never be handled by ad-blockers until it becomes known. And even then, it’s a question of if it’s worth the dev time for the maker of the ad-blocker you happen to be using and if that filter list gets enabled… and how much of the web enabling it breaks.

Re: LinkedIn is searching your browser extensions

#63

Post by acorn221 »

ceejayoz wrote: post #32
z3ratul163071 wrote: post #13

why would the browser ever expose extensions api to a web page. does firefox does this as well?

The "The Attack: How it works" section explains how it works. It's not an API. I am a little surprised something like CORS doesn't apply to it, though.

So these extensions allow linkedin to do this though, it's literally them saying "yes, this site can ping this resource" - called "web_accessible_resources".

This is fair from Linkedin IMO as I've seen loads of different extensions actually scraping the linkedin session tokens or content on linkedin.

Re: LinkedIn is searching your browser extensions

#67

Post by acorn221 »

davidmurdoch wrote: post #54
mentalgear wrote: post #45

Interesting. I didn't know a extension’s web-accessible resource (e.g. chrome-extension:// /...) could be abused to learn about the user's installed extensions by checking whether it resolves or not.

You would need to use use_dynamic_url: true in the manifest to create a unique one.

Yeah, this is the easiest way to get around it

Re: LinkedIn is searching your browser extensions

#68

Post by Ajedi32 »

acorn221 wrote: post #34
Ajedi32 wrote: post #22

Earlier quoted context omitted.

Still pretty annoying browsers haven't patched that yet.

They have! It's these developers either not knowing or not caring about it which is the issue! I did a blog post about this a while back showing how they do it, and how you can get around it, it's not very complex for the devs. https://www.linkedin.com/pulse/how-linkedin-knows-which-chro...

`use_dynamic_url` seems like it should be enabled by default, maybe with a phase-out period for backwards compatibility with older extensions.
Post reply on HN