Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

141–150 of 836 posts

Re: LinkedIn is searching your browser extensions

#141

Post by inetknght »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

> the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).

Your computer is your private domain. Your house is your private domain. You don't make a "getAllKeysOnPorch()" API, and certainly don't make "getAllBankAccounts()" API. And if you do, you certainly don't make it available to anyone who asks.

It absolutely is sinister.

Re: LinkedIn is searching your browser extensions

#142

Post by Aurornis »

replwoacause wrote: post #41
haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

I disagree, I think we should push back hard on behavior like this. What business is it of LinkedIn's what browser extensions I have installed? I think the framing for this is appropriate.

> What business is it of LinkedIn's what browser extensions I have installed?

The list of extensions they scan for has been extracted from the code. It was all extensions related to spamming and scraping LinkedIn last time this was posted: Extensions to scrape your LinkedIn session and extract contact info for lead lists, extensions to generate AI message spam.

That seems like fair game for their business.

Re: LinkedIn is searching your browser extensions

#143

Post by butlike »

anon22981 wrote: post #25
mikkupikku wrote: post #21

LinkedIn has been overtly evil for decades, and their power users are the most insufferable sort of middle management yuppy scum. I know job searching can be hard, but I don't go near LinkedIn with a ten foot pole.

I really like going to linkedin daily to play minisudoku and a couple of other puzzles, then never engage the feed or other features

This is really delightfully quirky

Re: LinkedIn is searching your browser extensions

#144

Post by nottorp »

pamcake wrote: post #73
gburgett wrote: post #47

The “how it works” page suggests it only works on chrome based browsers. Anyone able to determine if firefox or safari are affected too?

Firefox-based browsers not affected.

Hmm I opened linkedin in Firefox and ublock origin showed it blocked 4 items... then switched away and back and the counter was up to 12.

Is that enough blocking, I wonder?

Re: LinkedIn is searching your browser extensions

#145

Post by pqtyw »

chii wrote: post #119
afandian wrote: post #113

Earlier quoted context omitted.

When "the browser is the OS", scanning that is a pretty big chunk of "your computer".

but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough. If it has the ability to scan your bookmarks, or visited site history, that would lend more credence to using the term "computer". The title ought to have said "linkedIn illegally scans your browser", and that would make clear what is being done without being sensat…

Extensions are files installed on your computer, though?

Re: LinkedIn is searching your browser extensions

#146

Post by j45 »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

I wonder if this is part of the reason why LinkedIn tabs seem to use so much ram, and sometimes run away CPU processes.

Re: LinkedIn is searching your browser extensions

#147

Post by lastofthemojito »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

> this is why I run ad blockers.

It's pretty wild that we live in a world where the actual FBI has recommended we use ad blockers to protect ourselves, and if everyone actually listened, much of the Internet (and economy) as we know it would disappear. The FBI is like "you should protect yourself from the way that the third largest company in the world does business", and the average person's response is "nah, that would take at least a couple of minutes of my time, I'll just go ahead and continue to suffer with invasive ads and make sure $GOOG keeps going up".

Re: LinkedIn is searching your browser extensions

#148

Post by j45 »

andersonpico wrote: post #99
haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

There are rules and laws about fingerprinting too, I thought.

Re: LinkedIn is searching your browser extensions

#149

Post by philipwhiuk »

davidmurdoch wrote: post #54
mentalgear wrote: post #45

Interesting. I didn't know a extension’s web-accessible resource (e.g. chrome-extension:// /...) could be abused to learn about the user's installed extensions by checking whether it resolves or not.

You would need to use use_dynamic_url: true in the manifest to create a unique one.

Or just not allow them to load the URIs at all

Re: LinkedIn is searching your browser extensions

#150

Post by mrgoldenbrown »

RajT88 wrote: post #31
hjk2 wrote: post #23

How a web site can search one's computer?

TFA explains it is looking for installed browser extensions (which sites are allowed to do)

TFA goes into a lot of detail explaining why they "allegedly" aren't actually allowed to do so in the EU.
Post reply on HN