Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

271–280 of 836 posts

Re: LinkedIn is searching your browser extensions

#271

Post by urig »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

The tracking described is extremely invasive. You say you are not endorsing it but you are certainly normalizing it. This is unacceptable.

The people behind this URL are trying to hold Microsoft accountable. The power to them.

Re: LinkedIn is searching your browser extensions

#272

Post by fasterik »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

>this is why I run ad blockers.

It's important to note that this isn't fixed by ad blockers. To avoid this kind of fingerprinting, you need to disable JavaScript or use a browser like Firefox which randomizes extension UUIDs.

Re: LinkedIn is searching your browser extensions

#273

Post by honzaik »

Aurornis wrote: post #241
honzaik wrote: post #179

Earlier quoted context omitted.

well if they have evidence why they dont report it? why are these extensions on the store? im sure linkedin has enough motion to report it directly to google also, having a PQC enabled extension doesnt seem like a good "large user base capture" tactic. the source code is as usual obfuscated react but that doesnt mean its malicious... EDIT: i debuged the extension quickly and it doesnt seem to do anything malicious. i…

> well if they have evidence why they dont report it? why are these extensions on the store? We had a browser extension for our product. A couple times a month someone would clone it, add some data scraping or other malware to it, and re-upload it with the same or similar name. We set up automated searches to find them. After reporting it could take weeks to get them removed, some times longer. That’s for extensions…

I am aware that google will take looong time to act. that is why I mentioned that it is LinkedIn (Microsoft) or its contracted fingerprinting/"monitoring" partner who may have more direct ways to report this if they actually investigate malicious extensions.

but that doesn't really matter. for the sake of the argument assume the extensions are not malicious (as evidenced e.g. by the PQC one with ?16 users?) does that change the situation?

Re: LinkedIn is searching your browser extensions

#274

Post by nightpool »

haswell wrote: post #167
andersonpico wrote: post #99

Earlier quoted context omitted.

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

> How is probing your browser for installed extensions not "scanning your computer"? I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate. But this is not happening. What actually is happening is still a problem. But the hyperbole underm…

> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself.

Yes, but I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox. The fact that there's no getAllExtensions API is deliberate. The fact that you can work around this with scanning for extension IDs is not something most people know about, and the Chrome developers patched it when it became common. So I don't think describing it as something everybody would expect is totally fine and normal for browsers to allow is correct.

Re: LinkedIn is searching your browser extensions

#275

Post by seanw444 »

dmoose wrote: post #197
taneq wrote: post #174

Earlier quoted context omitted.

Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone else unless you ask them to.

Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone who hasn't paid them for it or can compel them to give it up.

There's a fourth amendment case on the Supreme Court docket (Chatrie v. U.S.) about Google searching a massive amount of user data to find people in a location at a specific time, at police request. The case is about whether the police's warrant warranted such a wide scope of search (if general warrants are allowed).

Point being: Google will 100% give your info to the police, regardless of whether the police have the legal right to it or not, and regardless of whether you actually committed a crime or not.

Bonus points: the federal court that ruled on the case said that it likely violated the fourth amendment, but they allowed the police to admit the evidence anyway because of the "good faith" clause, which is a new one for me. Time to add it to the list of horribly abusable exceptions (qualified immunity, civil asset forfeiture, and eminent domain coming to mind).

Re: LinkedIn is searching your browser extensions

#278

Post by blenderob »

chii wrote: post #165
pqtyw wrote: post #145

Earlier quoted context omitted.

Extensions are files installed on your computer, though?

it doesn't have to be files. it could be in memory on the browser. Extensions don't imply files for anyone but the most technical of conversations. Certainly not to the laymen. Having sensationalist titles should be called out at every opportunity.

> it doesn't have to be files. it could be in memory on the browser.

How'd that work? If it's in memory, the extensions would vanish everytime I shutdown Chrome? I'll have to reinstall all my extensions again everytime I restart Chrome?

Have you seen any browser that keeps extension in memory? Where they ask the user to reinstall their extensions everytime they start the browser?

Re: LinkedIn is searching your browser extensions

#279

Post by big_toast »

mewmewblobcat wrote: post #184
j45 wrote: post #182

Earlier quoted context omitted.

Ad blockers focus on ads, not fingerprinting.

Depends on what lists you use. If you use uBlock Origin, and enable most of the lists, it'll target both.

According to the EFF fingerprinting website, Firefox + uBlock Origin didn't really make my browser particularly unique.

But turning on privacy.resistfingerprinting in about:config (or was it fingerprintingProtection?) would break things randomly (like 3D maps on google for me. maybe it's related to canvas API stuff?) and made it hard to remember why things weren't working.

Not really sure how to strike a balance of broad convenience vs effectiveness these days. Every additional hoop is more attrition.

Re: LinkedIn is searching your browser extensions

#280

Post by mcv »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

Why is JavaScript running in a page even allowed to know what extensions I have? Is this also what sites use to see I've got an ad blocker?

Just run everything in a safe environment that it can't look out of.

Post reply on HN