Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

491–500 of 836 posts

Re: LinkedIn is searching your browser extensions

#491

Post by nico »

al_borland wrote: post #81
arafeq wrote: post #4

[flagged]

Several years ago I heard the company I worked for say they had a way to get notified if it seemed like an employee might be thinking of leaving, so they could take some kind of action. I now wonder if LinkedIn, or various job sites, were selling them data.

LinkedIn might not need to sell the data. You can set your profile to “open for work” privately, and only recruiters can see it. So if your company has people with LinkedIn recruiter accounts, they could see your profile set to looking for work

PS: I guess given that recruiter accounts are paid, LinkedIn is technically selling access to the data in a way

Re: LinkedIn is searching your browser extensions

#492

Post by m-schuetz »

andersonpico wrote: post #99
haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

Scanning your computer is an entirely different thing than scanning browser extensions. By maximizing the expectation via "Illegally searching your computer", the truth suddenly appears harmless.

Re: LinkedIn is searching your browser extensions

#493

Post by entropyneur »

acorn221 wrote: post #63
ceejayoz wrote: post #32

Earlier quoted context omitted.

The "The Attack: How it works" section explains how it works. It's not an API. I am a little surprised something like CORS doesn't apply to it, though.

So these extensions allow linkedin to do this though, it's literally them saying "yes, this site can ping this resource" - called "web_accessible_resources". This is fair from Linkedin IMO as I've seen loads of different extensions actually scraping the linkedin session tokens or content on linkedin.

It's not the extension developer who should decide this, but the browser user.

Re: LinkedIn is searching your browser extensions

#494

Post by chromacity »

davedx wrote: post #348
chromacity wrote: post #269

Earlier quoted context omitted.

> I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister This seems like a really weird argument to make. The fact that the platform doesn't provide a privacy-violating API is not an extenuating circumstance. Lin…

What are the religious-related extensions described in the article doing that's "evil"?

Judging from the fact that 99% of the list seem like data-mining scam apps or spam tools, I suspect that's the answer in these cases too.

If LinkedIn really wanted to profile your religious beliefs, they would presumably go after the most popular religion-related extensions, not some "real-time AI for Islamic values" thing with 6k users.

Re: LinkedIn is searching your browser extensions

#495

Post by pixl97 »

IAmBroom wrote: post #474
flax wrote: post #384

Earlier quoted context omitted.

Yes, but the Awful registration fee is more like a speedbump to make banned behavior at least a little expensive to the offending users. Most of the revenue comes from completely optional aesthetic purchases: avatars, avatars _for others_, smilies, etc. I suspect it's a whale based economy.

> whale based economy Please explain this term. Google was not useful.

Also look up K shaped economies at the same time and you get a better answer.

But the gist of it is, companies do free to play systems that support themselves by a very small portion of their user base spending a very large amount of money. The free/low paying users find themselves with poor/no service as the companies do anything to attract more whales.

K based economies are somewhat related as you see a very small portion of the participants in an economy make a huge amount of money while everyone else gets poor.

Re: LinkedIn is searching your browser extensions

#496

Post by autoexec »

IAmBroom wrote: post #474
flax wrote: post #384

Earlier quoted context omitted.

Yes, but the Awful registration fee is more like a speedbump to make banned behavior at least a little expensive to the offending users. Most of the revenue comes from completely optional aesthetic purchases: avatars, avatars _for others_, smilies, etc. I suspect it's a whale based economy.

> whale based economy Please explain this term. Google was not useful.

Whales are the tiny percentage of users who spend large amounts of actual money on bullshit non-products offered by mobile apps and online platforms. AKA suckers.

Re: LinkedIn is searching your browser extensions

#497

Post by mlinsey »

array_key_first wrote: post #304
surajrmal wrote: post #256

Earlier quoted context omitted.

Don't worry, soon you'll need to pay every website 5.99 a month because AI is destroying click through rates. The internet will likely be far worse without ads than with ads. Solving the tracking problem doesn't need to be mixed up with blocking ads outright. What's funny is that tracking isn't nearly as meaningful for click through rates on ads as relevance to what's on the page, and yet so much effort is placed ont…

It would not be 5.99 to access a website because that's not what it costs and that's not what ads yield. I think people think ads give way, way more money than they actually do. If you're visiting a website with mostly static ads then you're generating fractions of a cent in revenue for that website. Even on YouTube, you're generating mere cents of revenue across all your watch time for the month. Why does YouTube pr…

YouTube had an estimated $40 billion in ad revenue in 2025: https://techcrunch.com/2026/03/10/youtube-surpasses-disney-p...

And has roughly 2.7 billion monthly active users. This means the average YouTube user brings in around $1.23 per month. When you consider that CPM's can easily swing by 20X based on how wealthy the user demographic is, and willingness to pay a subscription is a strong signal for purchasing power, I would not be at all subscribed if a YouTube premium subscription was revenue-neutral for Google.

Re: LinkedIn is searching your browser extensions

#499

Post by Johnny555 »

>the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch)

Why should a website be able to scan for extensions at all?

Or if there's a legitimate need (like linkedin.com wants to see if you installed the linkedin extension), leave it up to the extension to decide if it wants to reveal itself. The extension can register a list of URL patterns it will reveal itself to. So the linkedin extension might reveal itself only to *.linkedin.com, a language translation extension might reveal itself to everyone, and an adblocker extension might not choose to reveal itself to anyone.

Re: LinkedIn is searching your browser extensions

#500

Post by mrguyorama »

ryandrake wrote: post #230
haswell wrote: post #167

Earlier quoted context omitted.

> How is probing your browser for installed extensions not "scanning your computer"? I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate. But this is not happening. What actually is happening is still a problem. But the hyperbole underm…

> What the article describes sounds like what many devs would land on given the browser APIs available. > To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed. These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects. What t…

I integrate these kinds of systems in order to prevent criminals from being able to use our ecommerce platform to utilize stolen credit cards.

That involves integrating with tracking providers to best recognize whether a purchase is being made by a bot or not, whether it matches "Normal" signals for that kind of order, and importantly, whether the credit card is being used by the normal tracking identity that uses it.

Even the GDPR gives us enormous leeway to do literally this, but it requires participating in tracking networks that have what amounts to a total knowledge of purchases and browsing you do on the internet. That's the only way they work at all. And they work very well.

Is it Ethical?

It is a huge portion of the reason why ecommerce is possible, and significantly reduces credit card fraud, and in our specific case, drastically limits the ability of a criminal to profit off of stolen credit cards.

Are people better off from my work? If you do not visit our platforms, you are not tracked by us specifically, but the providers we work with are tracking you all over the web, and definitely not just on ecommerce.

Should this be allowed?

Post reply on HN