Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How LinkedIn detects browser extensions

github.com

Post reply on HN
Print view View original

101–110 of 113 posts

Re: How LinkedIn detects browser extensions

#101

Post by derefr »

Buge wrote: post #23
kodablah wrote: post #21

Earlier quoted context omitted.

Ah, as an anti-scraper/anti-bot method, every user has all these local network requests made? Maybe it's the true reason, maybe not. Transparency is key here to assume anything more than the worst. Of course any of the rest of us with a modicum of smarts would just side load a custom extension via CLI args (or we'd just browser automate, headless if not detected). Even given the most generous justification, it reeks…

I think it's a cat and mouse game. The more that Linkedin publishes about their anti-spam techniques, the more information spammers have to try to evade those anti-spam techniques.

LinkedIn doesn’t publish anything about their anti-spam techniques. This was published by a third party, because it was a client-side feature that third parties could discover. Most of LinkedIn’s anti-bot logic is on the backend and completely opaque.

Re: How LinkedIn detects browser extensions

#102

Post by peter_retief »

kerouanton wrote: post #98
peter_retief wrote: post #36

I am really in two minds about Linkedin, I cancelled my account years ago after getting spammed by recruiters, this could be an attempt to clean up but looking quite sinister in the attempt

Linkedin has been an issue for years for me, because they simply disclosed your email to anyone connected. This enables some people and/or corporations to scrap profiles and build spam email databases. After being annoyed about this, I started to change my linkedin dedicated email address frequently, 4-5 times a year. The conclusion was obvious: less than a few days after the change, I began receiving spam and propos…

Maybe I should try again, I am not looking to hire or be hired so not really sure if there is a point anymore

Re: How LinkedIn detects browser extensions

#103

Post by dawnerd »

tinus_hn wrote: post #64
dawnerd wrote: post #48

Ignoring everything else, it seems a bit weird a page can make requests to an extension's assets without originating from that extension.

Imagine an extension modifying a page and adding an image. How would it allow the image to load if that wasn’t possible?

I was thinking if an image is injected, it'd be injected by a script loaded from the plugin thus trusted.

Re: How LinkedIn detects browser extensions

#104

Post by tracker1 »

mirimir wrote: post #99
tracker1 wrote: post #97

Earlier quoted context omitted.

I really don't understand the downvotes.

LinkedIn's reputation isn't so great. Primarily because they harvest user mailboxes, and spam endlessly about Mirimir (for example) inviting recipients to join their associate at LinkedIn. And it's not just annoying. Sometimes it hurts people's careers.

Oh, LinkedIn's reputation is deplorable... what they did to bypass security on iOS (and I think Android too) are particularly interesting (mail proxy). I'm not saying that metadata collection is good, or that there aren't nefarious reasons... I stated that was one reason, and it could be to offer features.

I only created a linkedin account to stop all the email invites... and even then, refuse to install their app (links pervasive in mobile web) and only accept connections to those I've met personally, and very few recruiters.

Re: How LinkedIn detects browser extensions

#105

Post by aswan »

meitham wrote: post #14

Is this issue unique to Chrome? Does it happen with Firefox?

The technique of attemping to load web accessible resources does not work in Firefox. For starters, Firefox uses moz-extension: instead of chrome-extension:, that's obviously trivial to adapt to, but Chrome then uses the extension's global identifier in those URLs, while Firefox uses a locally generated identifier, specifically to avoid this sort of fingerprinting.

Re: How LinkedIn detects browser extensions

#106

Post by mirimir »

tracker1 wrote: post #104
mirimir wrote: post #99

Earlier quoted context omitted.

LinkedIn's reputation isn't so great. Primarily because they harvest user mailboxes, and spam endlessly about Mirimir (for example) inviting recipients to join their associate at LinkedIn. And it's not just annoying. Sometimes it hurts people's careers.

Oh, LinkedIn's reputation is deplorable... what they did to bypass security on iOS (and I think Android too) are particularly interesting (mail proxy). I'm not saying that metadata collection is good, or that there aren't nefarious reasons... I stated that was one reason, and it could be to offer features. I only created a linkedin account to stop all the email invites... and even then, refuse to install their app (l…

Fair enough. But some people just downvote anything even neutral about something that they hate.

That's a funny story. But I have a funnier one. Not long ago, maybe the last time LinkedIn came up on HN, I created a test LinkedIn account as Mirimir. Or at least, I attempted to. Given that I use VPNs, I got a cellphone text authentication prompt. But Mirimir doesn't have a cellphone, so I blew it off.

And here's the funny part. A few days later, Mirimir received email from LinkedIn, inviting him to join Mirimir's network on LinkedIn!

Re: How LinkedIn detects browser extensions

#108

Post by xg15 »

leni536 wrote: post #52
xg15 wrote: post #38

> Furthermore, there's no good reason to use web accessible resources in an extension! You can always find a solution to your problem that does not require them. How would I e.g inject an extension-provided image into a web page without using web accessible resources? The only ways I can think of would be copying the image to a blob or drawing it on a canvas - both seem significantly more complex than just injecting…

I'm not familiar with writing browser extensions, but data URI comes to mind.

Ah, right, I forgot those. That's true of course.

I think you could still use them for side-effect detection (watch for images/scripts/etc with a known data uri suddenly appearing in your DOM) - but at least you couldn't actively query it without the extension doing anything.

Re: How LinkedIn detects browser extensions

#109

Post by i_cant_speel »

feanaro wrote: post #85
newsbinator wrote: post #82

Earlier quoted context omitted.

I'm on the anti-LinkedIn side of this scraping debate. But that said, LinkedIn never agreed to your ToS.

True, and I accept this is a potentially good legal refutation of this kind of argument. However, I do consider ToS-es untenable and unjust because of this power asymmetry. If my computing node is interacting with your computing node, we should either both be able to put restrictions on the use of obtainable information or neither.

You an avoid them collecting your data by not visiting their site.

Re: How LinkedIn detects browser extensions

#110

Post by feanaro »

i_cant_speel wrote: post #109
feanaro wrote: post #85

Earlier quoted context omitted.

True, and I accept this is a potentially good legal refutation of this kind of argument. However, I do consider ToS-es untenable and unjust because of this power asymmetry. If my computing node is interacting with your computing node, we should either both be able to put restrictions on the use of obtainable information or neither.

You an avoid them collecting your data by not visiting their site.

And they can avoid me storing their data by not offering it to me. Both are rather lazy arguments.

This is besides the fact that many sites (LinkedIn included) aren't very upfront about what exactly they collect. Also, after a certain point, it gets impractical to have to make this decision for each and every site you visit.

Post reply on HN