Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn checks for 2953 browser extensions

github.com

Post reply on HN
Print view View original

121–130 of 263 posts

Re: LinkedIn checks for 2953 browser extensions

#121

Post by jorvi »

awesome_dude wrote: post #79
triceratops wrote: post #76

Earlier quoted context omitted.

It's not a naive question. This comment says it's not possible to do that: https://news.ycombinator.com/item?id=46905213

Oh, it's (re)randomised upon each restart, whew, thanks for the heads up edit: er, I think that that also suggests that I need to restart firefox more often...

Doing it on restart makes the mitigation de facto useless. How often do you have 10, 20, 30d (or even longer) desktop uptime these days? And no one is regularly restarting their core applications when their desktop is still up.

Enjoy the fingerprinting.

Re: LinkedIn checks for 2953 browser extensions

#122

Post by eek2121 »

jorvi wrote: post #121
awesome_dude wrote: post #79

Earlier quoted context omitted.

Oh, it's (re)randomised upon each restart, whew, thanks for the heads up edit: er, I think that that also suggests that I need to restart firefox more often...

Doing it on restart makes the mitigation de facto useless. How often do you have 10, 20, 30d (or even longer) desktop uptime these days? And no one is regularly restarting their core applications when their desktop is still up. Enjoy the fingerprinting.

Umm, I restart my PC about once a week for security and driver updates.

If you don't, you have a lot more to worry about beyond fingerprinting...

Oh and I'm on LINUX (CachyOS) mind you.

Re: LinkedIn checks for 2953 browser extensions

#123

Post by tristan957 »

jorvi wrote: post #121
awesome_dude wrote: post #79

Earlier quoted context omitted.

Oh, it's (re)randomised upon each restart, whew, thanks for the heads up edit: er, I think that that also suggests that I need to restart firefox more often...

Doing it on restart makes the mitigation de facto useless. How often do you have 10, 20, 30d (or even longer) desktop uptime these days? And no one is regularly restarting their core applications when their desktop is still up. Enjoy the fingerprinting.

I restart my browser basically every day.

Re: LinkedIn checks for 2953 browser extensions

#124

Post by b00ty4breakfast »

stirfish wrote: post #115
throwaway808081 wrote: post #110

Earlier quoted context omitted.

Just have a database of UUIDs. Seems pretty trivial to generate and sort as it's only 16 bytes each.

lol Let's go a step further and just iterate through them on the client. I plan on having this phone well past the heat death of the universe, so this is guaranteed to finish on my hardware. function* uuidIterator() { const bytes = new Uint8Array(16); while (true) { yield formatUUID(bytes); let carry = 1; for (let i = 15; i >= 0 && carry; i--) { const sum = bytes[i] + carry; bytes[i] = sum & 0xff; carry = sum > 0xff…

Free space heater

Re: LinkedIn checks for 2953 browser extensions

#125

Post by bitbasher »

The list of extensions being scanned for are pretty clear and obvious. What is really interesting to me are the extensions _not_ being scanned for that should be.

The big one that comes to mind is "Contact Out" which is scan-able, but LinkedIn seems to pretend like it doesn't exist? Smells like a deal happened behind the scenes...

https://chromewebstore.google.com/detail/email-finder-by-con...

Re: LinkedIn checks for 2953 browser extensions

#126

Post by cxr »

Aurornis wrote: post #35

I suggest everyone take a look at the list of extensions and their names for some very important context: https://github.com/mdp/linkedin-extension-fingerprinting/blo... I didn't find popular extensions like uBlock or other ad blockers. The list is full of scammy looking data collection and AI tools, though. Some random names from scrolling through the list: - LinkedGPT: ChatGPT for LinkedIn - Apollo Scraper - Extrac…

> I suggest everyone take a look at the list of extensions and their names for some very important context[…] I didn't find popular extensions like uBlock

Unsurprising outcome since uBlock (specifically: uBlock Origin Lite, the only version available for Chrome on the Chrome Web Store) makes itself undetectable using this method. (All of its content-accessible resources have "use_dynamic_url" set to "true" in its extension manifest.) So its absence in this data is not dispositive of any actual intent by LinkedIn to exclude it—because they couldn't have included it even if they wanted to.

Re: LinkedIn checks for 2953 browser extensions

#127

Post by xp84 »

josephg wrote: post #53
xp84 wrote: post #20

Earlier quoted context omitted.

I mean, regardless of who they are or even if you don’t like what LinkedIn does themselves with the data people have given them, the random third parties with the extensions don’t additionally deserve to just grab all that data too, do they?

Eh. I worked at a company which made an extension which scraped LinkedIn. We provided a service to recruiters, who would start a hiring process by putting candidates into our system. The recruiters all had LinkedIn paid accounts, and could access all of this data on the web. We made a browser extension so they wouldn’t need to do any manual data entry. Recruiters loved the extension because it saved them time. I thin…

Doesn't sound like your operation was particularly questionable, but I can imagine there must be some of those 3,000 extensions where the data flow isn't just "DOM -> End User" but more of a "Dom -> Cloud Server -> ??? -> Profit!" with perhaps a little detour where the end user gets some value too as a hook to justify the extension's existence.

Re: LinkedIn checks for 2953 browser extensions

#128

Post by echelon »

john-h-k wrote: post #118
jmward01 wrote: post #47

Earlier quoted context omitted.

Do they respect my data? Why do they get to track me across sites when I clearly don't want them to but someone can't scrape their data when they don't want them to. Why should big companies get the pass but individuals not? They clearly consider internet traffic fair game and are invasive and abusive about it so it is not only fair to be invasive and abusive back, it is self defense at this point.

Because you signed up to a set of terms and conditions saying LinkedIn can use your data in this way

I didn't want the web to turn into monolithic platforms. I abhor this status quo.

You cannot function without these enterprises, but that doesn't mean they're ideal or even ethical.

Microsoft wins because of network effects. It's impossible to compete. So I think it should be allowed to assail their monopoly here by any means. It's maximally fair for consumers and for free markets.

Ideally capitalism remains cutthroat and impossible to grow into undislodgeable titans.

Even more ideally, this would become a distributed protocol rather than a privately owned and guarded database.

Re: LinkedIn checks for 2953 browser extensions

#129

Post by cxr »

tech234a wrote: post #45
0cf8612b2e1e wrote: post #11

Earlier quoted context omitted.

No kidding. I am shocked this works. Does Firefox have a similar weakness?

No. Firefox always randomizes the extension ID used for URLs to web accessible resources on each restart [1]. Apparently, manifest v3 extensions on Chromium can now opt into similar behavior [2]. [1]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... [2]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

That's a different form of defense. The original claim in this thread was that LinkedIn's fingerprinting implementation was making cross-site requests to Chrome Web Store, and that they were reading back the response of those requests.

Firefox isn't susceptible to that, because that's not how Firefox and addons.mozilla.org work. Chrome, as it turns out, isn't susceptible to it, either, because that's also not how Chrome and the Chrome Web Store work. (And that's not what LinkedIn's fingerprinting technique does.)

(Those randomized IDs for content-accessible resources, however, do explain why the technique that LinkedIn actually uses is is a non-starter for Firefox.)

Re: LinkedIn checks for 2953 browser extensions

#130

Post by cyanydeez »

tristan957 wrote: post #123
jorvi wrote: post #121

Earlier quoted context omitted.

Doing it on restart makes the mitigation de facto useless. How often do you have 10, 20, 30d (or even longer) desktop uptime these days? And no one is regularly restarting their core applications when their desktop is still up. Enjoy the fingerprinting.

I restart my browser basically every day.

yeah I close out everything as a mental block against anything I'm working on.

I think there's a subset of people that offload memory to their browsers and that's kinda scary given how these fingerprint things work.

Post reply on HN