Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

121–130 of 836 posts

Re: LinkedIn is searching your browser extensions

#121

Post by MisterTea »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

> The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers.

Why is this even possible in the first place? It's nobodies business what extensions I have installed.

Re: LinkedIn is searching your browser extensions

#123

Post by sourcegrift »

The only explanation of linkedin being worth 44B is the prominent appearance of both bill gates (who started spending a day a week at MS after nadella became ceo), and reid hoffman appear prominently in epstein files. The deal itself was finalized during Trump's first term. So everything checks out

Re: LinkedIn is searching your browser extensions

#124

Post by chii »

egorfine wrote: post #115
andersonpico wrote: post #11

this is a massive violation of trust > The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify).

> this is a massive violation of trust This is not. To violate trust, there should have been some.

There's an implicit trust that a site doesn't try to racially profile you, as it is illegal. There's no enforcement, but that's why trust is being violated.

Re: LinkedIn is searching your browser extensions

#125

Post by taneq »

afandian wrote: post #113
andersonpico wrote: post #99

Earlier quoted context omitted.

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

When "the browser is the OS", scanning that is a pretty big chunk of "your computer".

This is just the next iteration of the issues with Linux file permissions, where the original threat model was “the computer is used by many users who need protection from each other”, and which no longer makes much sense in a world of “the computer is used by one or more users who need protection from each other and also from the huge amounts of potentially malicious remote code they constantly execute”.

Re: LinkedIn is searching your browser extensions

#126

Post by einpoklum »

andersonpico wrote: post #11

this is a massive violation of trust > The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify).

If you mean by the website, then - surely not. What basis do you have to trust websites you visit? Especially a social network that owned by Microsoft to boot?

If you mean the _browser_, then I agree in principle, but - it is a browser offered to you by Alphabet. And they are known to mass surveillance and use of personal information for all sorts of purposes, including passing copies to the US intelligence agencies.

But of course, this is what's promoted and suggested to people and installed by default on their phones, so even if it's Google/Alphabet, they should be pressured/coerced into respecting your privacy.

Re: LinkedIn is searching your browser extensions

#127

Post by Aurornis »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

This has been covered several times including reverse engineering of the code. The list of extensions they check for doesn’t include common extensions like ad blockers. It’s exclusively full of LinkedIn spamming and scraping type of extensions.

They also logically don’t need to fingerprint these users because those people are literally logging in to an account with their credentials.

By all appearances they’re just trying to detect people who are using spam automation and scraping extensions, which honestly I’m not too upset about.

If you never install a LinkedIn scraper or post generator extension you wouldn’t hit any of the extensions in the list they check for, last time I looked.

Re: LinkedIn is searching your browser extensions

#128

Post by andersonpico »

dylan604 wrote: post #76
Panda4 wrote: post #44

Earlier quoted context omitted.

> Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. It's not clear though, either they only tested against chrome-based browsers or Firefox isn't enabling them to do so. edit: I answered before I go fully through the article but it does say it's only Chrome based. > The extension scan runs only in Chrome-based browsers. The isUse…

What is a Chrome-based browser? Isn't Chrome Google's Chromium based browser? How many are based on Chrome?

From "The Attack: How it works", its just checking the user agent string:

function a() { return "undefined" != typeof window && window && "node" !== window.appEnvironment; }

function s() { return window?.navigator?.userAgent?.indexOf("Chrome") > -1; }

if (!a() || !s()) return;

Re: LinkedIn is searching your browser extensions

#129

Post by blargh »

VladVladikoff wrote: post #69

>The user is never asked. Never told. LinkedIn’s privacy policy does not mention it. OMG is literally every article written with LLMs these days I just can't anymore. It's all so tiring.

what makes you think that? and what sets your comment appart from beeing created by an llm?
Post reply on HN