Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn checks for 2953 browser extensions

github.com

Post reply on HN
Print view View original

151–160 of 263 posts

Re: LinkedIn checks for 2953 browser extensions

#151

Post by calvinmorrison »

awesome_dude wrote: post #70
cbsks wrote: post #44

Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif... On Firefox, web accessible resources are available at "moz-extension:// /myfile.png" is not your extension's ID. This ID is randomly gener…

This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"

yes thats how browser fingerprinting works and it is impossible to defeat because there are just too many variations in monitors (relevant for fonts), simple things like user agent, etc.

Re: LinkedIn checks for 2953 browser extensions

#152

Post by b1temy »

CobrastanJorji wrote: post #50
mongrelion wrote: post #7

Curious question: why would they check for installed extensions on one's browser?

Fingerprinting. There are a few reasons you'd do it: 1. Bot prevention. If the bots don't know that you're doing this, you might have a reliable bot detector for a while. The bots will quite possibly have no extensions at all, or even better specific exact combination they always use. Noticing bots means you can block them from scraping your site or spamming your users. If you wanna be very fancy, you could provide f…

> The bots will quite possibly have no extensions at all

I imagine most users will also not have extensions at all, so this would not be a reliable metric to track bots. Maybe it might be hard to imagine for someone whose first thing to do after installing a web browser is to install some extensions that they absolutely can't live without (ublock origin, privacy badger, dark mode reader, noscript, vimium c, whatever). But I imagine the majority of casual users do not install any extensions or even know of its existence (Maybe besides some people using something like Grammarly, or Honey, since they aggressively advertise on Youtube).

I do agree with the rest of your reasons though, like if bots used a specific exact combinations of extensions, or if there was an extension specifically for linkedin scraping/automation they want to detect, and of course, user tracking.

Re: LinkedIn checks for 2953 browser extensions

#153

Post by sidrag22 »

nitwit005 wrote: post #51
charcircuit wrote: post #19

Earlier quoted context omitted.

Why frame what you are trying to say like that? Businesses of all sizes deserve the ability to protect their businesses from abuse.

I'm sure there are issues with fake accounts for scraping, but the core issue is that LinkedIn considers the data valuable. LinkedIn wants to be able to sell the data, or access to it at least, and the scrapers undermine that. They could stop all the scraping by providing a downloadable data bundle like Wikipedia.

thinking more about, I don't think its a terrible thing that they prevent scraping. Their listings are already suffering from being flooded with garbage applications and having to sift through tons of noise. allowing scraping would just amplify that and make the platform almost entirely worthless.

I "scrape" linkedin in a roundabout way for personal use, and really what Ive found is that i should just maybee not bother at all. I can't get through the noise even when im applying at places that heavily match my skillset, and just get automated rejection emails.

Re: LinkedIn checks for 2953 browser extensions

#154

Post by Wicher »

burkaman wrote: post #34
0cf8612b2e1e wrote: post #11

Earlier quoted context omitted.

No kidding. I am shocked this works. Does Firefox have a similar weakness?

I don't see any evidence of this happening in Firefox. Either it's more difficult or they just didn't bother, either way I'm happy. Edit: Can't find much documentation on exactly how the anti-fingerprinting works, but this page implies that the browser blocks extension detection: https://support.mozilla.org/en-US/kb/trackers-and-scripts-fi...

From memory from working with these a couple of years ago:

Firefox extension asset URLs are random and long (there's a UUID in there iirc). The extension itself can discover its randomized base so that it can output its asset URLs, but webpage code can't.

Re: LinkedIn checks for 2953 browser extensions

#155

Post by RHSman2 »

rdoherty wrote: post #15

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

I had the pleasure of scraping LinkedIn for a client. Great fun.

Re: LinkedIn checks for 2953 browser extensions

#156

Post by Banditoz »

LinkedIn has been employing a lot of strange dark patterns recently:

* Overriding scroll speed on Firefox Web. Not sure why.

* Opening a profile on mobile web, then pressing back to go to last page, takes me to the LinkedIn homepage everytime.

* One of their analytic URLs is a randomly generated path on www.linkedin.com, supposedly to make it harder to block. Regex rules on ublock origin sufficiently stop this.

Anyone know why they could be doing this?

Re: LinkedIn checks for 2953 browser extensions

#157

Post by RHSman2 »

josephg wrote: post #53
xp84 wrote: post #20

Earlier quoted context omitted.

I mean, regardless of who they are or even if you don’t like what LinkedIn does themselves with the data people have given them, the random third parties with the extensions don’t additionally deserve to just grab all that data too, do they?

Eh. I worked at a company which made an extension which scraped LinkedIn. We provided a service to recruiters, who would start a hiring process by putting candidates into our system. The recruiters all had LinkedIn paid accounts, and could access all of this data on the web. We made a browser extension so they wouldn’t need to do any manual data entry. Recruiters loved the extension because it saved them time. I thin…

I started their but it felt like a dodgy way (as it could be seen to be illegal). We then just went aloffical and went through Google search API’s with LinkedIn as the target. Worked a treat and was cheaper than recruiter!!!

So when pay the highest scraper, it’s ok! Same data, different manner.

Re: LinkedIn checks for 2953 browser extensions

#158

Post by jmyeet »

I started using Chrome at version 2 I think. It still had the 3D logo. It was such a breath of fresh air and the big innovation was running one process per tab. Firefox existed but the entire browser could (and did) hang. And IE was... well, IE.

I did have a relatively early beef with Chrome though, whcih was I couldn't completely opt out of Flash. As in, I didn't even want it installed. This turned out to be an issue because Flash turned out to be one of the earliest vectors for so-called "zombie cookies".

Fingerprinting in general has been a longstanding problem and has become more and more advanced.

Add to this that Google is, first and foremost, an advertising business and they've become increasingly hostile to ad-bloccking tech for obvious reasons.

Basically what I'm getting at is something I couldn't have imagined a decade ago where I think I really have go switch away from Chrome to something that takes privacy and security seriously so that LinkedIn can't do things like this. And I increasingly don't trust Google to do that.

I actually have more trust in Apple because they have historically been user-focused eg blocking Meta's third party cookies. But obviously Safari isn't an option because it's not cross-platform.

I'm not sure I trust the current state of Mozilla. What's the alternative? Brave? Is Opera still a thing? I honestly don't know.

What I really want is a cross-platform browser written in Rust that black-holes ads out of the box. Why Rust? Memory safety. I simply don't trust a large C/C++ code to never have buffer overruns. Memory safety has become too important.

I don't want my browser to provide information on what extensions I'm using to a site and that shouldn't be a thing I have to ask for or turn on in any way.

Re: LinkedIn checks for 2953 browser extensions

#159

Post by hsbauauvhabzb »

dylan604 wrote: post #101
hsbauauvhabzb wrote: post #54

Earlier quoted context omitted.

No, I consider all data collection and scraping egregious. From that perspective, LinkedIn is hypocritical when Microsoft discloses every filesystem search I do locally to bing.

Are you not scraping a site with your eyeballs when you view a site?

By that logic I can charge you for looking at me.
Post reply on HN