Just as invasive as Akamai bot manager on every other site you visit. Akamai is so jam packed they can likely identify you from the mouse movement data alone. The LinkedIn discourse feels forced, the problem is so much worse than what you're seeing here.
LinkedIn is scanning browser extensions
171–180 of 226 posts
Re: LinkedIn is scanning browser extensions
#172Re: LinkedIn is scanning browser extensions
#173Earlier quoted context omitted.
So the follow up question, is why is a random website, allowed to try and load arbitrary files?
This is how I interpreted the original question and indeed it makes no sense, JavaScript from a website should not be allowed to interact with extensions like this.
>JavaScript from a website should not be allowed
Agreed 100%.
Re: LinkedIn is scanning browser extensions
#174friends, WHEN you are asked to implement something like this at your job, which will you choose: object (& hold ground, loose job) OR comply (& keep job) as practitioners, where do we hold the line between telemetry and surveillance?
Honestly I would implement this. Chrome's fault for telling every website what extensions are installed. User isn't harmed anyway.
How do you feel about burglars exploiting bad locks? Known flaw, so the owner had it coming? Insurance will make them right in the end?
Re: LinkedIn is scanning browser extensions
#175Earlier quoted context omitted.
I choose not to work at places like linked in, meta, or any place that accepts Saudi or Israeli funding. It makes it a little harder to find a job, but i sleep better at night.
I wouldn’t lump in Israel in, but good for you.
There have been several spywares developed in Israel and that have been used by them and other governments against civilians, below are just a few examples. Why wouldn't you lump Israel in?
https://en.wikipedia.org/wiki/Pegasus_(spyware)
Re: LinkedIn is scanning browser extensions
#176Aside from the gross privacy invasion it specifically looks for Muslim/Islamic related extensions.
Having a lot of connections working at Microsoft and Western tech industry, I'm not surprised with the targeting of Muslims.
Re: LinkedIn is scanning browser extensions
#177Aside from the gross privacy invasion it specifically looks for Muslim/Islamic related extensions. Having a lot of connections working at Microsoft and Western tech industry, I'm not surprised with the targeting of Muslims.
Muslim/Islamic extremist recruiters used Adobe's Express platform for terrorist / extremist recruitment.
No idea if if LinkedIn has the same issue though.
Re: LinkedIn is scanning browser extensions
#178Earlier quoted context omitted.
Honestly I would implement this. Chrome's fault for telling every website what extensions are installed. User isn't harmed anyway.
How do you feel about burglars exploiting bad locks? Known flaw, so the owner had it coming? Insurance will make them right in the end?
Nobody is getting burgled here
Re: LinkedIn is scanning browser extensions
#179Why is my Chrome telling random websites which extensions I have installed?
It isn’t exactly. They created a list of known extensions by their id and a file which is known to exist in that extension. The site iterates over each pair and tries to load that file, if it doesn’t error it knows the extension is installed. It’s a clever and difficult manual process, but it does bypass the security trying to prevent this kind of thing. I read that their reasoning is it exists to block users that us…
Firefox at least randomizes extension IDs per install. Chrome hands all of that to extension devs, basically a "your problem now".
Re: LinkedIn is scanning browser extensions
#180Here's the most relevant section I could find from the original source: "Chrome extensions can expose internal files to web pages through the web_accessible_resources field in their manifest.json. When an extension is installed and has exposed a resource, a fetch() request to chrome-extension://{id}/{file} will succeed. When the extension is not installed, Chrome blocks the request and the promise rejects. LinkedIn t…
It seems like it shouldn't let code originating from the site (as opposed to from the extension) to access that.
I'm not sure you'd need to directly fetch to determine if they resolve. One could probably inject an img tag and see if it resolves.