Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

191–200 of 836 posts

Re: LinkedIn is searching your browser extensions

#191

Post by dlenski »

roblabla wrote: post #105
kps wrote: post #53

Earlier quoted context omitted.

Why is it possible for a web site to determine what browser extensions I have installed? If there are legitimate uses, why isn't this gated behind a permission prompt, like things like location and camera?

It does two things: 1. Do a request to `chrome-extension:// / `. It's unclear to me why this is allowed. 2. Scan the DOM, look for nodes containing "chrome-extension://" within them (for instance because they link to an internal resource) It's pretty obvious why the second one works, and that "feels alright" - if an extension modifies the DOM, then it's going to leave traces behind that the page might be able to pick…

> 1. Do a request to `chrome-extension:///`. It's unclear to me why this is allowed.

Big +1 to that.

The charitable interpretation is that this behavior is simply an oversight by Google, a pretty massive one at that, which they have been slow to correct.

The less-charitable interpretation is that it has served Google's interests to maintain this (mis)feature of its browser. Likely, Google or its partners use similar to techniques to what LinkedIn/Microsoft use.

This would be in the same vein as Google Chrome replacing ManifestV2 with ManifestV3, ostensibly for performance- and security-related purposes, when it just so happens that ManifestV3 limits the ability to block ads in Chrome… the major source of revenue for Google.

The more-fully-open-source Mozilla Firefox browser seems to have had no difficulty in recognizing the issues with static extension IDs and randomizing them since forever (https://harshityadav.in/posts/Linkedins-Fingerprinting), just as Firefox continues to support ManifestV2 and more effective ad-blocking, with no issues.

Re: LinkedIn is searching your browser extensions

#192

Post by Scoundreller »

mewmewblobcat wrote: post #184
j45 wrote: post #182

Earlier quoted context omitted.

Ad blockers focus on ads, not fingerprinting.

Depends on what lists you use. If you use uBlock Origin, and enable most of the lists, it'll target both.

> Every time you open LinkedIn in a Chrome-based browser

I thought uBlock Origin was now dead in Chrome?

I remember a few hacks to keep it going but have now migrated to Firefox (or sometimes Edge…) to keep using it.

Re: LinkedIn is searching your browser extensions

#193

Post by [deleted] »

devy wrote: post #82
haswell wrote: post #50

Earlier quoted context omitted.

To broaden my point, I think we’d find that many websites we use are doing this. My point isn’t that this is acceptable or that we shouldn’t push back against it. We should. My point is that this doesn’t sound particularly surprising or unique to LinkedIn, and that the framing of the article seems a bit misleading as a result.

> To broaden my point, I think we’d find that many websites we use are doing this. Your point of "I think we’d find that many websites we use are doing this" doesn't make LinkedIn's behavior ok! By your logic, if our privacy rights are invaded which is illegal in most jurisdiction, and then it become ok because many companies do illegal things??

[deleted]

Re: LinkedIn is searching your browser extensions

#194

Post by debesyla »

bdangubic wrote: post #30
Ajedi32 wrote: post #18

Earlier quoted context omitted.

LinkedIn is a job board so that seems unlikely.

LinkedIn is a job board as much as Facebook is picture-sharing website

Not in Lithuania. While it's not the No1 or 2,3 platform for job advertisements, it's still very popular, especially for IT and management jobs.

So this probably depends on the country.

Re: LinkedIn is searching your browser extensions

#195

Post by ronjouch »

j45 wrote: post #182
lastofthemojito wrote: post #147

Earlier quoted context omitted.

> this is why I run ad blockers. It's pretty wild that we live in a world where the actual FBI has recommended we use ad blockers to protect ourselves, and if everyone actually listened, much of the Internet (and economy) as we know it would disappear. The FBI is like "you should protect yourself from the way that the third largest company in the world does business", and the average person's response is "nah, that w…

Ad blockers focus on ads, not fingerprinting.

"Ad blockers" nowadays do much more. From the horse’s mouth, which describes itself as a “wide-spectrum content blocker” [1]:

“uBlock Origin (uBO) is a CPU and memory-efficient wide-spectrum content blocker for Chromium and Firefox. It blocks ads, trackers, coin miners, popups, annoying anti-blockers, malware sites, etc., by default using EasyList, EasyPrivacy, Peter Lowe's Blocklist, Online Malicious URL Blocklist, and uBO filter lists. There are many other lists available to block even more [...]

Ads, "unintrusive" or not, are just the visible portion of the privacy-invading means entering your browser when you visit most sites. uBO's primary goal is to help users neutralize these privacy-invading methods in a way that welcomes those users who do not wish to use more technical means.”

[1] https://github.com/gorhill/uBlock?tab=readme-ov-file#ublock-...

Re: LinkedIn is searching your browser extensions

#196

Post by RankingMember »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

> this is why I run ad blockers.

What's been really obnoxious lately is the number of sites I try to do things on that are straight up broken without turning off my ad-blocker.

Re: LinkedIn is searching your browser extensions

#197

Post by dmoose »

taneq wrote: post #174
acheron wrote: post #161

Earlier quoted context omitted.

This is a Chrome thing. It’s a safe bet that if you use Google products you don’t care about privacy anyway. “Google product collects info about you: news at 11.”

Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone else unless you ask them to.

Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone who hasn't paid them for it or can compel them to give it up.

Re: LinkedIn is searching your browser extensions

#198

Post by [deleted] »

acheron wrote: post #161
haswell wrote: post #80

Earlier quoted context omitted.

This, to me, seems like the more salient point. A headline like “Major browsers allow websites to see your installed extensions” seems more appropriate here. We’ve known for a long time that advertisers/“security” vendors use as many detectable characteristics as possible to constrict unique fingerprints. This seems like a major enabler of even more invasive fingerprinting and that seems like the bigger issue here.

This is a Chrome thing. It’s a safe bet that if you use Google products you don’t care about privacy anyway. “Google product collects info about you: news at 11.”

[deleted]

Re: LinkedIn is searching your browser extensions

#199

Post by ronjouch »

Scoundreller wrote: post #192
mewmewblobcat wrote: post #184

Earlier quoted context omitted.

Depends on what lists you use. If you use uBlock Origin, and enable most of the lists, it'll target both.

> Every time you open LinkedIn in a Chrome-based browser I thought uBlock Origin was now dead in Chrome? I remember a few hacks to keep it going but have now migrated to Firefox (or sometimes Edge…) to keep using it.

Full uBlock Origin is dead in Chrome, yes, but https://github.com/uBlockOrigin/uBOL-home is the next best thing if you cannot leave Chrome
Post reply on HN