Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is scanning browser extensions

404privacy.com

Post reply on HN
Print view View original

191–200 of 226 posts

Re: LinkedIn is scanning browser extensions

#191

Post by tomhow »

un-nf wrote: post #2

[flagged]

This is a good example of why post summaries are considered off-topic on HN. If it becomes the top comment (which it often does if people agree with it or are riled up by it) they'll reply to the summary rather than posting their replies as root comments to the main thread, creating a split between replies to the top comment and root replies.

Also, please don't use a title for the HN submission that's different from the title of the original post. The guidelines are specific about this.

Re: LinkedIn is scanning browser extensions

#192

Post by golem14 »

pyrophane wrote: post #117

Here's the most relevant section I could find from the original source: "Chrome extensions can expose internal files to web pages through the web_accessible_resources field in their manifest.json. When an extension is installed and has exposed a resource, a fetch() request to chrome-extension://{id}/{file} will succeed. When the extension is not installed, Chrome blocks the request and the promise rejects. LinkedIn t…

Hmm, can one fake-install extensions that randomly return yes/no to those queries ? It's pretty clear which files linkedin (and other sites doing the fingerprinting) is testing, one can observe it as the OP author points out.

It should also be interesting to see which other sites test those very same files, has anybody looked yet ?

Re: LinkedIn is scanning browser extensions

#193

Post by Tor3 »

booi wrote: post #39
maelito wrote: post #15

Well, I deleted my Linkedin account and life is better now.

That's big talk coming from someone who currently has a job. getting a job without a linkedin account isn't that straightforward.

None of our new hires the last few years had anything to do with Linkedin though. As for myself, I deleted my account around the time when it started to try to look like a Facebook feed.

Re: LinkedIn is scanning browser extensions

#194

Post by 1vuio0pswjnm7 »

traderj0e wrote: post #94
ChrisArchitect wrote: post #9

[dupe] Discussion: https://news.ycombinator.com/item?id=47613981

It's a different primary source though

It's not clear to me what "[dupe]" means on HN anymore

It is being used, e.g., by this commenter, where the URLs and the target page content for each submission differ

Moreover, HN allows duplicate submissions under some circumstances, where the URLs are exactly the same. If the submissions are relatively far apart in time sometimes the moderator or a commenter will reply with "Previous discussion". More recently, a "past" link was added. Many times however the duplicate submissions are close together in time and there are no comments

Perhaps "[dupe]" as used here means "duplicate topic". But that seems like a pointless label as there are multiple submissions about the same topic every week on HN

As someone who archives all active HN story URLs, titles, etc. in an SQL database daily, I can locate duplicate submissions very quickly. Most do not have any indication of "[dupe]" in the title or comments

Re: LinkedIn is scanning browser extensions

#195

Post by unglaublich »

mschuster91 wrote: post #110
FridgeSeal wrote: post #69

Earlier quoted context omitted.

So the follow up question, is why is a random website, allowed to try and load arbitrary files?

Because extensions can and often do contain stuff like images or JS bundles that they inject into a target page's DOM. Not allowing a tab's context to load files from the chrome-extension:// namespace would break a lot of things.

True, but you'd expect the same CORS rules to apply for extensions. Only pages originating from an extension are by default able to load resources from said extension.

Re: LinkedIn is scanning browser extensions

#196

Post by ranger_danger »

gib444 wrote: post #21
ro_bit wrote: post #20

Why is my Chrome telling random websites which extensions I have installed?

Chrome is a browser produced by an advertising company. Its reason for existence is to track you.

> Its reason for existence is to track you.

Source:

Re: LinkedIn is scanning browser extensions

#197

Post by gusfoo »

In fairness, their privacy policy DOES explicitly say that they collect this information. See https://www.linkedin.com/legal/privacy-policy?ref=cms.hondas...

> 1.5 Your Device and Location > We receive data through cookies and similar technologies When you visit or leave our Services (including some plugins and our cookies or similar technology on the sites of others), we receive the URL of both the site you came from and the one you go to and the time of your visit. We also get information about your network and device (e.g., IP address, proxy server, operating system, web browser and add-ons, device identifier and features, cookie IDs and/or ISP, or your mobile carrier). If you use our Services from a mobile device, that device will send us data about your location based on your phone settings. We will ask you to opt-in before we use GPS or other tools to identify your precise location.

"including some plugins" being the relevant bit.

Re: LinkedIn is scanning browser extensions

#198

Post by sigmoid10 »

pbhjpbhj wrote: post #183
sigmoid10 wrote: post #96

Earlier quoted context omitted.

Chrome exposes these files via a URL that you can fetch in javascript like you would any other file on a normal website. These local extension files usually contain code, styles or images that your browser needs to run the extensions.

Why is it not a CORS violation? The browser needing access and a random website having access are quite different. Seems like a big ol' pile of vulns waiting to happen.

CORS is a server setting to tell the browser not to load its data from potentially unsafe origins. If you set a server to send access-control-allow-origin: *, then your browser will happily load these resources for you regardless of where you currently are. And chrome extensions need to be loadable from everywhere to be able to inject code or images into pages, so enabling CORS for them would defeat their main purpose. The extensions themselves might even need to bypass an existing CORS setup for the website you are currently on to fetch additional data.

Re: LinkedIn is scanning browser extensions

#199

Post by AndroTux »

pnw wrote: post #160
AndroTux wrote: post #58

Earlier quoted context omitted.

Brave explicitly blocks this

Last time this was discussed the consensus was Brave does not block it. Brave's fingerprinting protection does not include extensions. https://news.ycombinator.com/item?id=46904361

Well, just because LinkedIn still tries to send the requests on Brave doesn't mean the blocking doesn't work. The question is whether any request will give a valid response.

That said, I can't find conclusive info on whether this is blocked exactly. Brave does block "plugins" (which is why I assumed this includes this specific kind of fingerprinting), and the getExtension() call (which is probably unrelated), according to this page: https://brave.com/privacy-updates/4-fingerprinting-defenses-...

But since they don't explicitly mention the chrome-extension URL, you might be right.

Re: LinkedIn is scanning browser extensions

#200

Post by vehemenz »

KoftaBob wrote: post #175
vehemenz wrote: post #59

Earlier quoted context omitted.

I wouldn’t lump in Israel in, but good for you.

There have been several spywares developed in Israel and that have been used by them and other governments against civilians, below are just a few examples. Why wouldn't you lump Israel in? https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Paragon_Solutions https://en.wikipedia.org/wiki/Cytrox#Predator

If your criterion holds for spyware merely developed in a state, then that commits you not working in the US or UK as well. Something to think about.

Putting that aside, my moral positions about Israel are rooted in the righteousness of the Jews' cause and their historical struggle. My personal self-righteousness is inadequate in comparison.

Post reply on HN