Live data from Hacker News

LinkedIn is scanning browser extensions

404privacy.com

201–210 of 226 posts

Re: LinkedIn is scanning browser extensions

#202
post #5

"What is not a question is that a criminal investigation is now open." Good. These companies deserve each and every stone thrown at them, and much more.

What's really needed is to find out whose idea this was to begin with.

Some truly straight-shooters should be pointing the finger very accurately to where all this is coming from.

Anybody who has a team committed to non-below-average websites should be able to screen applicants against a roster of known enshittifiers.

It may be too late to nip it in the bud, but there's no reason to allow these individuals to continue unabated, much less keep growing so annoyingly.

What's wrong with some people anyway?

Re: LinkedIn is scanning browser extensions

#203

Earlier quoted context omitted.

It's a different primary source though

This is the same source - 404 story lists browsergate.eu (linked by Chris) as the original source

Yeah, the source I used is browsergate.eu. I do a lot of developing in the dev tools (browser fingerprinting protection tool on the same site) and so I was looking at the dev tools for linked in and saw the extension enumeration a few weeks ago. I didn't realize that's what was going on, but there was a repository from a few years ago that started tracking this. There's a HN link somewhere... nefariouslinkedin I think it was called.

Then, I saw the browsergate story drop on mastodon and thought "no way," lo-and-behold, there's a lawsuit in the works for it.

I found the audit to be a bit dense and hard to read, this is a response to that. I

Re: LinkedIn is scanning browser extensions

#204
post #5

"What is not a question is that a criminal investigation is now open." Good. These companies deserve each and every stone thrown at them, and much more.

What's really needed is to find out whose idea this was to begin with. Some truly straight-shooters should be pointing the finger very accurately to where all this is coming from. Anybody who has a team committed to non-below-average websites should be able to screen applicants against a roster of known enshittifiers. It may be too late to nip it in the bud, but there's no reason to allow these individuals to continu…

This is unfortunately common practice on the internet.

Browser fingerprinting is the new norm. LinkedIn just didn't disclose it in their privacy policy. They do mention canvas fingerprinting and collecting other signals, but not specifically this extension enumeration stuff.

But fingerprinting is used to track people even without cookies. Take a look at this for some further reading: https://404privacy.com/blog/browser-fingerprinting-is-the-ad...

Re: LinkedIn is scanning browser extensions

#205
post #40
post #20

Why is my Chrome telling random websites which extensions I have installed?

It isn’t exactly. They created a list of known extensions by their id and a file which is known to exist in that extension. The site iterates over each pair and tries to load that file, if it doesn’t error it knows the extension is installed. It’s a clever and difficult manual process, but it does bypass the security trying to prevent this kind of thing. I read that their reasoning is it exists to block users that us…

If that were the case, the list wouldn't have extensions that relate to a users religion, income, demographics, and more.

Re: LinkedIn is scanning browser extensions

#206

Earlier quoted context omitted.

It's a different primary source though

This is the same source - 404 story lists browsergate.eu (linked by Chris) as the original source

I did do my own independent audit, though. Sorry, I just checked back today and was not expecting this to get the traction it did.

Re: LinkedIn is scanning browser extensions

#207

Earlier quoted context omitted.

Why is it not a CORS violation? The browser needing access and a random website having access are quite different. Seems like a big ol' pile of vulns waiting to happen.

CORS is a server setting to tell the browser not to load its data from potentially unsafe origins. If you set a server to send access-control-allow-origin: *, then your browser will happily load these resources for you regardless of where you currently are. And chrome extensions need to be loadable from everywhere to be able to inject code or images into pages, so enabling CORS for them would defeat their main purpos…

From the other end, yes extensions access all page data, but pages shouldn't access extension data at all; it feels like that should be the CORS violation.

Re: LinkedIn is scanning browser extensions

#208
post #35
post #29

Can someone here please create a LinkedIn replacement for developers that 1. Doesn't have the spam 2. That doesn't look like it's from 2008 3. That only developers / engineers / tech folks can join 4. Doesn't try to log into your email to steal your contact list 5. That doesn't track you or your extensions / browser fingerprint 6. That doesn't have a bunch of fake "linkedinmaxxing" garbage content 7. that doesn't hav…

Maybe that's what the new Friendster should be

Friendster sounds like a great idea for a platform to take this on.

Is there anything else making a new start right now with as well-known a name? That could make a major difference in building critical mass fast enough.

Now Friendster is already moving in its own new direction [0], but it would still be a good portal to a separate new jobs board that only needs to start out with zero bullshit and one key thing a little bit better than Linkedin in some very important area, then gradually diverge further from there if necessary.

No need to even try to replace Linkedin (who wants another one of those?), the only thing that a better option needs to have to become sustainable, is to be better for a few million visitors on a regular basis. Maybe way fewer would be adequate if done right, IDK.

I don't think Friendster is going to stop short of that, so there you go.

Plus IIRC Friendster is already paid for and owes nobody anything. If it stays that way it could turn out to be a surprising advantage. No matter how big Linkedin is I can only imagine that it is "mortgaged" up the wazoo like anything else, it's a whale like no other.

Friendster could go into the kind of shallow water where it can thrive, and Linkedin would be effectively beached.

[0] Very cool the way their plan for physical contact or proximity looks like it will restrict bot activity just when it's needed most, while accepting the limitation to unbridled growth that this implies.

Re: LinkedIn is scanning browser extensions

#209
post #173

Earlier quoted context omitted.

This is how I interpreted the original question and indeed it makes no sense, JavaScript from a website should not be allowed to interact with extensions like this.

>JavaScript from a website should not be allowed Agreed 100%.

I agree, and this is why I built 404. If you poke around the page a bit, you'll see a tool that prevents browser fingerprinting.

404 catches JS calls in JS proxies and returns mocked-up values (assigned by a profile), it also has protections against TLS fingerprinting, canvas fingerprinting, device enumeration, TCP/IP fingerprinting, HTTP header fingerprinting, and more.

The predatory practices that browser fingerprinting have enabled guised behind "fraud protection" are atrocious. Even with a VPN, even in incognito mode, a website can track me and see what I've been doing EVEN IF ITS NOT ON THEIR SITE.

Then a data broker buys all this data and uses an AI model to put it all into a pretty little package and sell it to Google, or the gov't, or something. It's scary.

Re: LinkedIn is scanning browser extensions

#210

This is re-posted article from the author's Substack that does a pretty bad job of explaining the situation. The second link in the article is supposed to take you to a "GitHub repository tracking the extension list" but it goes to a GitHub page for a plugin that hasn't been updated in 9 years. It has a lot of hallmarks of LLM writings ("It's not this, it's that" and feeling like a lot of empty words rehydrated from…

Aurornis, I appreciate your comment and want to step in to defend myself.

The LLM writing style is simply not true. I am a high-school English teacher and if my students caught me using AI to do my writing, they'd rip me to pieces.

I included the GH link as a source of proof. While I did read the browsergate piece and ended up publishing my article as a result of, I noticed this was happening months ago because I am a developer myself and saw this very strange behavior in the LinkedIn dev console. The nature of my work is that I spend many hours sometimes staring at the dev tools to debug my JS injection, CSP rewriting, and header modification that 404 does.

Is 404 a tool to stop this? Yes. But that's the point. The reason why this type of thing is allowed to happen, browser fingerprinting, is because the public is unaware of it, so trying to educate the public is a part of my outreach. There are almost no tools on the market that allow for browser fingerprinting protection. Mullvad and Tor are close options, but they're often met with their own levels of scrutiny just for using their tools. For example, my school blocks the Tor network from being accessed altogether. Some websites can block the Tor fingerprint.

The original source is more technical, of course, but I was also in communication with the Browsergate team and continue to be so this is not a one-off journalist just trying to peddle his project. This has been my life for the last 2 years and I don't appreciate you discounting the work that privacy advocates do by splitting hairs and mincing my words.

While it may not be things I would think to install, maybe they're not extensions someone with certain affiliations would think to install.

Post reply on HN