I don’t get it. How can a browser extension mine data that otherwise is inaccessible? This should be covered by basic RBAC. Or are they just convenient scrapers, saving time but otherwise not accessing privileged information. If so, the LinkedIn story about “protecting our users” seems a bit shaky.
How LinkedIn detects browser extensions
31–40 of 113 posts
Re: How LinkedIn detects browser extensions
#32Talking of LinkedIn. Any suggestions of how I can bulk-remove contacts? I was wondering if there’s a Chrome Extension? I’m assuming all I’m missing is the motivation to script it?
Re: How LinkedIn detects browser extensions
#33> LinkedIn violates their own users' privacy in an effort to detect the usage of browser extensions. At the time of writing this, LinkedIn is scanning visitors for 38 different browser extensions.
No it is defending against malicious actors from abusing its API.
Re: How LinkedIn detects browser extensions
#34OK, but why does LinkedIn scan extensions?
LinkedIn contains lots of personal data, a large part of which is only available to users who are signed in and/or paid members. They want to protect this information from potential exfiltration by these extensions and their backing companies.
Re: How LinkedIn detects browser extensions
#35Even if the intent by LinkedIn is legit this will soon get used by data tracking scripts to further de-anonymise people
Is that inherently wrong if the website doesn't want to serve anonymous clients?
Re: How LinkedIn detects browser extensions
#36I am really in two minds about Linkedin, I cancelled my account years ago after getting spammed by recruiters, this could be an attempt to clean up but looking quite sinister in the attempt
Re: How LinkedIn detects browser extensions
#37Calling this "nefarious-linkedin" when it's obvious that LinkedIn is trying to protect itself from unauthorized data collection shows that the developer is either seeking for attention or didn't really look into the purpose of those extensions (https://github.com/dandrews/nefarious-linkedin/pull/1)
Re: How LinkedIn detects browser extensions
#38> Furthermore, there's no good reason to use web accessible resources in an extension! You can always find a solution to your problem that does not require them.
How would I e.g inject an extension-provided image into a web page without using web accessible resources?
The only ways I can think of would be copying the image to a blob or drawing it on a canvas - both seem significantly more complex than just injecting an IMG tag and would still be detectable as side effects.
Re: How LinkedIn detects browser extensions
#39[deleted]
Do you know if the user is blocked on LinkedIn, if the system detects one of the extension?
Re: How LinkedIn detects browser extensions
#40Why this is dangerous?