Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

331–340 of 836 posts

Re: LinkedIn is searching your browser extensions

#331

Post by cryptoegorophy »

Aurornis wrote: post #155
andersonpico wrote: post #11

this is a massive violation of trust > The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify).

Many extensions designed to scrape data from social media websites are disguised as simple extensions that do something else. If I had to guess: I sought that automatic content blurrer, neurodivergent website simplifier, or anti-Zionist tagger actually work. They’re all just piggybacking on trending topics to get users to install them and then forget about them, then they exfiltrate the data when you visit LinkedIn.

This. Do not install any extension unless you absolutely need. Assume they all leak your browsing data. Not familiar with Google but if you can just vibe code your own extension then do that.

Re: LinkedIn is searching your browser extensions

#332

Post by ImPostingOnHN »

seanw444 wrote: post #275
dmoose wrote: post #197

Earlier quoted context omitted.

Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone who hasn't paid them for it or can compel them to give it up.

There's a fourth amendment case on the Supreme Court docket (Chatrie v. U.S.) about Google searching a massive amount of user data to find people in a location at a specific time, at police request. The case is about whether the police's warrant warranted such a wide scope of search (if general warrants are allowed). Point being: Google will 100% give your info to the police, regardless of whether the police have the…

They knowingly participated in PRISM, too.

Re: LinkedIn is searching your browser extensions

#333

Post by II2II »

toomuchtodo wrote: post #259
surajrmal wrote: post #256

Earlier quoted context omitted.

Don't worry, soon you'll need to pay every website 5.99 a month because AI is destroying click through rates. The internet will likely be far worse without ads than with ads. Solving the tracking problem doesn't need to be mixed up with blocking ads outright. What's funny is that tracking isn't nearly as meaningful for click through rates on ads as relevance to what's on the page, and yet so much effort is placed ont…

I would rather pay people and websites for content. I already do this today for journalism orgs and a handful of high value substacks, I'm happy to pay for more. I'd pay for HN. Free does not scale (with the caveat being orgs like Wikipedia, the Internet Archive, and others who have an endowment behind them and can self fund alongside donations; this, of course, is a model others can adopt), people need to eat, pay f…

> Free does not scale

No disagreement there, except the early web was not about scale. The sites you visited may have been created by someone as a hobby, a university professor outlining their courses or research, a government funded organization opening up their resources to the public, a non-profit organization providing information to the public or other professionals, or companies providing information and support for their products (in the way they rarely do today).

> people need to eat, pay for rent

Those people were either creating small sites in their spare time, or were paid to work on larger sites by their employer.

There were undoubtedly gaps in the non-commercial web. On the other hand, I'm not sure that commercializing the web filled those gaps. If anything, it is so "loud" that the web of today feels smaller and less diverse than the web of the 1990's.

Re: LinkedIn is searching your browser extensions

#334

Post by ksymph »

haswell wrote: post #167
andersonpico wrote: post #99

Earlier quoted context omitted.

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

> How is probing your browser for installed extensions not "scanning your computer"? I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate. But this is not happening. What actually is happening is still a problem. But the hyperbole underm…

> Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible.

To take a step back further: what you're saying here is that gathering more data makes it less sinister. The gathering not being targeted is not an excuse for gathering the data in the first place.

It's likely that the 'naive developer tasked with fingerprinting' scenario is close to the reality of how this happened. But that doesn't change the fact that sensitive data -- associated with real identities -- is now in the hands of MS and a slew of other companies, likely illegally.

> But the authors have chosen to frame this in language that is hyperbolic and alarmist, and in doing so I thing they’re making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.

The article is not hyperbolizing by exploring the ramifications of this; and it's true that this sort of tracking is going on everywhere, but neither is it alarmist to draw attention to a particularly egregious case. What wrong things does it focus on?

Re: LinkedIn is searching your browser extensions

#335

Post by haswell »

catlifeonmars wrote: post #202
haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

> I’m certainly not endorsing it, do think it’s pretty problematic, and I’m glad it’s getting some visibility. But I do take some issue with the alarmist framing of what’s going on. Speaking has someone who shares the same lack of surprise, perhaps some alarm is warranted. Just because it’s ubiquitous doesn’t mean it’s ok. This feels very much frog in boiling water for me. Why do you think the alarmist framing is unw…

I do think a degree of alarm is appropriate.

But it’s critical to sound the correct alarm.

To me, it seems like the authors pulled the fire alarm for a single building when in reality there’s a tornado bearing down.

And by doing so, everyone is scrambling about a fire instead of the response a tornado siren would cause.

They’re both dangerous and worthy of an immediate reaction, but the confusion and misdirection this causes seems deeply problematic.

When people realize the fire wasn’t real, they start to question the validity of the alarm. The tornado is still out there.

I realize this analogy is a bit stretched.

As someone who has spent quite a lot of time steeped in security/privacy research, the stuff described in the article has been happening pervasively across the industry.

People absolutely should be alarmed. Many of us have been alarmed for quite some time. Raising the alarm by saying “LinkedIn is searching your computer” isn’t it.

Re: LinkedIn is searching your browser extensions

#337

Post by iso1631 »

streetfighter64 wrote: post #251
j45 wrote: post #186

Earlier quoted context omitted.

Go try it with fingerprint.com. Even post-sanitization, pi-hole, you name it, it will be surprising.

fingerprint.com seems to be some fingerprinting vendor, they don't even offer a demo without logging in. https://coveryourtracks.eff.org is EFFs demo site is non-profit and doesn't require login

coveryoutracks always tells me I'm unique

Which is concerning. Until you realise I do the same thing a few days later and I'm still unique.

Re: LinkedIn is searching your browser extensions

#338

Post by jijijijij »

sweetheart wrote: post #286
jijijijij wrote: post #214

Earlier quoted context omitted.

Nice try, but you em-dashed like a filthy human. The drone has been dispatched.

the drone that gives hugs, right??? right????

Let me think about that...

Yes. Resistance puts the possibility of hugs on the stool, so to speak.

Re: LinkedIn is searching your browser extensions

#339

Post by phplovesong »

lastofthemojito wrote: post #147
haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

> this is why I run ad blockers. It's pretty wild that we live in a world where the actual FBI has recommended we use ad blockers to protect ourselves, and if everyone actually listened, much of the Internet (and economy) as we know it would disappear. The FBI is like "you should protect yourself from the way that the third largest company in the world does business", and the average person's response is "nah, that w…

YT made sure adblockers ruin the experience. We really need a good YT alternative, as it has become AI slop (shorts) and most new videos are of real poor quality.

Re: LinkedIn is searching your browser extensions

#340

Post by lejalv »

emacdona wrote: post #205
haswell wrote: post #167

Earlier quoted context omitted.

> How is probing your browser for installed extensions not "scanning your computer"? I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate. But this is not happening. What actually is happening is still a problem. But the hyperbole underm…

> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. That is exactly how I interpreted it, and that is why I clicked the link. When I skimmed the article and realized that wasn't the case, I immediately thought "Ugh, clickbait" and came to the HN comments section. > To reiterate, at no point am I saying this is g…

But LinkedIn is the one social network many people literally cannot escape to put food on the table.

I don't care about how much spying is going on in ESPN. I can ditch it at the shadow of a suspicion. Not so with LinkedIn.

This is very alarming, and pretending it's not because everyone else does it sounds disingenuous to me.

Post reply on HN