Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn checks for 2953 browser extensions

github.com

Post reply on HN
Print view View original

41–50 of 263 posts

Re: LinkedIn checks for 2953 browser extensions

#41

Post by charcircuit »

sellmesoap wrote: post #31
charcircuit wrote: post #19

Earlier quoted context omitted.

Why frame what you are trying to say like that? Businesses of all sizes deserve the ability to protect their businesses from abuse.

We enjoy the fruits of an LLM or two from time to time, derived from hoards of ill gotten data. Linkedin has the resourses to attempt to block scraping, but even at the resource scale of LI I doubt the effort is effective.

I am not denying that scraping is useful. If it wasn't people wouldn't do it. But if the site rules say you aren't allowed to scrape, then I don't think people should be hostile towards the people enforcing the rules.

Re: LinkedIn checks for 2953 browser extensions

#43

Post by ronsor »

charcircuit wrote: post #41
sellmesoap wrote: post #31

Earlier quoted context omitted.

We enjoy the fruits of an LLM or two from time to time, derived from hoards of ill gotten data. Linkedin has the resourses to attempt to block scraping, but even at the resource scale of LI I doubt the effort is effective.

I am not denying that scraping is useful. If it wasn't people wouldn't do it. But if the site rules say you aren't allowed to scrape, then I don't think people should be hostile towards the people enforcing the rules.

Well, they can try to enforce the rules; that's perfectly fair. At the same time, there are many methods of "trying" which I would not consider valid or acceptable ones. "Enforcing the rules" does not give a carte blanche right to snoop and do "whatever's necessary." Sony tried that with their CD rootkits and got multiple lawsuits.

Re: LinkedIn checks for 2953 browser extensions

#44

Post by cbsks »

Looks like Firefox is immune.

This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif...

On Firefox, web accessible resources are available at "moz-extension:///myfile.png" is not your extension's ID. This ID is randomly generated for every browser instance. This prevents websites from fingerprinting a browser by examining the extensions it has installed. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Re: LinkedIn checks for 2953 browser extensions

#45

Post by tech234a »

0cf8612b2e1e wrote: post #11
ronsor wrote: post #5

Earlier quoted context omitted.

This is a security vulnerability and should be patched. Sorry, LinkedIn. (Alternatively extension developers can modify their extensions to block these requests!)

No kidding. I am shocked this works. Does Firefox have a similar weakness?

No. Firefox always randomizes the extension ID used for URLs to web accessible resources on each restart [1]. Apparently, manifest v3 extensions on Chromium can now opt into similar behavior [2].

[1]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

[2]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Re: LinkedIn checks for 2953 browser extensions

#46

Post by cxr »

halapro wrote: post #17
lapcat wrote: post #2

[removed]

If this is true, it's insane that this would work: - why does CWS respond to cross-site requests? - why is chrome sending the credentials (or equivalent) in these requests? - why is the button enabled server-side and not via JS? Google must be confident in knowing the exact and latest state of your installed extensions enough to store it on their servers, I guess

It's not true. The person you're responding to has a habit of posting implausible-but-plausibly-plausible nonsense, and it's not how this works at all.

Re: LinkedIn checks for 2953 browser extensions

#47

Post by jmward01 »

charcircuit wrote: post #19
hsbauauvhabzb wrote: post #16

Earlier quoted context omitted.

Wont someone think of poor little LinkedIn, a subsidiary of one of the largest data brokers in the world?

Why frame what you are trying to say like that? Businesses of all sizes deserve the ability to protect their businesses from abuse.

Do they respect my data? Why do they get to track me across sites when I clearly don't want them to but someone can't scrape their data when they don't want them to. Why should big companies get the pass but individuals not? They clearly consider internet traffic fair game and are invasive and abusive about it so it is not only fair to be invasive and abusive back, it is self defense at this point.

Re: LinkedIn checks for 2953 browser extensions

#50

Post by CobrastanJorji »

mongrelion wrote: post #7

Curious question: why would they check for installed extensions on one's browser?

Fingerprinting. There are a few reasons you'd do it:

1. Bot prevention. If the bots don't know that you're doing this, you might have a reliable bot detector for a while. The bots will quite possibly have no extensions at all, or even better specific exact combination they always use. Noticing bots means you can block them from scraping your site or spamming your users. If you wanna be very fancy, you could provide fake data or quietly ignore the stuff they create on the site.

2. Spamming/misuse evasion. Imagine an extension called "Send Messages to everybody with a given job role at this company." LinkedIn would prefer not to allow that, probably because they'd want to sell that feature.

3. User tracking.

Post reply on HN