Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn checks for 2953 browser extensions

github.com

Post reply on HN
Print view View original

51–60 of 263 posts

Re: LinkedIn checks for 2953 browser extensions

#51

Post by nitwit005 »

charcircuit wrote: post #19
hsbauauvhabzb wrote: post #16

Earlier quoted context omitted.

Wont someone think of poor little LinkedIn, a subsidiary of one of the largest data brokers in the world?

Why frame what you are trying to say like that? Businesses of all sizes deserve the ability to protect their businesses from abuse.

I'm sure there are issues with fake accounts for scraping, but the core issue is that LinkedIn considers the data valuable. LinkedIn wants to be able to sell the data, or access to it at least, and the scrapers undermine that.

They could stop all the scraping by providing a downloadable data bundle like Wikipedia.

Re: LinkedIn checks for 2953 browser extensions

#52

Post by circuit10 »

zahlman wrote: post #32
toomuchtodo wrote: post #13

Earlier quoted context omitted.

Is there no browser setting to defend against this attack? If not, there should be, versus relying on extension authors to configure or enable such a setting.

I imagine that it would require browsers to treat web requests from JS differently from those initiated by the user, specifically pretending the JS-originating requests are by logged-out or "incognito" users (by, I suppose, simply not forwarding any local credentials along, but maybe there's more to it than that). Which would probably wreak havoc with a lot of web apps, at least requiring some kind of same-origin pol…

As people have said it’s not making requests to web store, that’s just part of this repository looking for what extensions it’s blocking via nodejs

Browsers already have strong protections against that sort of thing, look up the same-origin policy and CORS

Re: LinkedIn checks for 2953 browser extensions

#53

Post by josephg »

xp84 wrote: post #20
hsbauauvhabzb wrote: post #16

Earlier quoted context omitted.

Wont someone think of poor little LinkedIn, a subsidiary of one of the largest data brokers in the world?

I mean, regardless of who they are or even if you don’t like what LinkedIn does themselves with the data people have given them, the random third parties with the extensions don’t additionally deserve to just grab all that data too, do they?

Eh. I worked at a company which made an extension which scraped LinkedIn. We provided a service to recruiters, who would start a hiring process by putting candidates into our system.

The recruiters all had LinkedIn paid accounts, and could access all of this data on the web. We made a browser extension so they wouldn’t need to do any manual data entry. Recruiters loved the extension because it saved them time.

I think it was a legitimate use. We were making LinkedIn more useful to some of their actual customers (recruiters) by adding a somewhat cursed api integration via a chrome extension. Forcing recruiters to copy and paste did’t help anyone. Our extension only grabbed content on the page the recruiter had open. It was purely read only and scoped by the user.

Re: LinkedIn checks for 2953 browser extensions

#54

Post by hsbauauvhabzb »

ronsor wrote: post #25
charcircuit wrote: post #19

Earlier quoted context omitted.

Why frame what you are trying to say like that? Businesses of all sizes deserve the ability to protect their businesses from abuse.

I think they framed it this way because they don't consider scraping abuse (to be fair, neither do I, as long as it doesn't overload the site). Botting accounts for spam is clear abuse, however, so that's fair game.

No, I consider all data collection and scraping egregious. From that perspective, LinkedIn is hypocritical when Microsoft discloses every filesystem search I do locally to bing.

Re: LinkedIn checks for 2953 browser extensions

#55

Post by what »

jsheard wrote: post #22
lapcat wrote: post #2

[removed]

Looks to me like LinkedIn is fetching chrome-extension://{extension id}/{known filename} and seeing if it succeeds, not pinging the web store. Should be patched nonetheless though, that's a pretty obscene fingerprinting vector.

How do you patch it? The extensions themselves (presumably) need to access the same web accessible resources from their content scripts. How do you differentiate between some extension’s content script requesting the resource and LinkedIn requesting it?

Re: LinkedIn checks for 2953 browser extensions

#56

Post by cxr »

rdoherty wrote: post #15

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

In order to create the data source that LinkedIn's extension-fingerprinting relies on to work, someone (at LinkedIn*?) almost certainly violated the Chrome Web Store TOS—by (perversely*) scraping it.

* if LinkedIn didn't get it from an existing data source

Re: LinkedIn checks for 2953 browser extensions

#57

Post by hsbauauvhabzb »

jmward01 wrote: post #47
charcircuit wrote: post #19

Earlier quoted context omitted.

Why frame what you are trying to say like that? Businesses of all sizes deserve the ability to protect their businesses from abuse.

Do they respect my data? Why do they get to track me across sites when I clearly don't want them to but someone can't scrape their data when they don't want them to. Why should big companies get the pass but individuals not? They clearly consider internet traffic fair game and are invasive and abusive about it so it is not only fair to be invasive and abusive back, it is self defense at this point.

They don’t need to track your web browser when they’re owned by Microsoft, because they track every action at a lower level.

Re: LinkedIn checks for 2953 browser extensions

#59

Post by jsheard »

what wrote: post #55
jsheard wrote: post #22

Earlier quoted context omitted.

Looks to me like LinkedIn is fetching chrome-extension://{extension id}/{known filename} and seeing if it succeeds, not pinging the web store. Should be patched nonetheless though, that's a pretty obscene fingerprinting vector.

How do you patch it? The extensions themselves (presumably) need to access the same web accessible resources from their content scripts. How do you differentiate between some extension’s content script requesting the resource and LinkedIn requesting it?

Firefox already mitigates this by randomizing the extension path: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

    The file is then available using a URL like: moz-extension:///images/my-image.png"
     is not your extension's ID. This ID is randomly generated for every browser instance.
    This prevents websites from fingerprinting a browser by examining the extensions it has installed.

Re: LinkedIn checks for 2953 browser extensions

#60

Post by jmholla »

shouldnt_be wrote: post #58

I wrote an article about it a couple of months ago. I also explain why, how and a way to prevent it. https://javascript.plainenglish.io/the-extensions-you-use-ar...

To clarify, you talk about why it's possible, not why LinkedIn is doing it, right? Or did I miss something in your article.
Post reply on HN