Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

611–620 of 836 posts

Re: LinkedIn is searching your browser extensions

#611

Post by Dylan16807 »

order-matters wrote: post #440
FloorEgg wrote: post #397

Earlier quoted context omitted.

In 2023 I did a deep dive into the crypto community with two main questions: - do these people understand the principles of making good products? - is anyone clearly working towards a microtransaction system that could replace advertising and subscription models? After attending two conferences, hundreds of conversations and hours spent researching, my conclusion to both questions was no. The community felt more like…

I have also done similar research because I wanted to build something to handle microtransactions on a personal website that could scale if adopted to be usable by everyone if they wanted. I looked at crypto currency because it seems like the obvious naive solution. it doesnt work. the cost of the transaction itself far outweighs the value of the transaction when dealing with fractions of a cent. you want an entire n…

It would need to be mostly centralized, but keeping track of history would not be hard.

A typical credit is getting paid in, transacted once, and cashed out. And a transaction with a user ID, destination ID, and timestamp only needs 16 bytes to store. So if you want to track every hundredth of a penny individually, then processing a million dollars generates 0.16 terabytes of data. You want to keep that around for five years? Okay, that's around $100 in cost. If you're taking a 1% fee then the storage cost is 1% of your fee.

If your credits are worth 1/20th of a penny, and you store history for 18 months, then that drops the amount of data 17x.

(And any criticisms of these numbers based on database overhead get countered by the fact that you would not store a 10 credit transaction as 10 separate database entries.)

Re: LinkedIn is searching your browser extensions

#612

Post by lxgr »

eipi10_hn wrote: post #601
lxgr wrote: post #468

Earlier quoted context omitted.

Turns out Firefox has a similar issue, despite mitigations :( https://bugzilla.mozilla.org/show_bug.cgi?id=1372288

This only happens if the extension puts their `moz-extension://` links into the DOM. It's different to chrome case where extensions can be detected regardless of being activated on that site or not.

As I understand it, an extension could also leak its links via its own backend, e.g. to advertisers, who could then detect it even though no user-observable DOM modification is happening.

Much better than static global IDs, but still not ideal.

Re: LinkedIn is searching your browser extensions

#613

Post by drnick1 »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

The bigger problem I see here is browser security and Javascript as a whole. Browsers should not be allowed to extract and send such vast amounts of information in the first place, especially without the user's consent. At most, they should return a few broad things such as browser type (major version), language perhaps, and device type (mobile/desktop). That's it. Other things, such as exact resolutions, time zones, and other hardware identifiers make it trivially easy to track users across the Internet. Now that it's too late to revise Web standards, browsers should default to return spoofed values for all the rest.

Re: LinkedIn is searching your browser extensions

#614

Post by aerhardt »

padjo wrote: post #523
jobberknoll wrote: post #498

Can't be said enough: Stop using Chrome.

Also: stop installing random extensions

A lot of extensions on LinkedIn are necessary because of their total lack of innovation. You really cannot do anything in B2B sales or recruiting with only LinkedIn tools. These are not random extensions, but crucial extensions literally saving billions of dollars in wasted time or creating massive opportunities in the global economy.

Re: LinkedIn is searching your browser extensions

#615

Post by keeda »

mikkupikku wrote: post #29
Ajedi32 wrote: post #18

Earlier quoted context omitted.

LinkedIn is a job board so that seems unlikely.

Are you kidding? They've probably been selling a datastream of who in the company has been job searching to company HR departments the whole time. Search for a job on LinkedIn and I bet anybody with a paid corporate account can find that out if they care to.

LinkedIn actually sued HiQ Labs, which scraped LinkedIn to do exactly this (and this extensions scanning is likely a defense mechanism against similar attacks):

https://epic.org/documents/linkedin-corp-v-hiq-labs-inc/

> HiQ has created two specific data products targeted at employers: (1) “Keeper,” which informs employers which of their employees are at “risk” of being recruited by competitors; and...

My hunch is that HiQ simply looked for spikes in activity on LinkedIn as a signal for a job hunt: https://news.ycombinator.com/item?id=47566893

In any case, this lawsuit was discussed a few times on HN at the time, and IIRC there were a fair bit of support for allowing free scraping of "public information." Interesting how the sentiment here has turned these days...

Re: LinkedIn is searching your browser extensions

#616

Post by chickensong »

stronglikedan wrote: post #565
lastofthemojito wrote: post #147

Earlier quoted context omitted.

> this is why I run ad blockers. It's pretty wild that we live in a world where the actual FBI has recommended we use ad blockers to protect ourselves, and if everyone actually listened, much of the Internet (and economy) as we know it would disappear. The FBI is like "you should protect yourself from the way that the third largest company in the world does business", and the average person's response is "nah, that w…

> the average person's response is ... I'll just go ahead and continue to suffer with invasive ads The real reason is that the average person neither suffers with ads nor finds ads invasive, despite what a vocal online minority would have you believe. We just ignore them and get on with life. ::shrug::

Ignoring (post-impact) and moving on is the natural thing to do, but it seems like a stretch to imply that the average person neither suffers or finds ads invasive.

The suffering isn't acute, it's death by a thousand cuts as your mind erodes into a twitchy mess. Look at the comment section of a nice youtube video and see people outraged at getting blasted with an ad at the wrong moment.

Most people don't like ads, but we love the stimulation of the screen more so we suffer them, regardless of the damage done.

Re: LinkedIn is searching your browser extensions

#617

Post by Griffinsauce »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

> But I do take some issue with the alarmist framing of what's going on.

On the contrary, your framing is quite defeatist IMO. The fact that stores get robbed frequently does not mean we should just normalize that and accept it as a fact of life.

Re: LinkedIn is searching your browser extensions

#618

Post by gzread »

MidnightRider39 wrote: post #579
gzread wrote: post #560

Earlier quoted context omitted.

The best browser is either Waterfox or Librewolf since they're Firefox-based but don't steal your data or claim copyright on it.

It would be news to me that Firefox steals data or claims copyright on my data - do you have anything concrete to back that up?

It was their terms of service change at the start of 2025. It caused quite a shitstorm.

Re: LinkedIn is searching your browser extensions

#619

Post by leptons »

andersonpico wrote: post #99
haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

>How is probing your browser for installed extensions not "scanning your computer"?

The same way taking a photo of a house from the street is not the same as investigating the contents of your pantry.

Re: LinkedIn is searching your browser extensions

#620

Post by TZubiri »

andersonpico wrote: post #99
haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

Because "scanning your computer" technically could include scanning plugins, but it could also include scanning your files, your network or your operating system.

While "scanning your browser" would be more accurate and would exclude the interpretation that it scans your files.

The reason the latter is not used is that, even though more precise and more communicative, it would get less clicks.

Post reply on HN