LinkedIn is searching your browser extensions

Post by austin-cheney » Thu, Apr 02, 2026, 7:13 PM UTC

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

    async function c() {
      const e = [],
        t = r.map(({id: t, file: n}) => {
          return fetch(`chrome-extension://${t}/${n}`)
        });
      (await Promise.allSettled(t)).forEach((t, n) => {
        if ("fulfilled" === t.status && void 0 !== t.value) {
          const t = r[n];
          t && e.push(t.id);
        }
      });
      return e;
    }

    async function(e) {
      const t = [];
      for (const {id: n, file: i} of r) {
        try {
          await fetch(`chrome-extension://${n}/${i}`) && t.push(n);
        } catch(e) {}
        e > 0 && await new Promise(t => setTimeout(t, e));
      }
      return t;
    }

    chrome-extension://${store_id}/${file_name}

Post by brokencode » Thu, Apr 02, 2026, 7:19 PM UTC

bookofjoe wrote: post #548

brokencode wrote: post #466

Earlier quoted context omitted.

I mean yeah, you pay for the internet. But many sites are free to use only due to ads. Such as news and magazine sites, many of which are actively dying due to a lack of revenue. I personally wish these sites could all switch to paid models, because I also don’t like ads. But absent that, I’d like to support the sites I use so that they don’t go out of business.

I have expensive online subscriptions to New York Times, Wall Street Journal, and Washington Post. Nevertheless they are FILLED with ads/popups/videos that run automatically/dark patterns. Just saying: there's no refuge.

Post by mrguyorama » Thu, Apr 02, 2026, 7:25 PM UTC

benregenspan wrote: post #556

mrguyorama wrote: post #500

Earlier quoted context omitted.

I integrate these kinds of systems in order to prevent criminals from being able to use our ecommerce platform to utilize stolen credit cards. That involves integrating with tracking providers to best recognize whether a purchase is being made by a bot or not, whether it matches "Normal" signals for that kind of order, and importantly, whether the credit card is being used by the normal tracking identity that uses it…

What I'm wondering is if this requires sending the full list of extensions straight to a server (as opposed to a more privacy-protecting approach like generating some type of hash clientside)? Based on their privacy policy, it looks like Sift (major anti-fraud vendor) collects only "number of plugins" and "plugins hash". No one can accuse them of collecting the plugins for some dual-use purpose beyond fingerprinting,…

Post by autoexec » Thu, Apr 02, 2026, 7:26 PM UTC

j45 wrote: post #625

autoexec wrote: post #521

Earlier quoted context omitted.

Disable JS and you've eliminated the vast majority of fingerprinting (besides "blocks JS")

alternatively, css can script quite a bit... :)

Post by School-Cotton » Thu, Apr 02, 2026, 7:29 PM UTC

lejalv wrote: post #340

emacdona wrote: post #205

Earlier quoted context omitted.

> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. That is exactly how I interpreted it, and that is why I clicked the link. When I skimmed the article and realized that wasn't the case, I immediately thought "Ugh, clickbait" and came to the HN comments section. > To reiterate, at no point am I saying this is g…

But LinkedIn is the one social network many people literally cannot escape to put food on the table. I don't care about how much spying is going on in ESPN. I can ditch it at the shadow of a suspicion. Not so with LinkedIn. This is very alarming, and pretending it's not because everyone else does it sounds disingenuous to me.