Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

Post reply on HN
Print view View original

661–670 of 836 posts

Re: LinkedIn is searching your browser extensions

#661

Post by frugalmail »

roblabla wrote: post #105
kps wrote: post #53

Earlier quoted context omitted.

Why is it possible for a web site to determine what browser extensions I have installed? If there are legitimate uses, why isn't this gated behind a permission prompt, like things like location and camera?

It does two things: 1. Do a request to `chrome-extension:// / `. It's unclear to me why this is allowed. 2. Scan the DOM, look for nodes containing "chrome-extension://" within them (for instance because they link to an internal resource) It's pretty obvious why the second one works, and that "feels alright" - if an extension modifies the DOM, then it's going to leave traces behind that the page might be able to pick…

For widget style services: If you need the functionality of an extension to operate, then you can check if it's already installed so you don't ask to install it again.

This is better than forcing the extension to announce it's presences on every web site.

Re: LinkedIn is searching your browser extensions

#662

Post by ankaz »

cryptoegorophy wrote: post #331
Aurornis wrote: post #155

Earlier quoted context omitted.

Many extensions designed to scrape data from social media websites are disguised as simple extensions that do something else. If I had to guess: I sought that automatic content blurrer, neurodivergent website simplifier, or anti-Zionist tagger actually work. They’re all just piggybacking on trending topics to get users to install them and then forget about them, then they exfiltrate the data when you visit LinkedIn.

This. Do not install any extension unless you absolutely need. Assume they all leak your browsing data. Not familiar with Google but if you can just vibe code your own extension then do that.

[dead]

Re: LinkedIn is searching your browser extensions

#663

Post by jll29 »

philipallstar wrote: post #641
jcgrillo wrote: post #431

Earlier quoted context omitted.

You can't actually push back as an IC. Tech companies aren't structured that way. There's no employment protection of any kind, at least in the US. So the most you can do is protest and resign, or protest and be fired. Either way, it'll cost you your job. I've paid that price and it's steep. There's no viable "grassroots" solution to the problem, it needs to come from regulation. Managers need to serve time in prison…

> There's no viable "grassroots" solution to the problem Does something like running the duckduckgo extension not help?

I'm hoping the Ladybird project's new Web browser (alpha release expected in August) will solve some issues resulting from big tech controlling most browers.

Re: LinkedIn is searching your browser extensions

#664

Post by sdeframond »

haswell wrote: post #264
ryandrake wrote: post #230

Earlier quoted context omitted.

> What the article describes sounds like what many devs would land on given the browser APIs available. > To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed. These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects. What t…

I completely agree. Fighting against these kinds of directives was a large factor in my own major burnout and ultimately quitting big tech. I was successful for awhile, but it takes a serious toll if you’re an IC constantly fighting against directors and VPs just concerned about solving some perceived business problem regardless of the technical barriers. Part of the problem is that these projects often address a leg…

Oh yeah. Must be an anti-fraud/child abuse/money laudering/terrorism/fake news thing. All real problems with no known good solution (to my knowledge, please prove me wrong).

Edit: typos

Re: LinkedIn is searching your browser extensions

#665

Post by Imustaskforhelp »

LinkedIn is definitely one of the most by far worse companies I have had to ever interact with.

Literally 2 days ago, I submitted a post: LinkedIn "final decision", restricting my account and making me feel unheard[0] explaining all of some of the worst customer support I have seen

I wish to give a TLDR, but essentially Linkedin will simply reject your account or give you immense headache if your id's aren't being detected by persona (persona is a really shady-company in it of itself with really not the best security practices) I actually lost count of how many times their customer support just responded with a bland message and just didn't even read my message

This is why, being frustrated out of all of this, I actually sent a linkedin customer support message that I don't feel heard, I want to be heard by human, so if you are a human especially when they were asking ME to go to a public notary to sign an affadavite to get a 1 day old restricted Linkedin account (oh btw, its also illegal for a minor to sign an public notary in my country the way they mentioned and I mentioned it about as many times as I could and that I am willing to share my ID like Aadhaar to them but they genuinely don't hear your messages)

Honestly, my experience just says that there is no human customer support in Linkedin, its really a customer support nightmare worse than even some of the telecom horror stories. Perhaps I should contact browsergate.eu if my incident within my country can also be a case of legality or not, essentially I was cooperating with them to give any document that I can reasonably provide but linkedin forms and everything redirect to 404 as well.You can read my experience in depths but my experience really shows me as to Linkedin customer support being so unhelpful that you question how a company can be so bad. I wish for more ethical alternatives to Linkedin and its nightmare to appear within this space.

(I also had a minor idea of asking Linkedin support to see if they read my messages and literally as I told them that I feel unheard, I would like it if they can make me feel heard and that they are reading my messages so If they are actually reading my message, then respond to me with value of 351/13 and I asked the person who joined Linkedin as to why they joined Linkedin, essentially just one line would suffice to know if I am talking to human or not, they did not respond to any of this and essentially, as far as I can tell, pasted another pre-generated response not hearing me)

[0]: https://news.ycombinator.com/item?id=47586760 (https://smileplease.mataroa.blog/blog/linkedin/)

Re: LinkedIn is searching your browser extensions

#666

Post by BrianGragg »

andersonpico wrote: post #99
haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

I personally think its misleading and even when you start reading the page it links to is even more misleading in my opinion.

>Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm.

When I read that, I think they have escaped the browser and checking which applications I have installed on my computer. Not which plugins the browser has in it. Just my 2cents.

Re: LinkedIn is searching your browser extensions

#667

Post by Shog9 »

crazygringo wrote: post #626
nightpool wrote: post #274

Earlier quoted context omitted.

> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. Yes, but I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox. The fact that there's no getAllExtensions API is deliberate. The fact…

> Yes, but I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox. I don't think so, because most people understand that extensions necessarily work inside of the sandbox . Accessing your filesystem is a meaningful escape. Accessing extensions means they have identification mechanisms unfortu…

Y'all are letting "most people" carry an awful lot of water for this scummy behavior here.

In my experience, most people - even most tech people - are unaware of just how much information a bit of script on a website can snag without triggering so much as a mild warning in the browser UI. And tend toward shock and horror on those occasions where they encounter evidence of reality.

The widespread "Facebook is listening to me" belief is my favorite proxy for this ... Because, it sorta is - just... Not in the way folks think. Don't need ears if you see everything!

Re: LinkedIn is searching your browser extensions

#668

Post by fragmede »

1shooner wrote: post #168
andersonpico wrote: post #99

Earlier quoted context omitted.

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re…

>Calling the title misleading because they didn't breach the browser sandbox is wrong By this logic we could also say that LinkedIn scans your home network.

XSS never a thing in your world?

Re: LinkedIn is searching your browser extensions

#669

Post by fragmede »

haswell wrote: post #14

The headline seems pretty misleading. Here’s what seems to actually be going on: > Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. This does seem invasive. It also seems like what I’d expect…

To flip it around, if one of those chrome extensions saved parts of the contents of the page it was on into a database, and I had the chrome extension navigate around on LinkedIn for me, collecting information, LinkedIn would sue me for CFAA violations because I'm scraping them for email addresses and phone numbers. This is not theoretical either, as LinkedIn has sued people in the past for scraping.

Re: LinkedIn is searching your browser extensions

#670

Post by JumpCrisscross »

OkayPhysicist wrote: post #593
JumpCrisscross wrote: post #534

Earlier quoted context omitted.

> there's a good chunk of the Chrome team who are actively enemy combatants Uh what.

Everyone involved in Chrome's most questionable decisions such as Manifest V3's anti-adblocking, the Topics API, etc, are not just working orthogonal to the people's interest, they are directly working against it. I couched my statement down from the entirety of the Chrome team because I hesitate to label "making constant, marginal feature additions that ultimately result in anti competitive behavior" openly maliciou…

None of this makes them “enemy combatants.”
Post reply on HN