731–740 of 836 posts
I mean, come on. Do I like that they are making use of browser fingerprinting? Not really. But to make it sound like they are "illegally" scanning my computer is ridiculous.
Earlier quoted context omitted.
Why is it possible for a web site to determine what browser extensions I have installed? If there are legitimate uses, why isn't this gated behind a permission prompt, like things like location and camera?
It does two things: 1. Do a request to `chrome-extension:// / `. It's unclear to me why this is allowed. 2. Scan the DOM, look for nodes containing "chrome-extension://" within them (for instance because they link to an internal resource) It's pretty obvious why the second one works, and that "feels alright" - if an extension modifies the DOM, then it's going to leave traces behind that the page might be able to pick…
These are web accessible resources, e.g. images and stylesheets you can reference in generated HTML. Since content scripts operate directly on the same DOM, it’s unclear how you can tell an or came from the modification of a content script or a first party script. You might argue it’s possible to block these in fetch(), but then you also need to consider leaks in say Image’s load event.
This behavior has been improved in MV3, with option to make the extension id dynamic to defeat detection:
> Note: In Chrome in Manifest V2, an extension's ID is fixed. When a resource is listed in web_accessible_resources, it is accessible as chrome-extension:///. In Manifest V3, Chrome can use a dynamic URL by setting use_dynamic_url to true.
This should really be the default though.
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
Fwiw... I now run personal and professional browser profiles from two different jails / cgroups. It's a pain in the arse to set up, and I have to verify my config still works after every update, but I get a good feeling knowing my personal chocolate is not mixing in with my professional peanut butter. I set up the cgroups hack so I could route traffic from a dev profile into a VPS vpn, and may not be that useful for…
I... I searched for this extension.
Earlier quoted context omitted.
Calling out the fingerprinting users' extensions is not hyperbolic. Defending that action is.
Calling out the fingerprinting of extensions is appropriate and can be achieved without hyperbole. As I’ve stated clearly throughout this thread, the fingerprinting they’re doing is a problem. Calling it “searching your computer” is also a problem. > Defending that action is Nowhere have I defended what LinkedIn is doing.
> Nowhere have I defended what LinkedIn is doing.
Yep. You feel the same taste of your own. You are accusing the site being hyperbole and alarmism. I'm accusing you being defendant of linkedin.
Earlier quoted context omitted.
This only happens if the extension puts their `moz-extension://` links into the DOM. It's different to chrome case where extensions can be detected regardless of being activated on that site or not.
As I understand it, an extension could also leak its links via its own backend, e.g. to advertisers, who could then detect it even though no user-observable DOM modification is happening. Much better than static global IDs, but still not ideal.
Earlier quoted context omitted.
> How is probing your browser for installed extensions not "scanning your computer"? I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate. But this is not happening. What actually is happening is still a problem. But the hyperbole underm…
> What the article describes sounds like what many devs would land on given the browser APIs available. > To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed. These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects. What t…
Earlier quoted context omitted.
Calling out the fingerprinting of extensions is appropriate and can be achieved without hyperbole. As I’ve stated clearly throughout this thread, the fingerprinting they’re doing is a problem. Calling it “searching your computer” is also a problem. > Defending that action is Nowhere have I defended what LinkedIn is doing.
It's `searching your computer`, period. The extensions are part of my computer. They don't exist in my refrigerator. > Nowhere have I defended what LinkedIn is doing. Yep. You feel the same taste of your own. You are accusing the site being hyperbole and alarmism. I'm accusing you being defendant of linkedin.
If you think about, to protect yourself: The EFF privacy badger browser add-on [1] try to block fingerprinting.
Also, browser fingerprints are a common tracking pattern nowadays. You can test [2] your browser and please start protect your self: E.g. use add-ons like U-Block and Privacy Badger to block tracking and/or use different browser and devices for different use cases. DNS-blocking with block-list like hegazi [3] is IMO the best option, but also a bit more involved, when you host you own DNS forwarder(s). For example AdGuard Home [4] helps you with hosting your own DNS infrastructure. It's also possible to add block-lists to dnsmasq or unbound and run them on you notebook as forwarders.
[1] https://privacybadger.org/
[2] https://coveryourtracks.eff.org/