Live data from Hacker News

LinkedIn is searching your browser extensions

browsergate.eu

741–750 of 836 posts

Re: LinkedIn is searching your browser extensions

#743

Earlier quoted context omitted.

YT made sure adblockers ruin the experience. We really need a good YT alternative, as it has become AI slop (shorts) and most new videos are of real poor quality.

You’re not going to get a YT alternative if it can’t make money with ads.

Ooh this one's easy

Nebula

Re: LinkedIn is searching your browser extensions

#744
post #726
post #551

A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. Anyway, what they're calling "spectroscopy", is a combination of extension probing and doing residue detection (looking for what extensions might leave behind in the DOM). An ad blocker is not necessarily equipped to help since the script is embedded with the application code. Since th…

> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years. That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my…

Have you (or anyone reading this) been able to "beat" fingerprint.com without Tor or turning JavaScript off outright?

I've tried it various times over the last couple years, using different browsers with various privacy settings enabled and a VPN.

I can get good partial results and am able to reset my fingerprint by changing my OS and browser at the same time, so it's not entirely there with regards to sniffing the hardware. But I can never revisit the site and have it not recognize me. Is there no one but me using (for example) Debian testing Librewolf with resistFingerprinting on Proton VPN? If there are others, then resistFingerprinting is doing a bad job hiding my hardware.

That's depressing! Despite our genuine best efforts, enough identifiers leak that it seems to me there's no practical solution. I am genuinely at a loss for what we can do.

(If you're reading this and think it doesn't matter, it's possible you're not realizing that this means that any site collecting and storing these identifiers now will be able to talk to any site in the future and link your identity. Your past actions on every website on a given piece of hardware are liable to be linked to create a detailed profile in the future, so even if Reddit and Pornhub and Discord and the government aren't talking to each other now, you can put some decent probability in the fact that if they decided to share identifiers, they could link all your historical (signed out) activity to your real-world identity without much effort. I use those sites as examples because they're sites where people tend to generate information that they may want private, but they visit using the same hardware identifiers.)

Re: LinkedIn is searching your browser extensions

#745

Earlier quoted context omitted.

What's the path for that to even happen? Are companies now commonly uploading lists of employees to LinkedIn? Is this happening automatically because you got an e-mail account from the company and the company runs on MS Office and you're identified as am employee within it? What triggered it? This seems like somewhat of a scandal that deserves its own post, but it also needs a lot more details to be trustworthy and f…

I rather suspect the information was siphoned to linkedin from the payroll company the consulting firm was using. While there are a zillion small consulting firms, there are a small number of firms which process their payroll (whether to employees or independent contractors like myself). I have no evidence to back this up but after thinking it through, it made more sense than every little mom/pop/medium size niche co…

That is extremely disturbing to hear!

What is the benefit that the company derives from that? Kickbacks from LinkedIn? I'm not saying it is, or isn't, I don't understand what the benefit to be gotten from it is. It seems like a lot of effort by one party or the other, unless it is "baked in" to an MS account or whatever.

Also, as the person above had asked: did you have any option/ability to "take control" of the account, or did it have to go through the consulting company was using? It almost feels like someone had a fake ID card made for you. Not a drivers license, but something that would be of greater concern to the person on the ID (LinkedIn profile) than the company making it.

Re: LinkedIn is searching your browser extensions

#746
post #726

Earlier quoted context omitted.

> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years. That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my…

Have you (or anyone reading this) been able to "beat" fingerprint.com without Tor or turning JavaScript off outright? I've tried it various times over the last couple years, using different browsers with various privacy settings enabled and a VPN. I can get good partial results and am able to reset my fingerprint by changing my OS and browser at the same time, so it's not entirely there with regards to sniffing the h…

It is depressing how robust it is!

I can beat it, but only be changing my IP. Since I'm not using a shared IP like a university/company might, my IP is giving them a lot of bits about me since I'm the only entity using it... No matter the browser switch, if I hit it from the same IP, it correctly assumes that my IP is still me. But the moment I switch to a different browser and change IPs I get a new fingerprint. Haven't dug deep on it though, like would an incognito window in Chrome on a new IP, have the same fingerprint as a non-incognito Chrome window on another IP? Not sure

I would love to play around with that fingerprint demo while on a large shared IP, where they the IP itself provides less signal and is less unique.

Re: LinkedIn is searching your browser extensions

#747

Earlier quoted context omitted.

HackerNews users used to be the type that would do the scraping, so they could Hack the data into whatever format or integration they desired. It's unfortunate to see folks here who don't support that – interoperability is at the heart of the Hacker Ethic. LinkedIn (along with any other big tech companies locking down and crippling their APIs) is wrong to even try to block it. Is it an issue of the resources scrapers…

LinkedIn has an API you can use at your convenience: https://learn.microsoft.com/en-us/linkedin/ Accessing other users' LinkedIn data via the API requires their OAuth consent, as it should be. But you are welcome to access your own data via the API.

Can I, an ordinary user, get access to that API and use it to fetch my messages?

Last time I checked, I could not.

Re: LinkedIn is searching your browser extensions

#748
post #726
post #551

A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. Anyway, what they're calling "spectroscopy", is a combination of extension probing and doing residue detection (looking for what extensions might leave behind in the DOM). An ad blocker is not necessarily equipped to help since the script is embedded with the application code. Since th…

> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years. That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my…

I've been getting into making and breaking these antibots recently and it's funny to me how the person who wrote this post gave so much attention to what LinkedIn was doing and left the other antibots on the page as a footnote. They grab way more, they just don't let you see it. I haven't reversed PX or Recap yet but the antibot on twitch and Nike similarly checks if you have any of these 53 apps installed (when loaded on a WebKit browser) https://pastebin.com/raw/KACvjpTK

Re: LinkedIn is searching your browser extensions

#749
post #165

Earlier quoted context omitted.

it doesn't have to be files. it could be in memory on the browser. Extensions don't imply files for anyone but the most technical of conversations. Certainly not to the laymen. Having sensationalist titles should be called out at every opportunity.

> it doesn't have to be files. it could be in memory on the browser. How'd that work? If it's in memory, the extensions would vanish everytime I shutdown Chrome? I'll have to reinstall all my extensions again everytime I restart Chrome? Have you seen any browser that keeps extension in memory? Where they ask the user to reinstall their extensions everytime they start the browser?

I'm just using it as a possible example. There's also tampermonkey which installs not via files but via urls from another site.

The point is to call out the sensationalism in the title.

Re: LinkedIn is searching your browser extensions

#750
post #726

Earlier quoted context omitted.

> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years. That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my…

Have you (or anyone reading this) been able to "beat" fingerprint.com without Tor or turning JavaScript off outright? I've tried it various times over the last couple years, using different browsers with various privacy settings enabled and a VPN. I can get good partial results and am able to reset my fingerprint by changing my OS and browser at the same time, so it's not entirely there with regards to sniffing the h…

Yes!

At least for now. Tried many browsers and Mullvad Browser and Konform Browser are the only two that I managed to beat them with. They both enforce bundled set of fonts like Tor Browser. Firefox and other forks are fingerprintable via variations in font rendering due to system fontconf or fonts differing.

Post reply on HN