Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn checks for 2953 browser extensions

github.com

Post reply on HN
Print view View original

81–90 of 263 posts

Re: LinkedIn checks for 2953 browser extensions

#81

Post by b112 »

awesome_dude wrote: post #70
cbsks wrote: post #44

Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif... On Firefox, web accessible resources are available at "moz-extension:// /myfile.png" is not your extension's ID. This ID is randomly gener…

This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"

Maybe, but how long are the extension ids? And if they are random, how long to scan a trillion random alphanumeric ids, to find matches?

I presume the extension knows when it wants to access resources of its own. But random javascript, doesn't.

Re: LinkedIn checks for 2953 browser extensions

#82

Post by zelphirkalt »

missingdays wrote: post #64
hsbauauvhabzb wrote: post #57

Earlier quoted context omitted.

They don’t need to track your web browser when they’re owned by Microsoft, because they track every action at a lower level.

What lower level? Microsoft owns internet?

The operating system. For example see the Windows 11 screenshot debacle/scandal.

Re: LinkedIn checks for 2953 browser extensions

#83

Post by b112 »

charcircuit wrote: post #19
hsbauauvhabzb wrote: post #16

Earlier quoted context omitted.

Wont someone think of poor little LinkedIn, a subsidiary of one of the largest data brokers in the world?

Why frame what you are trying to say like that? Businesses of all sizes deserve the ability to protect their businesses from abuse.

Yes, until it becomes abusive and malignly affects innocents.

Re: LinkedIn checks for 2953 browser extensions

#84

Post by maples37 »

b112 wrote: post #81
awesome_dude wrote: post #70

Earlier quoted context omitted.

This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"

Maybe, but how long are the extension ids? And if they are random, how long to scan a trillion random alphanumeric ids, to find matches? I presume the extension knows when it wants to access resources of its own. But random javascript, doesn't.

The extension IDs are UUIDs/GUIDs, so 128 bits of entropy. No site is going to be able to successfully scan that full range.

Re: LinkedIn checks for 2953 browser extensions

#85

Post by [deleted] »

b112 wrote: post #81
awesome_dude wrote: post #70

Earlier quoted context omitted.

This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"

Maybe, but how long are the extension ids? And if they are random, how long to scan a trillion random alphanumeric ids, to find matches? I presume the extension knows when it wants to access resources of its own. But random javascript, doesn't.

[deleted]

Re: LinkedIn checks for 2953 browser extensions

#86

Post by cxr »

zahlman wrote: post #66
jsheard wrote: post #59

Earlier quoted context omitted.

Firefox already mitigates this by randomizing the extension path: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... The file is then available using a URL like: moz-extension:// /images/my-image.png" is not your extension's ID. This ID is randomly generated for every browser instance. This prevents websites from fingerprinting a browser by examining the extensions it has installed.

Doesn't the browser know which script it's running? Why can't it just deny access to the specified path, except to the extension itself?

It does by default, except for the files from the extension that the extension author has explicitly designated as content-accessible. It's explained ("Using web_accessible_resources") at the other end of the link.

Re: LinkedIn checks for 2953 browser extensions

#87

Post by lapcat »

cxr wrote: post #46
halapro wrote: post #17

Earlier quoted context omitted.

If this is true, it's insane that this would work: - why does CWS respond to cross-site requests? - why is chrome sending the credentials (or equivalent) in these requests? - why is the button enabled server-side and not via JS? Google must be confident in knowing the exact and latest state of your installed extensions enough to store it on their servers, I guess

It's not true. The person you're responding to has a habit of posting implausible-but-plausibly-plausible nonsense, and it's not how this works at all.

I made the mistake of trying to skim the code hastily before I had to leave to run an errand, and yes it turns out I was wrong, but please refrain from the personal comments, and no, I don't have any such "habit."

Re: LinkedIn checks for 2953 browser extensions

#88

Post by bastard_op »

Chrome is the new IE6. Google set themselves up to be the next Microsoft and is "ad friendly" in all the creepy ways because that's what Google IS an ad company. All they've contributed to security is diminishing the capability of adblockers and letting malware to do bad things to you as consumers.

Re: LinkedIn checks for 2953 browser extensions

#89

Post by hsbauauvhabzb »

xp84 wrote: post #20
hsbauauvhabzb wrote: post #16

Earlier quoted context omitted.

Wont someone think of poor little LinkedIn, a subsidiary of one of the largest data brokers in the world?

I mean, regardless of who they are or even if you don’t like what LinkedIn does themselves with the data people have given them, the random third parties with the extensions don’t additionally deserve to just grab all that data too, do they?

I say the same thing about my start menu sending every action I perform to bing.

Re: LinkedIn checks for 2953 browser extensions

#90

Post by 0xbadcafebee »

bastard_op wrote: post #88

Chrome is the new IE6. Google set themselves up to be the next Microsoft and is "ad friendly" in all the creepy ways because that's what Google IS an ad company. All they've contributed to security is diminishing the capability of adblockers and letting malware to do bad things to you as consumers.

He who controls the Ads, controls the Internet.
Post reply on HN