There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/
-
There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:
https://browsergate.eu/The website claims "LinkedIn is Illegally Searching Your Computer", and implies the purpose is to find "religious beliefs, political opinions, disabilities".
tl;dr:
- yes, LinkedIn is scanning through a list of 6k+ extensions on Chrome;
- yes, this is bad;
- but the website is disingenuous in making unnecessarily overblown claims.🧵
@Michał "rysiek" Woźniak ·
Interesting, that LinkedIn is even a thing still. I thought everyone with a mind got out of this by now.
-
There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:
https://browsergate.eu/The website claims "LinkedIn is Illegally Searching Your Computer", and implies the purpose is to find "religious beliefs, political opinions, disabilities".
tl;dr:
- yes, LinkedIn is scanning through a list of 6k+ extensions on Chrome;
- yes, this is bad;
- but the website is disingenuous in making unnecessarily overblown claims.🧵
LinkedIn loads a lot of JS. In that JS there is a list of over 6.000 extensions, identified by their ids and with a single file path provided.
The JS then checks if it is running in Chrome or a Chromium-based browser, and cycles through that list, checking if these extensions are installed by doing a fetch() to "chrome-extension://<extension_id>/<file_path>".
If the fetch() succeeds, the extension is installed. If not, it isn't.
🧵
-
LinkedIn loads a lot of JS. In that JS there is a list of over 6.000 extensions, identified by their ids and with a single file path provided.
The JS then checks if it is running in Chrome or a Chromium-based browser, and cycles through that list, checking if these extensions are installed by doing a fetch() to "chrome-extension://<extension_id>/<file_path>".
If the fetch() succeeds, the extension is installed. If not, it isn't.
🧵
@rysiek Why does LinkedIn do that?
-
@rysiek Why does LinkedIn do that?
@Luka Rubinjoni Well, of course in order to combine that info with your existing info (when logged in) and have more relevant data to sell to data brokers, of course. -
LinkedIn loads a lot of JS. In that JS there is a list of over 6.000 extensions, identified by their ids and with a single file path provided.
The JS then checks if it is running in Chrome or a Chromium-based browser, and cycles through that list, checking if these extensions are installed by doing a fetch() to "chrome-extension://<extension_id>/<file_path>".
If the fetch() succeeds, the extension is installed. If not, it isn't.
🧵
Is this bad? Yes. It could allow fingerprinting users, and a specific set of installed extensions (say, a lot related to particular religion) could be revealing, and arguably is illegal based on GDPR.
Is this "Searching Your Computer"? No, this is not what we generally think of when "searching your computer" is mentioned. This framing is way overblown and unnecessary.
BrowserGate site also implies LI's purpose might be to gather this kind of protected data. I don't think this is warranted.
🧵
-
Is this bad? Yes. It could allow fingerprinting users, and a specific set of installed extensions (say, a lot related to particular religion) could be revealing, and arguably is illegal based on GDPR.
Is this "Searching Your Computer"? No, this is not what we generally think of when "searching your computer" is mentioned. This framing is way overblown and unnecessary.
BrowserGate site also implies LI's purpose might be to gather this kind of protected data. I don't think this is warranted.
🧵
BrowserGate site quotes a "sworn affidavit from LinkedIn’s Senior Engineering Manager":
> “LinkedIn has invested in extension detection mechanisms without which LinkedIn would not have been able to trace the cause of service impacts and outages.”
I don't trust Big Tech, but this is not an unreasonable explanation – although importantly, it is not a *justification* for this scanning.
In other words: LI should not be doing that. But they might not be after your religion or orientation here.
🧵
-
Is this bad? Yes. It could allow fingerprinting users, and a specific set of installed extensions (say, a lot related to particular religion) could be revealing, and arguably is illegal based on GDPR.
Is this "Searching Your Computer"? No, this is not what we generally think of when "searching your computer" is mentioned. This framing is way overblown and unnecessary.
BrowserGate site also implies LI's purpose might be to gather this kind of protected data. I don't think this is warranted.
🧵
@Michał "rysiek" Woźniak · Can you explain "BrowserGate" to me. Sorry, not a professional here. Thank you!
-
BrowserGate site quotes a "sworn affidavit from LinkedIn’s Senior Engineering Manager":
> “LinkedIn has invested in extension detection mechanisms without which LinkedIn would not have been able to trace the cause of service impacts and outages.”
I don't trust Big Tech, but this is not an unreasonable explanation – although importantly, it is not a *justification* for this scanning.
In other words: LI should not be doing that. But they might not be after your religion or orientation here.
🧵
The explanation might be reasonable, because extensions do affect how websites work, sometimes negatively, and the list of extensions here seems to contain mostly extensions specifically interfacing with LinkedIn.
But here's my point: this kind of scanning is an overkill. And that alone is already bad enough and infuriating.
There is no need to make overblown, click-baity claims like BrowserGate site does. That just muddies the waters ("wait, how are they scanning my computer?!").
🧵
-
@Michał "rysiek" Woźniak · Can you explain "BrowserGate" to me. Sorry, not a professional here. Thank you!
@jrp literally the only link in this thread, literally in the first toot of the thread.
-
@jrp literally the only link in this thread, literally in the first toot of the thread.
-
The explanation might be reasonable, because extensions do affect how websites work, sometimes negatively, and the list of extensions here seems to contain mostly extensions specifically interfacing with LinkedIn.
But here's my point: this kind of scanning is an overkill. And that alone is already bad enough and infuriating.
There is no need to make overblown, click-baity claims like BrowserGate site does. That just muddies the waters ("wait, how are they scanning my computer?!").
🧵
@rysiek
> The explanation might be reasonable, because extensions do affect how websites work, sometimes negatively, and the list of extensions here seems to contain mostly extensions specifically interfacing with LinkedIn.I'm on the fence between calling BS because HTTP 4xx codes exist, and just shrugging saying “JavaScript”.
-
The explanation might be reasonable, because extensions do affect how websites work, sometimes negatively, and the list of extensions here seems to contain mostly extensions specifically interfacing with LinkedIn.
But here's my point: this kind of scanning is an overkill. And that alone is already bad enough and infuriating.
There is no need to make overblown, click-baity claims like BrowserGate site does. That just muddies the waters ("wait, how are they scanning my computer?!").
🧵
I was not aware of the technique the scanning employs, but apparently it's a known issue on Chrome and Chromium-based browsers, and has been for years:
https://browserleaks.com/chromeLinkedIn itself has been using it since 2017:
https://github.com/dandrews/nefarious-linkedinAnd I am sure it is used by a lot of shady sites to fingerprint users and actually figure out protected information about them. It can absolutely be used that way, and Google needs to plug this huge privacy hole.
🧵/end
-
There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:
https://browsergate.eu/The website claims "LinkedIn is Illegally Searching Your Computer", and implies the purpose is to find "religious beliefs, political opinions, disabilities".
tl;dr:
- yes, LinkedIn is scanning through a list of 6k+ extensions on Chrome;
- yes, this is bad;
- but the website is disingenuous in making unnecessarily overblown claims.🧵
@rysiek they think “browsergate” is going to stick for one site scanning extensions?
-
@rysiek
> The explanation might be reasonable, because extensions do affect how websites work, sometimes negatively, and the list of extensions here seems to contain mostly extensions specifically interfacing with LinkedIn.I'm on the fence between calling BS because HTTP 4xx codes exist, and just shrugging saying “JavaScript”.
@dzwiedziu the explanation is reasonable in the sense of "I cans ee how somebody thought this is a solution to this problem".
I said before this does not justify this level of scanning though.
-
@rysiek they think “browsergate” is going to stick for one site scanning extensions?
@Laukidh yeah, also had that thought
-
There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:
https://browsergate.eu/The website claims "LinkedIn is Illegally Searching Your Computer", and implies the purpose is to find "religious beliefs, political opinions, disabilities".
tl;dr:
- yes, LinkedIn is scanning through a list of 6k+ extensions on Chrome;
- yes, this is bad;
- but the website is disingenuous in making unnecessarily overblown claims.🧵
@rysiek Thanks for this analysis. I saw the BrowserGate thing earlier and it seemed bad but also way overblown, but I was not sure if I was missing something.
-
I was not aware of the technique the scanning employs, but apparently it's a known issue on Chrome and Chromium-based browsers, and has been for years:
https://browserleaks.com/chromeLinkedIn itself has been using it since 2017:
https://github.com/dandrews/nefarious-linkedinAnd I am sure it is used by a lot of shady sites to fingerprint users and actually figure out protected information about them. It can absolutely be used that way, and Google needs to plug this huge privacy hole.
🧵/end
Also go see what @vantiss has to say about it:
https://social.treehouse.systems/@vantiss/116336811478744261Credit where credit's due, I relied on her research on the earliest known instance of LinkedIn using this technique.
If you want to boost something, go boost her toot!
-
LinkedIn loads a lot of JS. In that JS there is a list of over 6.000 extensions, identified by their ids and with a single file path provided.
The JS then checks if it is running in Chrome or a Chromium-based browser, and cycles through that list, checking if these extensions are installed by doing a fetch() to "chrome-extension://<extension_id>/<file_path>".
If the fetch() succeeds, the extension is installed. If not, it isn't.
🧵
@rysiek@mstdn.social wtf why does Chrome allows an untrusted website to do that??? -
LinkedIn loads a lot of JS. In that JS there is a list of over 6.000 extensions, identified by their ids and with a single file path provided.
The JS then checks if it is running in Chrome or a Chromium-based browser, and cycles through that list, checking if these extensions are installed by doing a fetch() to "chrome-extension://<extension_id>/<file_path>".
If the fetch() succeeds, the extension is installed. If not, it isn't.
🧵
@rysiek why ffs is this even possible?
