175
LinkedIn Hidden Code Secretly Searches Your Browser for Installed Extensions (cybersecuritynews.com)
submitted 7 months ago by to c/cybersecurity@sh.itjust.works
16 comments fedilink hide all child comments

all 16 comments

sorted by: hot top controversial new old
[–] 17 points 7 months ago

Good thing I haven't visited the site since before the Microslop acquisition then.

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 7 months ago

    Linkedln being a walled garden just makes this funnier to me.

  • permalink
  • fedilink
  • source
    •
    [–] 4 points 7 months ago

    I deleted my linkedin account (as much as they would allow, anyway). I visited about twice a year, usually on accident.

    Good riddance.

  • permalink
  • fedilink
  • source
    •
    [–] 7 points 7 months ago (7 children)

    All very "secret" and "hidden" in cleartext javascript. These titles need to chill.

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 9 points 7 months ago (6 children)

    Ah yes, who doesn't read through the minified bundles of every page they open. I fucking love reading through megabytes of uglified code!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 0 points 7 months ago (5 children)

    And your point is what exactly? Nobody does, but it still is not a secret. My point is that any assumption that your extensions are not detected is a delusion, if one wants to put in the effort it is not overly complicated to understand what minified js is doing and one can expect any major social media to do such things.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 5 points 7 months ago (4 children)

    It is absolutely a secret! Based on the discussions I've seen, many people in the field were quite surprised that this technique works. So just like Meta's recent-ish WebRTC scandal, this was a secret, even if the code always showed what it does.

    My point is that any assumption that your extensions are not detected is a delusion

    It is? How are these websites detecting my Firefox extensions?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 7 months ago (3 children)

    By doing things the extensions are interacting with. You can see if an ad is served and displayed or not, you can detect if an iteraction was originated by an user or automatic, you can see if letters were pasted or input at a speed no human can match.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 7 months ago (2 children)

    You can see if an ad is served and displayed or not

    This doesn't tell you which specific extensions a user has installed. First, the filter lists are mostly shared between ad blockers, so you can at best tell that some adblock extension is installed, but not which one. Second, the ad might fail to load for a variety of other reasons (e.g. user is offline, firewall blocking URLs/endpoints, network-level DNS adblock, ...), so all you can tell is that the user might have an adblock extension installed. That's far milder than your initial premise: "My point is that any assumption that your extensions are not detected is a delusion[...]"

    you can detect if an iteraction was originated by an user or automatic

    Sure, and how does this help with detecting the installed extensions? Knowing that the click event wasn't triggered by the user doesn't tell you who triggered it.

    you can see if letters were pasted or input at a speed no human can match

    Again, how does this help with detecting the installed extensions?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 6 months ago (1 child)

    I mean, I was listing stuff one person can do on their site to detect if visitors have a type of extension or not. If I can do that with a couple hours of work I am not surprised at all whith what a major social network like linkedin can implement. I don't know what linkedin does and I don't plan to read their code, I did not even read the article tbh

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 6 months ago*

    Well, that's a pretty useless approach for tech discussions, because this kind of attack is explicitly not possible on Firefox.

    Also, extrapolating such a broad statement from the simple fact that it's possible to unreliably detect the presence of a single broad category of extensions is a huge reach.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 2 points 7 months ago

    and they sell data to apollo io

  • permalink
  • fedilink
  • source
    •
    [–] 6 points 7 months ago (3 children)

    Isn't it standard for a website to be able to detect browser/extensions?

    Funny that the name dropping of Chrome in the link summary implies Firefox users are safe.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •