4 ms·

The real question here is why LinkedIn should even need this information. This represents significant engineering work to develop, so obviously at some point th

The real question here is why LinkedIn should even need this information. This represents significant engineering work to develop, so obviously at some point they decided that knowing which extensions are present had value. However, I cannot think of a single non-malicious reason to want this information; the malicious reasons that spring to mind are browser fingerprinting and ad targeting.

nicolaslem 7y ago
The answer is mentioned hidden in the article: to detect accounts that scrape/resell the data found in LinkedIn profiles.
- jacquesm 7y ago
  Unfortunately for linkedin spying on all your users in order to catch a few miscreants is not how you implement stuff like this.
  - driverdan 7y ago
    Of course it is, it's SOP. CAPTCHAs, for example, are much more intrusive but are used everywhere to catch a minority of bad actors.
    - jacquesm 7y ago
      But CAPTCHAs do not fingerprint all your users, contrary to legislation in quite a few countries. Fingerprinting is illegal in the EU.
      - driverdan 7y ago
        ReCAPTCHA fingerprints users to determine a risk level.
codezero 7y ago
I can think of tons of non-malicious reasons. 1. Support requests because site is broken, but it turns out you are using an extension that breaks the site. 2. Extensions are exfiltrating data to the extension owners, against LinkedIn's TOS, and they are trying to protect their users, or rather, they don't want competition :) OK, that was two. They aren't blinding probing for any and all extensions, only a specific set, which shows restraint and implies to me they are having a sort of arms race with extensions that scrape contact info.
- jguffey 7y ago
  There are a lot of extensions built for networking professionals (recruiters, marketers, sales people) that automate browser behavior on LinkedIn in an attempt to drum up attention. For example: automatically viewing profiles of candidates, so that the candidate sees the recruiter/sales person on their "who's viewed my profile" page. A cursory google-search for something like "linkedin browser plugin" yields tons of these types of products.
- kibwen 7y ago
  > They aren't blinding probing for any and all extensions, only a specific set, which shows restraint and implies to me they are having a sort of arms race with extensions that scrape contact info. I agree that the goal here is likely to combat scraping, but I don't think we can use this behavior to draw that conclusion. From the article: "I recommend not using web accessible resources. Out of all extensions LinkedIn finds, a majority of them are due to web accessible resources." There's no trivial way to get a list of all the user's extensions, so they needed a side channel that they could use to detect them on a case-by-case basis. The only extensions that they can detect are ones that feature this side-channel. Even if Linkedin did want to know all your extensions (which, again, I think is less plausible than an arms race) we would see this same sort of behavior due to the limitations imposed by the browser.
- imglorp 7y ago
  Wait, so they try like crazy to scrape YOUR contact list but fight like crazy to keep THEIRs from getting scraped.
draw_down 7y ago
I agree, except I don't think we should be surprised that a business that exists for the purpose of data mining is mining whatever data they can. Maybe they can think of ways to "use" data about the relative popularity of browser extensions, whatever. Collect it first and figure out what to do with it later.
jressey 7y ago
I am in the "Sales Engagement" space, and most of the extensions I'm seeing are sales-based. Sales Navigator is LinkedIn's (less sophisticated) sales engagement tool. I understand they use a heuristic to determine which extensions to look for, so my set may be based on my industry. My take is that some motivation comes from LinkedIn seeing which Sales Engagement company they want to buy in order to replace Sales Navigator. Therefore by extension they are probably seeing what extensions people are using most commonly with LinkedIn in order to either beat or buy them.
NewsAware 7y ago
I would guess this is not just to protect user data from being scraped. LinkedIn earns a lot of money from users paying for recruitment services (as in get advanced filters to search for candidates and to send them job proposals). This costs 4 figures per month. So the LinkedIn product management has a high value from learning which extensions people are using to substitute or enhance their paid services even if the extensions don't violate the ToS.
- zrobotics 7y ago
  This seems like the most likely reasoning; some of these extensions probably do allow certain uses that LinkedIn charges for. Still shady behavior, but this is at least more reasonable than user fingerprinting.
bduerst 7y ago
Linkedin is used for lead generation, for more than just recruitment. OP touches on it when he hints at the email-hunter extension. Linkedin can skew results and obfuscate data to users who are heavily digging for lead data. Remember, Linkedin's main value proposition is that it has a wealth of user-submitted data, and if it loses that it loses some of it's value.

nicolaslem 7y ago

The answer is mentioned hidden in the article: to detect accounts that scrape/resell the data found in LinkedIn profiles.

jacquesm 7y ago
Unfortunately for linkedin spying on all your users in order to catch a few miscreants is not how you implement stuff like this.
- driverdan 7y ago
  Of course it is, it's SOP. CAPTCHAs, for example, are much more intrusive but are used everywhere to catch a minority of bad actors.
  - jacquesm 7y ago
    But CAPTCHAs do not fingerprint all your users, contrary to legislation in quite a few countries. Fingerprinting is illegal in the EU.
    - driverdan 7y ago
      ReCAPTCHA fingerprints users to determine a risk level.

codezero 7y ago

I can think of tons of non-malicious reasons. 1. Support requests because site is broken, but it turns out you are using an extension that breaks the site. 2. Extensions are exfiltrating data to the extension owners, against LinkedIn's TOS, and they are trying to protect their users, or rather, they don't want competition :) OK, that was two. They aren't blinding probing for any and all extensions, only a specific set, which shows restraint and implies to me they are having a sort of arms race with extensions that scrape contact info.

jguffey 7y ago
There are a lot of extensions built for networking professionals (recruiters, marketers, sales people) that automate browser behavior on LinkedIn in an attempt to drum up attention. For example: automatically viewing profiles of candidates, so that the candidate sees the recruiter/sales person on their "who's viewed my profile" page. A cursory google-search for something like "linkedin browser plugin" yields tons of these types of products.
kibwen 7y ago
> They aren't blinding probing for any and all extensions, only a specific set, which shows restraint and implies to me they are having a sort of arms race with extensions that scrape contact info. I agree that the goal here is likely to combat scraping, but I don't think we can use this behavior to draw that conclusion. From the article: "I recommend not using web accessible resources. Out of all extensions LinkedIn finds, a majority of them are due to web accessible resources." There's no trivial way to get a list of all the user's extensions, so they needed a side channel that they could use to detect them on a case-by-case basis. The only extensions that they can detect are ones that feature this side-channel. Even if Linkedin did want to know all your extensions (which, again, I think is less plausible than an arms race) we would see this same sort of behavior due to the limitations imposed by the browser.
imglorp 7y ago
Wait, so they try like crazy to scrape YOUR contact list but fight like crazy to keep THEIRs from getting scraped.

draw_down 7y ago

I agree, except I don't think we should be surprised that a business that exists for the purpose of data mining is mining whatever data they can. Maybe they can think of ways to "use" data about the relative popularity of browser extensions, whatever. Collect it first and figure out what to do with it later.

jressey 7y ago

I am in the "Sales Engagement" space, and most of the extensions I'm seeing are sales-based. Sales Navigator is LinkedIn's (less sophisticated) sales engagement tool. I understand they use a heuristic to determine which extensions to look for, so my set may be based on my industry. My take is that some motivation comes from LinkedIn seeing which Sales Engagement company they want to buy in order to replace Sales Navigator. Therefore by extension they are probably seeing what extensions people are using most commonly with LinkedIn in order to either beat or buy them.

NewsAware 7y ago

I would guess this is not just to protect user data from being scraped. LinkedIn earns a lot of money from users paying for recruitment services (as in get advanced filters to search for candidates and to send them job proposals). This costs 4 figures per month. So the LinkedIn product management has a high value from learning which extensions people are using to substitute or enhance their paid services even if the extensions don't violate the ToS.

zrobotics 7y ago
This seems like the most likely reasoning; some of these extensions probably do allow certain uses that LinkedIn charges for. Still shady behavior, but this is at least more reasonable than user fingerprinting.

bduerst 7y ago

Linkedin is used for lead generation, for more than just recruitment. OP touches on it when he hints at the email-hunter extension. Linkedin can skew results and obfuscate data to users who are heavily digging for lead data. Remember, Linkedin's main value proposition is that it has a wealth of user-submitted data, and if it loses that it loses some of it's value.