7 ms·

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox

How is probing your browser for installed extensions not "scanning your computer"? Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario. > vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”) They chose to put that particular extension in their target list, how is it not sinister? If the list had only extensions to affect LinkedIn page directly (a good chunk seem to be LinkedIn productivity tools) they would have some plausible deniability, but that's not the case. You're just "nothing ever happens"ing this.

afandian 7mo ago
When "the browser is the OS", scanning that is a pretty big chunk of "your computer".
- chii 7mo ago
  but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough. If it has the ability to scan your bookmarks, or visited site history, that would lend more credence to using the term "computer". The title ought to have said "linkedIn illegally scans your browser", and that would make clear what is being done without being sensationalist.
  - blenderob 7mo ago
    > but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough. But the language of "your computer" also implies software on your computer including but not limited to Chrome extensions.
    - ImPostingOnHN 7mo ago
      It implies more than just the browser, which is likely why it was used for the post title. If it is exclusively limited to the browser, then "scans your browser" is more correct, and doesn't mislead the reader into thinking something is happening which isn't commonplace on the internet.
  - pqtyw 7mo ago
    Extensions are files installed on your computer, though?
    - chii 7mo ago
      it doesn't have to be files. it could be in memory on the browser. Extensions don't imply files for anyone but the most technical of conversations. Certainly not to the laymen. Having sensationalist titles should be called out at every opportunity.
      - blenderob 7mo ago
        > it doesn't have to be files. it could be in memory on the browser. How'd that work? If it's in memory, the extensions would vanish everytime I shutdown Chrome? I'll have to reinstall all my extensions again everytime I restart Chrome? Have you seen any browser that keeps extension in memory? Where they ask the user to reinstall their extensions everytime they start the browser?
        chii 7mo ago
        I'm just using it as a possible example. There's also tampermonkey which installs not via files but via urls from another site. The point is to call out the sensationalism in the title.
    - voganmother42 7mo ago
      Reminds me of https://xkcd.com/1200/ https://xkcd.com/1200/
      - Dylan16807 7mo ago
        But it's not getting access to real user data, just a partial list of things that are installed.
    - haswell 7mo ago
      So are fonts. But running Window.queryLocalFonts() is not equivalent to “illegally searching your computer”. I’m not defending the act of scanning for these extensions, and I’m of the opinion that such an API shouldn’t even exist, but just pointing out that there are perfectly legitimate APIs that reveal information that could be framed as “files installed on your computer” that are clearly not “searching your computer” like the title implies.
  - justonceokay 7mo ago
    Are you defending LinkedIn’s behavior right now or are you just happy to be more technically correct (the best kind of correct!) than those around you? Trying to understand the angle
    - ImPostingOnHN 7mo ago
      The browser fingerprinting described is ubiquitous on the internet, used by players large and small. There are even libraries to do this. Like OP, I don't consider behavior confined to the browser to be my computer. "Scans your browser" is both technically correct and less misleading. "Scans your computer" was chosen instead, to get more clicks.
    - compiler-guy 7mo ago
      Something may be bad, but accurately describing why it is bad significantly elevates the discourse. Eg, someone could use the phrase "Won't someone think of the children?" to describe a legitimately bad thing like bank fraud, but the solutions that flow from the problem that "children are in danger" are significantly different from the solutions that flow from "phishing attacks are rampant". The two issues in this case aren't quite as different as child-endangerment and bank fraud. But if the problem was as the original title describes, the solution is quite different (better sandboxing) than what the actual solution is. Which I don't know, but better sandboxing ain't it.
      - justonceokay 7mo ago
        So technically correct. Got it
        ImPostingOnHN 7mo ago
        attacking people for having more nuance and accuracy than you have is how polarization and tribal epistemology happens 'ignore the facts! ENEMY!!!' generally doesn't end well for anybody
        7mo ago
- taneq 7mo ago
  This is just the next iteration of the issues with Linux file permissions, where the original threat model was “the computer is used by many users who need protection from each other”, and which no longer makes much sense in a world of “the computer is used by one or more users who need protection from each other and also from the huge amounts of potentially malicious remote code they constantly execute”.
- latkin 7mo ago
  And I spend a lot of my time at home on my computer. The article should have said LinkedIn is searching my house.
- autoexec 7mo ago
  It looks like it's also gathering info on your OS and graphics card which seems very much "your computer"
injidup 7mo ago
In the same way that scanning and identifying your microwave for food you put inside it is not the same as scanning your house and reading the letters in your postbox. Your browser is a subset of your computer and lives inside a sandbox. Breaching that sandbox is certainly a much more interesting topic than breaking GDPR by browser fingerprinting.
j45 7mo ago
There are rules and laws about fingerprinting too, I thought.
- moffkalast 7mo ago
  Lol, lmao even. Lawmakers are banning privacy as fast as they can, this kind of personally identifiable stuff is perfectly aligned with their end goals. Checking for extensions is barely anything when you consider the amount of system data a browser exposes in various APIs, and you can identify someone just by checking what's supported by their hardware, their screen res, what quirks the rendering pipeline has, etc. It's borderline trivial and impossible to avoid if you want a working browser, and if you don't the likes of Anubis will block you from every site cause they'll think you're a VM running scraper bot.
haswell 7mo ago
> How is probing your browser for installed extensions not "scanning your computer"? I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate. But this is not happening. What actually is happening is still a problem. But the hyperbole undermines what they’re trying to communicate and this is why I objected to the title. > They chose to put that particular extension in their target list, how is it not sinister? Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible. If we step back for a moment and ask the question: “I’ve been tasked with building a unique fingerprint capability to combat (bots/scrapers/known bad actors, etc), how would I leverage installed extensions as part of that fingerprint?” What the article describes sounds like what many devs would land on given the browser APIs available. To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed. But the authors have chosen to frame this in language that is hyperbolic and alarmist, and in doing so I thing they’re making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.
- emacdona 7mo ago
  > I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. That is exactly how I interpreted it, and that is why I clicked the link. When I skimmed the article and realized that wasn't the case, I immediately thought "Ugh, clickbait" and came to the HN comments section. > To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed. 100% Agree. So, in summary: what they are doing is awful. Yes, they are collecting a ton of data about you. But, when you post with a headline that makes me think they are scouring my hard drive for data about me... and I realize that's not the case... your credibility suffers. Also, I think the article would be better served by pointing out that LinkedIn is BY FAR not the only company doing this...
1shooner 7mo ago
>Calling the title misleading because they didn't breach the browser sandbox is wrong By this logic we could also say that LinkedIn scans your home network.
- andersonpico 7mo ago
  Websites could scan your local network covertly up until a few years ago; now it requires explicit permission (like notifications, location, etc)
- fragmede 7mo ago
  XSS never a thing in your world?
m-schuetz 7mo ago
Scanning your computer is an entirely different thing than scanning browser extensions. By maximizing the expectation via "Illegally searching your computer", the truth suddenly appears harmless.
- islandfox100 7mo ago
  Where do browser extensions exist? I've got a dreadful feeling they might be on my computer.
  - fsckboy 7mo ago
    >Where do browser extensions exist? I've got a dreadful feeling they might be on my computer. all of the browser extensions I'm aware of are on planet earth, so i guess you'd have it linkedin is searching the planet for your browser extensions?
  - lelandfe 7mo ago
    Similarly, CSS font fallbacks are when websites break into your computer and steal your data, just because their font didn’t load!
amw-zero 7mo ago
It 100% implies that it's looking for locally installed binaries.
- hn_acc1 7mo ago
  And could possibly access private documents if it wanted to, etc.
leptons 7mo ago
>How is probing your browser for installed extensions not "scanning your computer"? The same way taking a photo of a house from the street is not the same as investigating the contents of your pantry.
TZubiri 7mo ago
Because "scanning your computer" technically could include scanning plugins, but it could also include scanning your files, your network or your operating system. While "scanning your browser" would be more accurate and would exclude the interpretation that it scans your files. The reason the latter is not used is that, even though more precise and more communicative, it would get less clicks.
BrianGragg 7mo ago
I personally think its misleading and even when you start reading the page it links to is even more misleading in my opinion. >Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm. When I read that, I think they have escaped the browser and checking which applications I have installed on my computer. Not which plugins the browser has in it. Just my 2cents.

afandian 7mo ago

When "the browser is the OS", scanning that is a pretty big chunk of "your computer".

chii 7mo ago
but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough. If it has the ability to scan your bookmarks, or visited site history, that would lend more credence to using the term "computer". The title ought to have said "linkedIn illegally scans your browser", and that would make clear what is being done without being sensationalist.
- blenderob 7mo ago
  > but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough. But the language of "your computer" also implies software on your computer including but not limited to Chrome extensions.
  - ImPostingOnHN 7mo ago
    It implies more than just the browser, which is likely why it was used for the post title. If it is exclusively limited to the browser, then "scans your browser" is more correct, and doesn't mislead the reader into thinking something is happening which isn't commonplace on the internet.
- pqtyw 7mo ago
  Extensions are files installed on your computer, though?
  - chii 7mo ago
    it doesn't have to be files. it could be in memory on the browser. Extensions don't imply files for anyone but the most technical of conversations. Certainly not to the laymen. Having sensationalist titles should be called out at every opportunity.
    - blenderob 7mo ago
      > it doesn't have to be files. it could be in memory on the browser. How'd that work? If it's in memory, the extensions would vanish everytime I shutdown Chrome? I'll have to reinstall all my extensions again everytime I restart Chrome? Have you seen any browser that keeps extension in memory? Where they ask the user to reinstall their extensions everytime they start the browser?
      - chii 7mo ago
        I'm just using it as a possible example. There's also tampermonkey which installs not via files but via urls from another site. The point is to call out the sensationalism in the title.
  - voganmother42 7mo ago
    Reminds me of https://xkcd.com/1200/ https://xkcd.com/1200/
    - Dylan16807 7mo ago
      But it's not getting access to real user data, just a partial list of things that are installed.
  - haswell 7mo ago
    So are fonts. But running Window.queryLocalFonts() is not equivalent to “illegally searching your computer”. I’m not defending the act of scanning for these extensions, and I’m of the opinion that such an API shouldn’t even exist, but just pointing out that there are perfectly legitimate APIs that reveal information that could be framed as “files installed on your computer” that are clearly not “searching your computer” like the title implies.
- justonceokay 7mo ago
  Are you defending LinkedIn’s behavior right now or are you just happy to be more technically correct (the best kind of correct!) than those around you? Trying to understand the angle
  - ImPostingOnHN 7mo ago
    The browser fingerprinting described is ubiquitous on the internet, used by players large and small. There are even libraries to do this. Like OP, I don't consider behavior confined to the browser to be my computer. "Scans your browser" is both technically correct and less misleading. "Scans your computer" was chosen instead, to get more clicks.
  - compiler-guy 7mo ago
    Something may be bad, but accurately describing why it is bad significantly elevates the discourse. Eg, someone could use the phrase "Won't someone think of the children?" to describe a legitimately bad thing like bank fraud, but the solutions that flow from the problem that "children are in danger" are significantly different from the solutions that flow from "phishing attacks are rampant". The two issues in this case aren't quite as different as child-endangerment and bank fraud. But if the problem was as the original title describes, the solution is quite different (better sandboxing) than what the actual solution is. Which I don't know, but better sandboxing ain't it.
    - justonceokay 7mo ago
      So technically correct. Got it
      - ImPostingOnHN 7mo ago
        attacking people for having more nuance and accuracy than you have is how polarization and tribal epistemology happens 'ignore the facts! ENEMY!!!' generally doesn't end well for anybody
        7mo ago
taneq 7mo ago
This is just the next iteration of the issues with Linux file permissions, where the original threat model was “the computer is used by many users who need protection from each other”, and which no longer makes much sense in a world of “the computer is used by one or more users who need protection from each other and also from the huge amounts of potentially malicious remote code they constantly execute”.
latkin 7mo ago
And I spend a lot of my time at home on my computer. The article should have said LinkedIn is searching my house.
autoexec 7mo ago
It looks like it's also gathering info on your OS and graphics card which seems very much "your computer"

injidup 7mo ago

In the same way that scanning and identifying your microwave for food you put inside it is not the same as scanning your house and reading the letters in your postbox. Your browser is a subset of your computer and lives inside a sandbox. Breaching that sandbox is certainly a much more interesting topic than breaking GDPR by browser fingerprinting.

j45 7mo ago

There are rules and laws about fingerprinting too, I thought.

moffkalast 7mo ago
Lol, lmao even. Lawmakers are banning privacy as fast as they can, this kind of personally identifiable stuff is perfectly aligned with their end goals. Checking for extensions is barely anything when you consider the amount of system data a browser exposes in various APIs, and you can identify someone just by checking what's supported by their hardware, their screen res, what quirks the rendering pipeline has, etc. It's borderline trivial and impossible to avoid if you want a working browser, and if you don't the likes of Anubis will block you from every site cause they'll think you're a VM running scraper bot.

haswell 7mo ago

> How is probing your browser for installed extensions not "scanning your computer"? I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate. But this is not happening. What actually is happening is still a problem. But the hyperbole undermines what they’re trying to communicate and this is why I objected to the title. > They chose to put that particular extension in their target list, how is it not sinister? Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible. If we step back for a moment and ask the question: “I’ve been tasked with building a unique fingerprint capability to combat (bots/scrapers/known bad actors, etc), how would I leverage installed extensions as part of that fingerprint?” What the article describes sounds like what many devs would land on given the browser APIs available. To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed. But the authors have chosen to frame this in language that is hyperbolic and alarmist, and in doing so I thing they’re making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.

emacdona 7mo ago
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. That is exactly how I interpreted it, and that is why I clicked the link. When I skimmed the article and realized that wasn't the case, I immediately thought "Ugh, clickbait" and came to the HN comments section. > To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed. 100% Agree. So, in summary: what they are doing is awful. Yes, they are collecting a ton of data about you. But, when you post with a headline that makes me think they are scouring my hard drive for data about me... and I realize that's not the case... your credibility suffers. Also, I think the article would be better served by pointing out that LinkedIn is BY FAR not the only company doing this...

1shooner 7mo ago

>Calling the title misleading because they didn't breach the browser sandbox is wrong By this logic we could also say that LinkedIn scans your home network.

andersonpico 7mo ago
Websites could scan your local network covertly up until a few years ago; now it requires explicit permission (like notifications, location, etc)
fragmede 7mo ago
XSS never a thing in your world?

m-schuetz 7mo ago

Scanning your computer is an entirely different thing than scanning browser extensions. By maximizing the expectation via "Illegally searching your computer", the truth suddenly appears harmless.

islandfox100 7mo ago
Where do browser extensions exist? I've got a dreadful feeling they might be on my computer.
- fsckboy 7mo ago
  >Where do browser extensions exist? I've got a dreadful feeling they might be on my computer. all of the browser extensions I'm aware of are on planet earth, so i guess you'd have it linkedin is searching the planet for your browser extensions?
- lelandfe 7mo ago
  Similarly, CSS font fallbacks are when websites break into your computer and steal your data, just because their font didn’t load!

amw-zero 7mo ago

It 100% implies that it's looking for locally installed binaries.

hn_acc1 7mo ago
And could possibly access private documents if it wanted to, etc.

leptons 7mo ago

>How is probing your browser for installed extensions not "scanning your computer"? The same way taking a photo of a house from the street is not the same as investigating the contents of your pantry.

TZubiri 7mo ago

Because "scanning your computer" technically could include scanning plugins, but it could also include scanning your files, your network or your operating system. While "scanning your browser" would be more accurate and would exclude the interpretation that it scans your files. The reason the latter is not used is that, even though more precise and more communicative, it would get less clicks.

BrianGragg 7mo ago

I personally think its misleading and even when you start reading the page it links to is even more misleading in my opinion. >Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm. When I read that, I think they have escaped the browser and checking which applications I have installed on my computer. Not which plugins the browser has in it. Just my 2cents.