Since this is being posted fucking everywhere with the same sensational headline that makes it look like linkedin is jumping out of the browser to scan your actual filesystems, here's an exerpt from the site linked:
The Attack: How it works
Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. The entire process happens in the background. There is no consent dialog, no notification, no mention of it in LinkedIn’s privacy policy.
It's enumerating the browser extensions you have installed.
Still could be quite damaging to your privacy, especially since LinkedIn usually also knows your real name and your employer, so they can easily match this list of extensions up with a precisely identified person.
LinkedIn loads an invisible tracking element from HUMAN Security (formerly PerimeterX), an American-Israeli cybersecurity firm, zero pixels wide, hidden off-screen, that sets cookies on your browser without your knowledge. A separate fingerprinting script runs from LinkedIn’s own servers. A third script from Google executes silently on every page load. All of it encrypted. None of it disclosed.
I'd like to know how this functions because if MS is doing it than others are as well. Metadata in your browser is one thing but being able to see past that is unacceptable.
One Linux you could, I.E. for a flatpak you could use flatseal (or manually do it via command line) to lock down what folders the flatpak can operate in. I just did this for Brave Browser.
There is also the software Bubblewrap that accomplishes the same. These are at the application level for the entire browser though.
15 Comments
mlfh@lemmy.sdf.org · 23 pts · 152d
Since this is being posted fucking everywhere with the same sensational headline that makes it look like linkedin is jumping out of the browser to scan your actual filesystems, here's an exerpt from the site linked:
It's enumerating the browser extensions you have installed.
LodeMike@lemmy.today · 12 pts · 152d
Why does Chrome give websites this ability?
ActualGrapesTasteGreen@piefed.zip · 9 pts · 152d
This should be top comment in every post of this article. It doesn't make what they're doing ok, but it's less sensational.
Honestly I'm surprised any browsers let arbitrary websites list installed extensions.
OwOarchist@pawb.social · 5 pts · 152d
Still could be quite damaging to your privacy, especially since LinkedIn usually also knows your real name and your employer, so they can easily match this list of extensions up with a precisely identified person.
scytale@piefed.zip · 16 pts · 152d
Can’t uBO block this with custom filters?
floofloof@lemmy.ca · 8 pts · 152d
I don't know, but I just added a DNS override on my home network to resolve *.linkedin.com to 0.0.0.0.
workerONE@lemmy.world · 7 pts · 152d
Do browsers actually allow code execution which can provide a list of installed programs?
OwOarchist@pawb.social · 2 pts · 152d
Chromium-based ones do, apparently.
Another common W for Firefox.
Tim_Bisley@piefed.social · 7 pts · 152d
I'd like to know how this functions because if MS is doing it than others are as well. Metadata in your browser is one thing but being able to see past that is unacceptable.
Hawke@lemmy.world · 3 pts · 152d
No, I don’t think they are.
LammaLemma@lemmy.ca · 3 pts · 152d
So is there a way to restrict this for LinkedIn or any other site for that matter?
rando@sh.itjust.works · 4 pts · 152d
One Linux you could, I.E. for a flatpak you could use flatseal (or manually do it via command line) to lock down what folders the flatpak can operate in. I just did this for Brave Browser.
There is also the software Bubblewrap that accomplishes the same. These are at the application level for the entire browser though.
LodeMike@lemmy.today · 3 pts · 152d
LinkedIn breaks the law without consequence all the fucking time. See their un-unsubscribable emails.
earlstilt@feddit.uk · 3 pts · 152d
Not mine
Bluegrass_Addict@lemmy.ca · 2 pts · 152d
you mean microslop