The headline seems pretty misleading. Here’s what seems to actually be going on:
> Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers.
This does seem invasive. It also seems like what I’d expect to find in modern browser fingerprinting code. I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).
I’m certainly not endorsing it, do think it’s pretty problematic, and I’m glad it’s getting some visibility. But I do take some issue with the alarmist framing of what’s going on.
I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.
How is probing your browser for installed extensions not "scanning your computer"?
Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario.
> vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”)
They chose to put that particular extension in their target list, how is it not sinister? If the list had only extensions to affect LinkedIn page directly (a good chunk seem to be LinkedIn productivity tools) they would have some plausible deniability, but that's not the case. You're just "nothing ever happens"ing this.
> How is probing your browser for installed extensions not "scanning your computer"?
I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate.
But this is not happening. What actually is happening is still a problem. But the hyperbole undermines what they’re trying to communicate and this is why I objected to the title.
> They chose to put that particular extension in their target list, how is it not sinister?
Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible.
If we step back for a moment and ask the question: “I’ve been tasked with building a unique fingerprint capability to combat (bots/scrapers/known bad actors, etc), how would I leverage installed extensions as part of that fingerprint?”
What the article describes sounds like what many devs would land on given the browser APIs available.
To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed.
But the authors have chosen to frame this in language that is hyperbolic and alarmist, and in doing so I thing they’re making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.
> What the article describes sounds like what many devs would land on given the browser APIs available.
> To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed.
These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects. What the article describes should not be "what many devs would land on" naturally. What many devs should land on is "scanning the user's browser in order to try to fingerprint him without consent is wrong and we cannot do it."
To put it more extreme: If a developer's boss said "We need to build software for a drone that will autonomously fly around and kill infants," The developer's natural reaction should not be: "OK, interesting problem. First we'll need a source of map data, and vision algorithm that identifies infants...." Yet, our industry is full of this "OK, interesting technology!" attitude.
Unfortunately, for every developer who is willing to draw the line on ethical grounds, there's another developer waiting in the recruiting pipeline more than willing to throw away "doing the right thing" if it lands him a six figure salary.
Fighting against these kinds of directives was a large factor in my own major burnout and ultimately quitting big tech. I was successful for awhile, but it takes a serious toll if you’re an IC constantly fighting against directors and VPs just concerned about solving some perceived business problem regardless of the technical barriers.
Part of the problem is that these projects often address a legitimate issue that has no “good” solution, and that makes pushing back/saying no very difficult if you don’t have enough standing within the company or aren’t willing to put your career on the line.
I’d be willing to bet good money that this LinkedIn thing was framed as an anti-bot/anti-abuse initiative. And those are real issues.
But too many people fail to consider the broader implications of the requested technical implementation.
Oh yeah. Must be an anti-fraud/child abuse/money laudering/terrorism/fake news thing. All real problems with no known good solution (to my knowledge, please prove me wrong).
> These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects.
One reason your boss is eager to replace everyone with language models, they won’t have any “ethical backbone” :’)
Many developers overestimate their agency without extremely high labor demand. We got a say because replacing us was painful, not because of our ethics and wisdom. Without that leverage, developers are cogs just like every other part of the machine.
You can't actually push back as an IC. Tech companies aren't structured that way. There's no employment protection of any kind, at least in the US. So the most you can do is protest and resign, or protest and be fired. Either way, it'll cost you your job. I've paid that price and it's steep. There's no viable "grassroots" solution to the problem, it needs to come from regulation. Managers need to serve time in prison, and companies need to be served meaningfully damaging fines. That's the only way anything will get done.
I'm hoping the Ladybird project's new Web browser (alpha release expected in August) will solve some issues resulting from big tech controlling most browers.
> There's no viable "grassroots" solution to the problem, it needs to come from regulation. Managers need to serve time in prison,
No, yes
Yes, giving these people short (or long, mēh) prison sentences is the only thing that will stop this.
No, the obvious grassroots response is to not use LinkedIn or Chrome. (You mean developers not consumers, I think. The developers in the trenches should obey if they need their jobs, they are not to blame. It is the evil swine getting the big money and writing the big cheque's...)
Yes, what I meant was there's no way ICs will change any of this. Using this or that extension, or choosing not to use some service won't really change anything either. The popular appetite just isn't there. Personally I use a variety of adblockers and haven't had a linkedin or anything for many years, but I fully accept that's an extremist position and most consumers will not behave that way. The only way these companies' behavior will improve is when they are meaningfully, painfully punished for it. There's very little we as consumers or ICs can do until then. Unless of course their risk management fails and they alienate a sufficiently large number of users that it becomes "uncool" to use the product. But all we need to do is look to twitter to see just how bad it'll get before then...
I integrate these kinds of systems in order to prevent criminals from being able to use our ecommerce platform to utilize stolen credit cards.
That involves integrating with tracking providers to best recognize whether a purchase is being made by a bot or not, whether it matches "Normal" signals for that kind of order, and importantly, whether the credit card is being used by the normal tracking identity that uses it.
Even the GDPR gives us enormous leeway to do literally this, but it requires participating in tracking networks that have what amounts to a total knowledge of purchases and browsing you do on the internet. That's the only way they work at all. And they work very well.
Is it Ethical?
It is a huge portion of the reason why ecommerce is possible, and significantly reduces credit card fraud, and in our specific case, drastically limits the ability of a criminal to profit off of stolen credit cards.
Are people better off from my work? If you do not visit our platforms, you are not tracked by us specifically, but the providers we work with are tracking you all over the web, and definitely not just on ecommerce.
No, credit card companies should be made to develop robust solutions to protect themselves from cards being able to be stolen. It's not like secure authentication isn't a relatively solved problem. They've obviously managed to foist the problem on you and make you come up with shitty solutions. But that's bad.
What I'm wondering is if this requires sending the full list of extensions straight to a server (as opposed to a more privacy-protecting approach like generating some type of hash clientside)?
Based on their privacy policy, it looks like Sift (major anti-fraud vendor) collects only "number of plugins" and "plugins hash". No one can accuse them of collecting the plugins for some dual-use purpose beyond fingerprinting, but LinkedIn has opened themselves up to this based on the specific implementation details described.
The SOP of this entire industry is "Include this javascript link in your tag manager of choice", and it will run whatever javascript it can to collect whatever they want to collect. You then integrate in the back end to investigate the signals they sell you. America has no GDPR or similar law, so your "privacy" never enters the picture. They do not even think about it.
This includes things like the motion of your mouse pointer, typing events including dwell times, fingerprints. If our providers are scanning the list of extensions you have installed, they aren't sharing that with us. That seems overkill IMO for what they are selling, but their business is spyware so...
On the backend, we generally get the results and some signals. We do not get the massive pack of data they have collected on you. That is the tracking company's prime asset. They sell you conclusions using that data, though most sell you vague signals and you get to make your own conclusions.
Frankly, most of these providers work extremely well.
Sometimes, one of our tracking vendors gets default blackholed by Firefox's anti-tracking policy. I don't know how they manage to "Fix" that but sometimes they do.
Again, to make that clear, I don't care what you think Firefox's incentives are, they objectively are doing things that reduce how tracked you are, and making it harder for these companies to operate and sell their services. Use Firefox.
In terms of "Is there a way to do this while preserving privacy?", it requires very strict regulation about who is allowed to collect what. Lots of data should be collected and forwarded to the payment network, who would have sole legal right to collect and use such data, and would be strictly regulated in how they can use such data, and the way payment networks handle fraud might change. That's the only way to maintain strong credit card fraud prevention in ecommerce, privacy, status quo of use for customers, and generally easy to use ecommerce. It would have the added benefit of essentially banning Google's tracking. It would ban "Fraud prevention as a service" though, except as sold by payment networks.
Mandating that tracking for anti-fraud be vertically integrated with the payment network seems unnecessary. Surely the law could instead mandate the acceptable uses of such data? The issue at present appears to be the lack of regulation, not scofflaws.
I'm not convinced tracking is the only or even a very good way to go about this though. Mandating chip use would largely solve the issue as it currently stands (at least AFAIK). The card provider doing 2FA on their end prior to payment approval seems like it works just as well in practice.
At this point my expectation is that I have to do 2FA when first adding a new card to a platform. I'm not clear why they should need to track me at that point.
> Even the GDPR gives us enormous leeway to do literally this, but it requires participating in tracking networks that have what amounts to a total knowledge of purchases and browsing you do on the internet. That's the only way they work at all.
That data sounds like it would be very valuable.
But I think if I sell widgets and a prospective customer browsers my site, telling my competitors (via a data broker) that customer is in the market for widgets is not a smart move.
How do such tracking networks get the cooperation of retailers, when it’s against the retailers interests to have their customers tracked?
I suspect a lot of retailers simply aren’t aware that that data is being collected and sold off to their competitors (or to ad networks so their competitors can poach their audience)
> These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects. What the article describes should not be "what many devs would land on" naturally. What many devs should land on is "scanning the user's browser in order to try to fingerprint him without consent is wrong and we cannot do it."
I think using LinkedIn is pretty much agreeing to participate in “fingerprinting” (essentially identifying yourself) to that system. There might be a blurry line somewhere around “I was just visiting a page hosted on LinkedIn.com and was not myself browsing anyone else’s personal information”, but otherwise LinkedIn exists as a social network/credit bureau-type system. I’m not sure how we navigate this need to have our privacy while simultaneously needing to establish our priors to others, which requires sharing information about ourselves. The ethics here is not black and white.
If you voluntarily visit my website and my web server sends a response to your IP address, have I “taken” your IP address, or did you give it to me “voluntarily”? What if I log your IP address?
One works for money. And money is important. Ethics isn’t going pay mortgage, send kids to university and all that other stuff. I’m not going to do things that are obviously illegal. But if I get a requirement that needs to be met and then the company legal team is responsible for the outcome.
In short, you are not going to solve this problem blaming developer ethics. You need regulation. To get the right regulation we need to get rid of PACs and lobbying.
Regulation does not necessarily need to be about deciding what's right and what's wrong. It's about making life better for people. That's supposed to be why we have government. If they are not improving people's lives, why do we even have them? Too many people see the government doing nothing to improve their lives and think there's totally nothing wrong with that.
I fail to see how some of the octogenarians in DC, who are making a kiling for decades in trading on market moves that they initiate/regulate themselves, are making life better for your family, or mine.
Because at least half the country thinks that government can't/shouldn't help them, and reliably votes for people who can't/won't make their lives better. We get the government we vote for, and too many people think the government's job is to grief people.
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself.
Yes, but I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox. The fact that there's no getAllExtensions API is deliberate. The fact that you can work around this with scanning for extension IDs is not something most people know about, and the Chrome developers patched it when it became common. So I don't think describing it as something everybody would expect is totally fine and normal for browsers to allow is correct.
> I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox
I think that’s a far more reasonable framing of the issue.
> I don't think describing it as something everybody would expect is totally fine and normal for browsers to allow is correct.
I agree that most people would not expect their extensions to be visible. I agree that browsers shouldn’t allow this. I, and most privacy/security focused people I know have been sounding the alarm about Chrome itself as unsafe if you care about privacy for awhile now.
This is still a drastically different thing than what the title implies.
> Yes, but I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox.
I don't think so, because most people understand that extensions necessarily work inside of the sandbox. Accessing your filesystem is a meaningful escape. Accessing extensions means they have identification mechanisms unfortunately exposed inside the sandbox. No escape needed.
It's extremely unfortunate that the sandbox exposes this in some way.
Microsoft should be sued, but browsers should also figure out how to mitigate revealing installed extensions.
Y'all are letting "most people" carry an awful lot of water for this scummy behavior here.
In my experience, most people - even most tech people - are unaware of just how much information a bit of script on a website can snag without triggering so much as a mild warning in the browser UI. And tend toward shock and horror on those occasions where they encounter evidence of reality.
The widespread "Facebook is listening to me" belief is my favorite proxy for this ... Because, it sorta is - just... Not in the way folks think. Don't need ears if you see everything!
> The widespread "Facebook is listening to me" belief is my favorite proxy for this ... Because, it sorta is - just... Not in the way folks think. Don't need ears if you see everything!
Getting folks to install “like” and “share” widgets all over their websites was a genius move.
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself.
That is exactly how I interpreted it, and that is why I clicked the link. When I skimmed the article and realized that wasn't the case, I immediately thought "Ugh, clickbait" and came to the HN comments section.
> To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed.
100% Agree.
So, in summary: what they are doing is awful. Yes, they are collecting a ton of data about you. But, when you post with a headline that makes me think they are scouring my hard drive for data about me... and I realize that's not the case... your credibility suffers.
Also, I think the article would be better served by pointing out that LinkedIn is BY FAR not the only company doing this...
That sounds problematic and is only supported by people mindlessly agreeing to it. I know someone who got jobs at google and apple with no linkedin, and he wasn't particularly young. What do you do in the face of it? I say quit entirely. It was an easy decision because I got nothing out of it during the entire time I was on it.
After getting laid off at age 52 (2nd time, 1st time day after my 50th birthday, took an inter-company transfer), and searching for a year, applying to maybe 5-10 companies a week, I got my current job (2 years+) through a random LinkedIn button.
> Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible.
To take a step back further: what you're saying here is that gathering more data makes it less sinister. The gathering not being targeted is not an excuse for gathering the data in the first place.
It's likely that the 'naive developer tasked with fingerprinting' scenario is close to the reality of how this happened. But that doesn't change the fact that sensitive data -- associated with real identities -- is now in the hands of MS and a slew of other companies, likely illegally.
> But the authors have chosen to frame this in language that is hyperbolic and alarmist, and in doing so I thing they’re making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.
The article is not hyperbolizing by exploring the ramifications of this; and it's true that this sort of tracking is going on everywhere, but neither is it alarmist to draw attention to a particularly egregious case. What wrong things does it focus on?
> The gathering not being targeted is not an excuse for gathering the data in the first place.
I’m not saying it is. My point is that they appear to be trying to accomplish something like getInstalledExcentions(), which is meaningfully different from a small and targeted list like isInstalled([“Indeed.com”, “DailyBibleVerse”, “ADHD Helper”]).
One could be reasonably interpreted as targeting specific kinds of users. What they’re actually doing to your point looks more like a naive implementation of a fingerprinting strategy that uses installed extensions as one set of indicators.
Both are problematic. I’m not arguing in favor of invasive fingerprinting. But what one might infer about the intent of one vs. the other is quite different, and I think that matters.
Here are two paragraphs that illustrate my point:
> “Microsoft reduces malicious traffic to their websites by employing an anti-bot/anti-abuse system that builds a browser fingerprint consisting of <n> categories of identifiers, including Browser/OS version, installed fonts, screen resolution, installed extensions, etc. and using that fingerprint to ban known offenders. While this approach is effective, it raises major privacy concerns due to the amount of information collected during the fingerprinting process and the risk that this data could be misused to profile users”.
vs.
> “Microsoft secretly scans every user’s computer software to determine if they’re a Christian or Muslim, have learning disabilities, are looking for jobs, are working for a competitor, etc.”
The second paragraph is what the article is effectively communicating, when in reality the first paragraph is almost certainly closer to the truth.
The implications inherent to the first paragraph are still critical and a discussion should be had about them. Collecting that much data is still a major privacy issue and makes it possible for bad things to happen.
But I would maintain that it is hyperbole and alarmism to present the information in the form of the second paragraph. And by calling this alarmism I’m not saying there isn’t a valid alarm to raise. But it’s important not to pull the fire alarm when there’s a tornado inbound.
> But what one might infer about the intent of one vs. the other is quite different, and I think that matters.
That's where we disagree: intent doesn't matter here, because the intent of the person gathering the data is not the same as those who have access to the data. I don't care if the team tasked with implementing this believed they were saving the world, because once this data is in the hands of a big corporation, in perpetuity, and the thousands of people that entails, and it diffuses across advertisers and governments, be it through leaks, backroom deals, or perfectly above-board operations, it makes no difference how it got there.
The two paragraphs given:
> “Microsoft reduces malicious traffic to their websites by employing an anti-bot/anti-abuse system that builds a browser fingerprint consisting of <n> categories of identifiers, including Browser/OS version, installed fonts, screen resolution, installed extensions, etc. and using that fingerprint to ban known offenders. While this approach is effective, it raises major privacy concerns due to the amount of information collected during the fingerprinting process and the risk that this data could be misused to profile users”.
vs.
> “Microsoft secretly scans every user’s computer software to determine if they’re a Christian or Muslim, have learning disabilities, are looking for jobs, are working for a competitor, etc.”
The latter is the tangible effect of the former. The two aren't mutually exclusive, and considering the former has long gone unaddressed in its most charitable form, it only makes sense to use a particularly egregious example of it taken to its natural conclusion to address in courts and the public consciousness.
It is equally “searching your home network” as it is “searching your computer”. This is not searching your computer. It is searching your browser. Being contained to the browser is completely different than having access to the OS behind the browser.
The issue here is that even if the original goal is the first thing, once you have the data you can do that second thing. From where we stand, nothing changes - same information is collected. But now, it's also used for affinity targeting or worse.
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself.
Which they would, if they could.
They are scanning users' computers to the maximum extent possible.
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate.
But at the end of the day, the browser is likely where your most sensitive data is.
> Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible.
If that's all it takes to fool you then its pretty trivial way to hide your true intentions.
> making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.
No, LinkedIN has much more sensitive data already. Combined with which the voracious fingerprinting, this stands out as a particularly dystopian instance of surveillance capitalism
but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough.
If it has the ability to scan your bookmarks, or visited site history, that would lend more credence to using the term "computer".
The title ought to have said "linkedIn illegally scans your browser", and that would make clear what is being done without being sensationalist.
So are fonts. But running Window.queryLocalFonts() is not equivalent to “illegally searching your computer”.
I’m not defending the act of scanning for these extensions, and I’m of the opinion that such an API shouldn’t even exist, but just pointing out that there are perfectly legitimate APIs that reveal information that could be framed as “files installed on your computer” that are clearly not “searching your computer” like the title implies.
it doesn't have to be files. it could be in memory on the browser. Extensions don't imply files for anyone but the most technical of conversations. Certainly not to the laymen.
Having sensationalist titles should be called out at every opportunity.
> it doesn't have to be files. it could be in memory on the browser.
How'd that work? If it's in memory, the extensions would vanish everytime I shutdown Chrome? I'll have to reinstall all my extensions again everytime I restart Chrome?
Have you seen any browser that keeps extension in memory? Where they ask the user to reinstall their extensions everytime they start the browser?
> but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough.
But the language of "your computer" also implies software on your computer including but not limited to Chrome extensions.
It implies more than just the browser, which is likely why it was used for the post title. If it is exclusively limited to the browser, then "scans your browser" is more correct, and doesn't mislead the reader into thinking something is happening which isn't commonplace on the internet.
Are you defending LinkedIn’s behavior right now or are you just happy to be more technically correct (the best kind of correct!) than those around you? Trying to understand the angle
The browser fingerprinting described is ubiquitous on the internet, used by players large and small. There are even libraries to do this.
Like OP, I don't consider behavior confined to the browser to be my computer. "Scans your browser" is both technically correct and less misleading. "Scans your computer" was chosen instead, to get more clicks.
Something may be bad, but accurately describing why it is bad significantly elevates the discourse.
Eg, someone could use the phrase "Won't someone think of the children?" to describe a legitimately bad thing like bank fraud, but the solutions that flow from the problem that "children are in danger" are significantly different from the solutions that flow from "phishing attacks are rampant".
The two issues in this case aren't quite as different as child-endangerment and bank fraud. But if the problem was as the original title describes, the solution is quite different (better sandboxing) than what the actual solution is. Which I don't know, but better sandboxing ain't it.
This is just the next iteration of the issues with Linux file permissions, where the original threat model was “the computer is used by many users who need protection from each other”, and which no longer makes much sense in a world of “the computer is used by one or more users who need protection from each other and also from the huge amounts of potentially malicious remote code they constantly execute”.
Scanning your computer is an entirely different thing than scanning browser extensions. By maximizing the expectation via "Illegally searching your computer", the truth suddenly appears harmless.
I personally think its misleading and even when you start reading the page it links to is even more misleading in my opinion.
>Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm.
When I read that, I think they have escaped the browser and checking which applications I have installed on my computer. Not which plugins the browser has in it. Just my 2cents.
Because "scanning your computer" technically could include scanning plugins, but it could also include scanning your files, your network or your operating system.
While "scanning your browser" would be more accurate and would exclude the interpretation that it scans your files.
The reason the latter is not used is that, even though more precise and more communicative, it would get less clicks.
Lol, lmao even. Lawmakers are banning privacy as fast as they can, this kind of personally identifiable stuff is perfectly aligned with their end goals.
Checking for extensions is barely anything when you consider the amount of system data a browser exposes in various APIs, and you can identify someone just by checking what's supported by their hardware, their screen res, what quirks the rendering pipeline has, etc. It's borderline trivial and impossible to avoid if you want a working browser, and if you don't the likes of Anubis will block you from every site cause they'll think you're a VM running scraper bot.
In the same way that scanning and identifying your microwave for food you put inside it is not the same as scanning your house and reading the letters in your postbox.
Your browser is a subset of your computer and lives inside a sandbox. Breaching that sandbox is certainly a much more interesting topic than breaking GDPR by browser fingerprinting.
> I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.
Expecting and accepting this kind of thing is why everyone feels the need to run an ad-blocker.
An ad-blocker also isn’t full protection. It’s a cat and mouse game. Novel ideas on how to extract information about you, and influence behavior, will never be handled by ad-blockers until it becomes known. And even then, it’s a question of if it’s worth the dev time for the maker of the ad-blocker you happen to be using and if that filter list gets enabled… and how much of the web enabling it breaks.
The point was more that the headline frames this as some major revelation about LinkedIn, while the reality is that we’re getting probed and profiled by far more sites than most people realize.
Studies show most people who don’t think they’re impacted by advertisements are wrong. Advertisements don’t just drive you to buy something, they can also be used to create brand recognition, positive feeling associations and force the brand to front of mind.
You don’t notice ads when they pop up in front of content? When they lead to nearly full page breaks between paragraphs in an article? When they contain auto-play videos? When the video resizes itself and moves to stay in the viewport as the user scrolls? When so many ads load that the page crashes? When you do a Google search and there is only a single organic result without scrolling?
They introduced ads like a frog into tepid water. The water is now boiling and many still think everything is fine, because at this point it’s all they know.
It’s not a fear, it’s annoyance and a resentment. I’m annoyed that the ads make web pages so much worse. I resent that everything being “free” with ads has made it next to impossible for other business models to take hold and that new companies need burden themselves with investors, because the expectation is that things online should be free. I’m annoyed that a profile of who I am has been built and sold without my consent and without giving me a cut of the profit. I resent the companies that do this and have no respect for them or their leadership. It’s most certainly not fear of advertisements.
The fear is what will happen to that data, or what may already be happening, if it is controlled by some deceitful individuals or groups.
The fear doesn’t come from the ads, it comes from the invasive data collection that increases the profit of the ads. It’s compounded by the extremely frequent hacks and data leaks that have made it very clear that most of these companies cannot keep the data they collect secure. As such, they have no business collecting and storing it in the first place.
A billboard is an advertisement, so is a magazine ad. The world would be a more aesthetically pleasing place without them, sure, but I don’t go out of my way to avoid them like with the online ads. Billboards and magazines aren’t monitoring me and using hyper-targeted ads. A knitting magazine is going to show ads for knitting stuff. A billboard in Orlando is going to point a driver toward Disney. That’s just fine. Those ads meet people where they are, they don’t follow them around.
I don’t like shopping at Target due to what I’ve read about their data collection and how it’s used. I don’t fear big box stores, I just don’t want to be part of their data set. A store should be a store that profits from the margins of the products they sell. Now, the retail arm is just the front of their advertising or credit card arm of the business, where all the real money is. I don’t want to play that game. I’m a simple man, I want things to be what they are and that’s it.
Excuse the rant.
When I look up diaphimisticophobia, it seems specific about the commercial and their content being the fear. I think most people on HN have an issue with the data collection and use, not the content of the ads themselves.
It's pretty wild that we live in a world where the actual FBI has recommended we use ad blockers to protect ourselves, and if everyone actually listened, much of the Internet (and economy) as we know it would disappear. The FBI is like "you should protect yourself from the way that the third largest company in the world does business", and the average person's response is "nah, that would take at least a couple of minutes of my time, I'll just go ahead and continue to suffer with invasive ads and make sure $GOOG keeps going up".
>the average person's response is "nah, that would take at least a couple of minutes of my time,
As a data point I, a technical person who tweaks his computer a lot, was against adblocking for moral reasons (as a part of perceived social contract, where internet is free because of ads). Only later I changed mi mind on this because I became more privacy aware.
Figure this: You could plaster a page with the most obtrusive ads imaginable without ever showing a cookie banner, when they collect no private info.
Most people, including folks on here, think cookie banners are a problem, but they are just an annoying attempt to phish your agreement. As long as these privacy loopholes exist, we will keep hearing such stories even from large corporations with much to loose, which means the current privacy regulations do not go far enough.
Beyond just invasive/annoying, ad networks explicitly spread malware and scams/fraud. There's not much incentive for them to clamp down on it, though, as that would cost them money both in lost revenue and in paying for more thorough review.
It'd not even be hard for them to stop it, but they just had to be annoying instead.
When I first started out on the internet, ads were banners. Literally just images and a link that you could click on to go see some product. That was just fine.
However, that wasn't good enough for advertisers. They needed animations, they needed sounds, they needed popups, they needed some way to stop the user from just skimming past and ignoring the ad. They wanted an assurance that the user was staring at their ad for a minimum amount of time.
And, to get all those awful annoying capabilities, they needed the ability to run code in the browser. And that is what has opened the floodgate of malware in advertisement.
Take away the ability for ads to be bundled with some executable and they become fine again. Turn them back into just images, even gifs, and all the sudden I'd be much more amenable to leaving my ad blocker off.
> The social contract was "your ads aren't annoying or invasive
Even back in the 1990s the internet was awash with popups, popunders and animated punch-the-monkey banner ads. And with the speed of dial up, hefty images slows down page loads too.
You must be a true Internet veteran if you remember a time ads weren’t annoying!
I remember a time before ads. I remember the first time I got "spam" email - email not directly addressed to me that ended up in my inbox. I was very confused for some time about why this email was sent to me.
I remember how I felt the first time I saw an ad come across my browser, it seems so long ago - I guess it was more than a quarter century ago now. I knew it was going to be downhill from there, and it has been.
Well by 2000 the guy at Tripod had already developed pop-up ads. I honestly don't remember ads before the pop-ups, but it must have already been maturing.
I strongly believe in paying journalists but I started blocking ads after nytimes.com served me a Windows malware download from a Doubleclick domain. It couldn’t have harmed my Mac but it was clear that the adtech industry had no interest in cleaning shop if it cost them a dime in revenue.
You mean the internet you pay to access and which was around before the ads were even on it? That internet?
I'm not trying to be mean I'm just trying to historically parse your sentence/belief.
Because for me this is a simplified analogy of what happened on the internet:
a) we opened a club house called the internet in the early 1990s, just after the time of BBSs
b) a few years later a new guy called commercial business turned up and started using our club house and fucking around with our stuff
c) commercial business started going around our club house rearranging the furniture and putting graffiti everywhere saying the internet is here and free because of it. We're pretty sure it might have even pissed in the hallway rather than use the toilet and the whole place is smelling awful.
d) the rest of us started breaking out the scrubbing brushes and mops (ad blockers, extensions, VPNs, etc) trying to clean up after it
e) some of its friends turned up and started repeating something about social contracts and how business and ads built this internet place
f) the rest of us keep crying into our hands just trying to meet up, break out the slop buckets to clean up the vomit in the kitchen and some of us now have to wear gloves and condoms just to share things with our friends and stop the whole place collapsing
Ya, back when 'we' were fucking around on BBS's there was the equivalent of 10 people online at the time.
Quantity is a quality in itself. Your BBS was never going to support a million users. Once people figured out the network effect it was over for the masses. They went where the people are, and we've all suffered since.
Honestly, I still prefer webboards, the closest thing to a BBS, for specific topics like specific car brands/models. WAY better signal-to-noise ratio. Alas, for my car model, all the recent stuff has moved to Fbook. FML.
> a) we opened a club house called the internet in the early 1990s, just after the time of BBSs
"we" is doing a lot of work here. No clubhouse got optical switching working and all that fiber in the ground for example. Beyond POC, the Internet was all commercial interests.
"we" paid ISP's ... which in turn, paid for infrastructure. Some of "we" pay cable providers for internet service, which in turn paid for (in my case) fiber-to-the-curb. Advertising basically supported social media, search engines, etc.
> it was first and foremost a military enterprise, just like GPS
This is sort of like arguing cutlery is a military enterprise. Like yes, that’s where knives came from. But that’s disconnected enough from modern design, governance and other fundamental concerns as to be irrelevant. The internet—and less ambiguously, the World Wide Web—are more commercial than military.
This is moving the goalposts. The commenter above is talking about the enthusiast-populated internet of the late 80s/early 90s, at which point it still wasn't even clear if it was legal to use the internet for commercial purposes. If all you mean to say is that the internet is currently commercialized, yes, that is obviously true, in much the same way that a disgusting ball of decomposing fungus may have once been an apple.
> commenter above is talking about the enthusiast-populated internet of the late 80s/early 90s, at which point it still wasn't even clear if it was legal to use the internet for commercial purposes
Source? Not doubting. But I have a friend who was buying airline tickets through CompuServe in the late 80s/early 90s.
Compuserve was NOT the internet. Compuserve / Prodigy / GEnie were early versions of Facebook. They also inter-operated (email) for some period of time. IIRC.
This is ignoring things like newspapers that were made obsolete by the internet. At some point someone does need to actually pay for the content we see online. That is if we want that content to actually be good.
not sure why you're talking about "commercial business" being the one inserting ads everywhere when even niche community run forums from the 2000s also had ads to help pay for their server costs. At the end of the day all this costs money. Whether its paid by ads or direct subscriptions. IMO the problem is more about concentration and centralization of the internet into a handful of sites than advertising.
I have expensive online subscriptions to New York Times, Wall Street Journal, and Washington Post. Nevertheless they are FILLED with ads/popups/videos that run automatically/dark patterns. Just saying: there's no refuge.
True, but that doesn’t invalidate what I said about the vast majority of sites that aren’t globally known, prestigious news companies that people are willing to pay an expensive subscription for.
Most publishers of content online are ad supported and struggling, and I want to make sure I’m contributing to their revenue somehow.
I don’t feel bad about blocking ads on sites I pay for though.
The average person — that would be me — thinks "nah, I have no idea how to install an ad blocker or how one works, and I'm afraid I'll screw up my computer."
The crazier part is that its an official government position, and we (people at large / the government) aren't immediately slapping down the actions of these companies.
Don't worry, soon you'll need to pay every website 5.99 a month because AI is destroying click through rates. The internet will likely be far worse without ads than with ads. Solving the tracking problem doesn't need to be mixed up with blocking ads outright. What's funny is that tracking isn't nearly as meaningful for click through rates on ads as relevance to what's on the page, and yet so much effort is placed onto tracking for the slim improvement it provides.
It would not be 5.99 to access a website because that's not what it costs and that's not what ads yield.
I think people think ads give way, way more money than they actually do. If you're visiting a website with mostly static ads then you're generating fractions of a cent in revenue for that website. Even on YouTube, you're generating mere cents of revenue across all your watch time for the month.
Why does YouTube premium cost, like, 19 dollars a month then? I don't know, your guess is as good as mine.
Point is, you wouldn't be paying 5.99. You could probably pay a dollar or two across ALL the websites you visit and you'd actually be giving them more money than you do today.
But there's no method or structure in place to pay a website a fraction of a cent. Ads are the only way we've found that actually implements a form of microtransactions... paying a tenth of a penny for a sliver of attention.
I don't want to defend ads, but whatever replaces them is going to be very disruptive. Maybe better, but very different.
In 2023 I did a deep dive into the crypto community with two main questions:
- do these people understand the principles of making good products?
- is anyone clearly working towards a microtransaction system that could replace advertising and subscription models?
After attending two conferences, hundreds of conversations and hours spent researching, my conclusion to both questions was no. The community felt more like an ouroboros. It was disappointing.
I don't want to pay NYT a subscription fee, I want to pay them some fraction of a cent per paragraph of article that I load in. Same goes for seconds of video on YouTube, etc.
Apparently I'm alone in this vision, or at least very rare...
I have also done similar research because I wanted to build something to handle microtransactions on a personal website that could scale if adopted to be usable by everyone if they wanted.
I looked at crypto currency because it seems like the obvious naive solution. it doesnt work. the cost of the transaction itself far outweighs the value of the transaction when dealing with fractions of a cent. you want an entire network to be updating ledgers with ~millions of records per ~$1000 moved. the fundamental tech of crypto leans towards slower, higher value transactions than high volume, small transactions. Lots of efforts have been made with some coins to bring down the bar of "high value, low volume" to meet everyday consumer usage rates and values - but a transaction history at the scale of every ad impression for every person is a tough ask and would perpetually be in an uphill battle against energy costs.
Ultimately, the conclusion I came to is that the service would need to be centralized, and likely treated as cash by not keeping track of history. Centralized company creates "web credits", user spends $5 for 10,000 credits, these credits are consumed when they visit websites. Websites collect a few credits from each user, and cash out with the centralized company. The issue is that since it would cost more to track and store all the transactions than the value of the transactions themselves, you have to fully trust the company to properly manage the balances.
I started building it and since I would be handling, exchanging, and storing real currency - it seemed subject to a lot of regulations. It is like a combination bank and casino.
i've thought about finishing the project and using disclaimers that buying credits legally owes the user nothing, and collecting credits legally owes the websites nothing, and operating on a trust system - but any smart person would see the potential for a rug pull on that and i figured there would not be much interest.
The alternative route of adhering to all the banking regulations to get the proper insurances needed to make the commitments necessary to users and websites to guarantee exchange between credits and $ seemed like too much for 1 person to take on as a side project for free
It would need to be mostly centralized, but keeping track of history would not be hard.
A typical credit is getting paid in, transacted once, and cashed out. And a transaction with a user ID, destination ID, and timestamp only needs 16 bytes to store. So if you want to track every hundredth of a penny individually, then processing a million dollars generates 0.16 terabytes of data. You want to keep that around for five years? Okay, that's around $100 in cost. If you're taking a 1% fee then the storage cost is 1% of your fee.
If your credits are worth 1/20th of a penny, and you store history for 18 months, then that drops the amount of data 17x.
(And any criticisms of these numbers based on database overhead get countered by the fact that you would not store a 10 credit transaction as 10 separate database entries.)
fair enough on tracking history in the centralized model. I had suspicions there would be hidden costs that might make it too expensive. i dont think the data storage would be as much of a problem as the cost to write it to storage.
I wasn't fully envisioning credits only being transacted once before cashout either. I was thinking more along the lines of being able to create something that goes viral, a lot of people use it and you rack up a bunch of credits, and then you can sit on those credits and spend them as you use the internet without ever having to connect to a bank yourself. So people who are contributing more than they are consuming would rack up credits. they could use those credits to enrich their contributions, maybe pay for cloud services, etc.
the credits could form its own mini web economy if it got popular enough. As cool as this would all be if done honestly, I know that if i saw a company telling me to buy web credits to use anywhere on the internet and the websites get to decide how much to charge and they charge it automatically when i visit the website, and if the company i buy the credits from goes out of business then i may not be able to cash out or get my money back, then I likely wouldnt be buying those credits... so idk
Even with user to user credits it would take a lot for the number of transactions to go above 2. That would mean more than half the money is going to viral payouts.
And was this assuming you'd only take a cut on the cash going in and out? Because even a 0.1% cut of the transactions would mean you have $1000 to handle the amount of data I described in the last comment.
>And was this assuming you'd only take a cut on the cash going in and out
I think fee needs to be per transaction, maybe not cash flowed per transaction but accrued per transaction.
Say we both self-host a website for our favorite daily game, and I use yours about as much as you use mine. We would transfer roughly the same amount of credits back and forth to each other ad-infinitum. but the credit service provider is accumulating only expenses with each transaction.
Say someone make a lot of bot accounts to simulate user traffic, and it sends each of them credits to use to visit their own site. the host collects the credits from the bots and transfers them back to the bots to keep them running.
you are not alone, people seriously proposed one thing after another in the early 2000s.. same time frame as RSS, roughly. Somehow, these proposals were undermined and slow-walked? merger and acquisition in Silicon Valley was aligned with very different things
>"Ads are the only way we've found that actually implements a form of microtransactions... paying a tenth of a penny for a sliver of attention."
Ads were the path of least resistance, and once entrenched, they effectively prevented any alternative from emerging. Now that we've seen how advertising scales, and how it's ruined our mediascape, we're finally looking at alternatives. Not dissimilar to how we reacted to pollution, once we saw it at scale.
And has roughly 2.7 billion monthly active users. This means the average YouTube user brings in around $1.23 per month. When you consider that CPM's can easily swing by 20X based on how wealthy the user demographic is, and willingness to pay a subscription is a strong signal for purchasing power, I would not be at all subscribed if a YouTube premium subscription was revenue-neutral for Google.
This may be a hot take but I'd be willing to pay my ISP $10 extra that they would distribute to sites I visit, if it meant zero tracking and ads. I use an ad blocker but I genuinely want to support content creators in a way that doesn't optimize for ads or clicks.
There would need to be a way for ISPs to know which websites are getting my traffic in order to know who to distribute the money to, which I'm not a fan of. But I think something along those lines, with anonymized traffic data, would work a treat.
Well what makes you think the VPN providers are not tracking?
You would have to either self-host your own VPN server somewhere (maybe on a public cloud provider) or if you are truly paranoid, use something like Tor.
They have been subject to warrant requests, and had nothing to turn over. There are only a few vpn providers that I genuinely trust. (Mullvad, airvpn, etc)
Really though, I am not worried about 3 letter agencies performing legitimate law enforcement duties. I am worried about corporations hovering up more data about me than I'd want to reveal, and either using that as a basis to charge me more, or worse, they get hacked, and that data is used by bad actors to target me.
Yeah that's the problem (and possibly why such a thing didn't exist).
But I kinda see it like TV. Cable providers know what channels and shows people are watching. Obviously web browsing data is more personal and intimate so it's not the same thing, but it's a good starting point for a thought experiment.
> This may be a hot take but I'd be willing to pay my ISP $10 extra that they would distribute to sites I visit, if it meant zero tracking and ads. I use an ad blocker but I genuinely want to support content creators in a way that doesn't optimize for ads or clicks.
The problem is that both the ISP and the websites would then go "Cool, we're getting $10 a month from them!" for about a minute before they started trying to come up with ways to start showing you ads anyways. With the level of customer appreciation ISPs tend to show, I'm sure they'd have no problem ignoring your complaints and would happily revoke your service if you stopped paying the now $10-higher price per month.
people with something to share, people with something to say, who share and say it because they want to
that's how pamphleteers worked, that's how the Internet worked
at scale, static (CMS-managed) information sites cost effectively nothing even for arbitrary amounts of traffic, and smoothed across a range of people sharing stuff, it approaches zero per person
publishing used to be free with your ISP, and edge CDN used to be (and still is) free to a point (an incredibly high volume point) as well
having people pay something nominal to say things instead of pay far too much in attention-distraction or money to consume things, would put this all back the right way round
I couldn’t disagree with this more if I tried. The biggest benefit of the internet is to make it easier to talk to each other and share ideas. Putting financial gates in front of that ability is hot garbage.
Also, I agree that the platforms and paradigms we have are fucked up, but do believe that people who put work into making something deserve to charge for it if there are folks who’d pay.
The ISP shouldn't necessarily be involved in this process, but some form of syndication does need to happen, and it seems crazy that it hasn't.
The closest we've come is something like Apple News, which allows me to pay for a selected (by them, not me) subset of features on a selected (by them, not me) subset of news sites. Can't somebody do this right?
internet will likely be far worse without ads than with ads
Not sure on that. It was far, far better before what drives ads today. I've gotten more value from random people's static HTML pages in 1999, than I ever have from something in the last 25 years.
This just led me to think of news sites, and how they've turned mostly into click-bait farms in the last decade to 15.
Gives me pause. Didn't the king of "doing it online" buy a newspaper, but the end result wasn't an improvement on its fate? If there is any way to make cash from news, shouldn't Bezos have been able to do it??
I would love to get something more akin to a monthly print issue of BYTE, Omni, Starlog, Reality Hackers, WIRED and Dr Dobbs Journal without blinky, shouty ads that cause the content to re-render every 10 seconds.
E-ink is getting cheaper and cheaper, there's a lot of 6" screen devices for $100. If it dropped to $100 for a 11" screen, that would be a respectable size for a magazine. I cite eink as most are distraction free, or can be, and are very easy on the eyes.
Such content would also suck with flashy ads too.
It's pretty easy tech I think, it's just never hit a flash point. But it could.
We literally had all of this. We had regular, affordable, high quality printed media for every hobby and interest and industry, that you could get delivered to your home address and collect in your own archive if you want, and your local library could do the same.
Those pieces of paper could not track anything about you. They tried, selling their subscriber lists, but that was the best tracking they could provide! You could easily ignore ads, and in return they had to make ads interesting enough in various ways that you might look at them anyway, or they had to make their ads directed at people who went looking for whatever you were selling.
It was an objectively better system in every way.
The Sears catalog was worlds better than Amazon. You weren't going to buy a fraudulent item for one.
Tech is a failure. It has made so much worse. It has only served to allow businesses to cut costs while extracting money from every single local community that used to allow such cash to circulate locally.
I might recomment a middle ground before banning all internet advertising.
What if we limited advertising to images which don't set tracking cookies, so you would get something sort of like banner headlines. Maybe say the image had to be served from the same place as the rest of the content so you don't get to track readers with image trackers
It turns out that "makes the most money for a small amount of people" is pretty much the same as "makes everything shitty for everyone else". It's time that we either stop accepting "most profitable" as an excuse for making things worse or start regulating/punishing bad behavior until it becomes so costly that it's no longer profitable.
Hardly. I'm the guy upthread, lamenting the current state of things.
But with e-ink, you can be detached. Knowing someone buys a newspaper is hardly a surprising thing. To put it in perspective, a large number of people subscribed to the paper, and it was delivered daily. The same was true of magazines subscriptions. As long as the media is offline (eg, PDF, epub, similar), and the reader OSS, then the tracking and ads aren't an issue still.
--
I don't disagree with how poor things are, but one issue is government moves slowly. Laws being passed today, are the result of trends 20 years ago. For example, in my legal jurisdiction, vendors (eg, Best Buy, big box stores) are responsible for the thing they sell. It's not just "ship it back to manufacturer", for obvious reasons.
Eventually the issues with e-trade will be dealt with, just as issues with shoddy sellers were deal with a century ago. Here's an example...
Back in the 50s people would send items through the mail, then demand people pay for them, or pay for return shipping. I'm not kidding. Even when it wasn't easily defensible in civil court, all the legal threats would scare some into paying.
So laws were passed. If you receive something in the mail you didn't order? It's yours. Period.
But this took a decade to happen, if not more.
This is the sort of thing which will happen in this new market.
And yes, Amazon sucks as it is now.
It's really quite fascinating to me how a lot of new markets aren't about novel, but instead about not having terrible behaviour regulated. For example, Amazon has the worst customer service in all existence. It used to be good, but they now take immense pains to hide all support channels, and where I live, it's a maze of incomprehensible clicks to even attempt to get a chat.
So... I have to call now. Every time. And now they have the same wall of "noise" on the phone, so it's harder to get through there. In the past, I've done chargebacks when I can never reach a company, and that will be the inevitable conclusion here too.
Which shows how incredibly stupid Amazon is, when this household buys $4k of stuff a month from them, and just has edge-case returns sometimes. I'm sure they'll cancel my account first time, and, well, who cares.
When companies get to this level of "screw the consumer", they're at the edge of all ability to improve profits. There's no where left to go. I expect Amazon to have issues due to things like this, and the squeeze on foreign imports, and crash and burn on its side.
But back to your point? Yes, we should. Or, we should just pass laws which make centralized advertising, that is, the collection of Pii impossible.
Ban all Pii? Ban all transactions of Pii? And you end advertising as it is.
> If there is any way to make cash from news, shouldn't Bezos have been able to do it??
News only made money when the newspapers could leverage their circulation numbers to run their own ads network. The classifieds section was a money machine. I remember full-page ads in the Washington Post from local car dealerships showing every model they were selling. They likely ran different ads for distribution in other regions, probably 10Xing their money. Google and Facebook killed that.
What Bezos bought was a corpse of a business, but one with strong journalistic credibility known for historic investigative analyses such as the Watergate cover-up that earned public goodwill. He was buying that goodwill and slowly asphyxiating it to align with his own interests.
This sounds possibly better. Aligns the interest of the website more with the users.
Ads are a weird game. People say you're ripping off the website if you adblock, but aren't you ripping off the advertiser if you don't buy the product? If I leave YouTube music playing on a muted PC, someone is losing.
That'd be ideal because it would mean I could browse the internet without ads and just never use AI chatbots. Unfortunately I think ads are only going to spread and what we'll actually end up with is "more ads everywhere".
I would rather pay people and websites for content. I already do this today for journalism orgs and a handful of high value substacks, I'm happy to pay for more. I'd pay for HN. Free does not scale (with the caveat being orgs like Wikipedia, the Internet Archive, and others who have an endowment behind them and can self fund alongside donations; this, of course, is a model others can adopt), people need to eat, pay for rent, etc, and ads are ineffective when everyone can block them.
Ads are a symptom of the problem that people want human generated content for free; they either do not value the content enough to pay for it, or cannot afford it. Ads do not solve for those problems.
No disagreement there, except the early web was not about scale. The sites you visited may have been created by someone as a hobby, a university professor outlining their courses or research, a government funded organization opening up their resources to the public, a non-profit organization providing information to the public or other professionals, or companies providing information and support for their products (in the way they rarely do today).
> people need to eat, pay for rent
Those people were either creating small sites in their spare time, or were paid to work on larger sites by their employer.
There were undoubtedly gaps in the non-commercial web. On the other hand, I'm not sure that commercializing the web filled those gaps. If anything, it is so "loud" that the web of today feels smaller and less diverse than the web of the 1990's.
I agree there are hobbyists, for lack of a better term, who will always share for free "for the love of the game", passion, whatever you want to call it. Nothing stops them from doing this passion or charity work today, the evidence of that is clear from the content we see daily pass through /new here. That was never really ad driven, nor would it be in the future, and numerous mechanisms remain for them to share this content for free with the world. But that is a small minority of today's Internet and consumption of data, information, and content (imho).
How does HN exist? Wealthy benefactors. Do I appreciate it any less? I do not, I am very grateful. But solutions are needed where a wealthy benefactor has not stepped in or does not exist, a commercial business model is untenable, the government does not or will not fund it, and the scale is beyond a single person spending a few hours a week on it for free.
I run into occasional articles, often linked from here, for say economist or ft.com or new york times
I'm not signing up for a subscription for that journal, but paying a small amount for access to that one article is a no brainer. I don't subscribe to a newspaper either, but I'll happily buy one.
The New European did this a decade ago using "agate" (named after the smallest font you'd get in a newspaper), top up with a few quid, then pay for each article.
Sadly didn't catch on. TNE dropped it in 2019[0]. Agate still exists, having been renamed to "axate", but consumers aren't willing to pay with anything other than their time.
While this works for some cohort of consumer, it doesn't work for organizations that need consistent cashflows to pay for consistent expenses, and so, those willing to subscribe on a recurring basis carry the economic burden of sustaining such operations.
Newspapers continue to run ads even after the paywalls went up everywhere a decade or so ago. Once "premium" offerings like HBO, which were ad-free on cable TV, now has ads on its paid streaming version. Even with the "premium" subscription tier, there's sponsored/co-branded content. And for some reason, it now has live sports, where they have no control over the ads shown.
The problem was less the scale of supply and more the scale of demand.
In the 19th century, economist William Stanley Jevons found that, as coal became more readily and easily available, demand for it went up. This was counter to the theories of others, and the principle became known as Jevons Paradox.
Jevons Paradox (a concept that is widely misunderstood, especially when it comes to tech and finance bros talking about AI) demonstrates that, a resource becomes more abundant and easily accessible, demand for that resource rises. As the web took off, people hungered more and more for digital content -- especially as internet accessibility became faster and cheaper.
To keep up -- and to pay for being able to keep up -- increasingly sophisticated monetization models were introduced.
In any case, ad models are one thing. But it's the data brokering that's even more insidious.
The irony is that if internet content were harder to access, the population on the whole wouldn't want it as much.
Now, the culmination of Jevons Paradox has spun itself around a bit in this case. We now live in a world where those profiting off of ad models and data brokering actively try to get people to demand internet content more. (Look no further than the recent social-media-addiction lawsuits.)
>> Sadly you are atypical and the vast majority are freeloaders
> Citation needed.
I think we need to agree upon a definition of freeloader before citing sources to support the claim. I've found that many people who use the word have a much more transactional view of the world than I do.
> I would rather pay people and websites for content.
I do not think that this is a workable model. Firstly, because it leads inevitably to monopolization, because you don't want to pay 50,000 people for content, you want to pay 10 people for content. Secondly, because most content is bad and a waste of time and you don't find out until after you've bought it. Thirdly, and most importantly, is that there's no actual, clear separation between "news" and "advertising."
Content is generated because people who want that content generated sponsor it beforehand, and dictate the conditions under which the delivery of that content will be accepted as a fulfillment of that sponsorship. The people sponsoring that content can have any number of reasons for doing it; it can make them money directly (i.e. I have articles about cats, people who like cats subscribe to my cat website), which if you're a linear thinker you think is the only way, or it can make them money indirectly, maybe by leading consumers to particular products or political stances that they have a stake in.
This is simply the truth. Your preferences don't matter, and it's not a moral question. If you pay for content, you're more valuable to advertise to, not less. A lot of work is put into producing trash that you regret having read or watched, and was really intended to make you support Uganda's intervention in a Zambian election (or whatever.) If you "value" reading it, you've failed an intelligence test. Its value is elsewhere for the people to paid for it to be written.
What's recently shown itself to scale is small groups of people sponsoring journalists and outlets who put out tons of content for free. The motivation of those sponsors is usually to spread the points of view of the journalists they sponsor widely, because they believe them to be good.
There was never a pay model that supported things that people didn't feel passionate about or entertained by. Newspapers cost less than the paper they were written on. Television news was always a huge money loser that was invested in to raise the social status and respectability of the network. If you feel passionately about anything, you're far better off paying people to listen, to give you a chance, than to lock away content. Journalism as a luxury good can work, but only for Bloomberg terminals and Stratfor, when it is used to make other lucrative decisions by its buyers.
> orgs like Wikipedia, the Internet Archive, and others who have an endowment behind them
This is simply sponsorships by governments and billionaires. Never ever been any significant shortage of that (the patron saint of this is King Alfonso X.*) All of those people have wide interests that can often be served by paying for media to be produced or distributed. It's where we got our first public libraries from.
For me, the fact that Substack and Patreon almost work is more important, and is something that wouldn't have been as easy without the benefits that the internet brings for the collaboration of distant strangers.
Yes, but the Awful registration fee is more like a speedbump to make banned behavior at least a little expensive to the offending users. Most of the revenue comes from completely optional aesthetic purchases: avatars, avatars _for others_, smilies, etc. I suspect it's a whale based economy.
True, I think it was more sort of a natural filter than explicitly revenue for the website.
Still, I would be willing to pay a bit more for a website that I actually like if it's a one-time fee; I actually paid for the "Platinum" membership for Something Awful so that I would have access to search, and a custom icon, so I think the total damage was around $30.
Dunno, I guess I just feel like people will pay for things if those things don't suck. I think the fact that the only way that companies can really compete for people's time is giving it away for free [1] is a testament that most stuff on the internet is actually kind of shit.
[1] yeah I know something something you are the product something something.
Also look up K shaped economies at the same time and you get a better answer.
But the gist of it is, companies do free to play systems that support themselves by a very small portion of their user base spending a very large amount of money. The free/low paying users find themselves with poor/no service as the companies do anything to attract more whales.
K based economies are somewhat related as you see a very small portion of the participants in an economy make a huge amount of money while everyone else gets poor.
Whales are the tiny percentage of users who spend large amounts of actual money on bullshit non-products offered by mobile apps and online platforms. AKA suckers.
> The internet will likely be far worse without ads than with ads
This is highly debateable. I wouldn't mind paying a bit for the websites I am using as there are just a few platforms and some blogs that I would be happy to pay a small amount for.
> soon you'll need to pay every website 5.99 a month
No, I won't. I'll just stop using them. So will almost everyone. I don't think there's a single ad-supported product that would survive by converting to a paid subscription, because they're all so profoundly unnecessary.
I'm happy to see that day. I'm already paying for stuff I need in life. There's no reasons to insist on not paying for the stuff I need in the web. Just kill those spywares stealing my personal actions and information.
I honestly don’t think “with ads” describes what we are experiencing. We are being all but violently fracked for data (and we don’t know what all they’re taking) for them to sell to 3rd parties we don’t know who then use decades of research and tooling + your personal data to psychologically manipulate you into not just buying things, but also into feeling and acting certain ways (socially, politically, etc).
This isn’t Nielsen ratings informing cable networks where to throw up which commercials in certain regions. This is far more dangerous and intense. So the conversation needs to be framed differently than the implied bar of “intrusive/annoying/incessant ads.”
But those websites would have to provide 5.99 a month of value, and many don't.
We used to have "static" banners on sites, that would just loop through a predefined list on every refresh, same for every user, and it worked. Not for millions of revenue, but enough to pay for that phpbb hosting.
The advertisers started with intrusive tracking, and the sites started with putting 50 ads around a maybe paragraph of usable text. They started with the enshittification, and now they have to deal with the consequences.
Nary a month goes by that I don't bemoan the loss of BYTE and Dr Dobbs Journal. WIRED is still hanging on, but it's more of a site where tech warehouses in Shenzhen hawk there latest wares.
There was a time when Boing Boing was a decent little print magazine. And the web site went a decade before turning into... whatever the heck it is now.
And Reality Hackers and Mondo 2000 were "guaranteed unreadable," but they were on the bleeding edge of desktop publishing style and technology.
I'm old enough to remember typing BASIC games from COMPUTE! into my C64 and reading about the latest Star Trek film in Starlog.
I sing the praises of Omni, even though it was clear they were probably snorting a lot of cocaine in their offices.
I can't be the only one who remembers Computer Shopper, but I have to admit it was years before I realized they had a bit of content and were more than just an ad sheet for Micro Center.
PC World wasn't my jam, but I respected the role it played. UnixWorld and Info World were more my thing.
And I even read the stories and articles in Playboy in the 70s. Believe it or not, they had some amazing authors publish stories there.
I think the damage is there even if you don't see the ads. News outlets and organizations that used to be magazine publishers focus on lowest common denominator stories they know will get the highest engagement. That usually means sexy anger-bait.
Sure we had that in the print times, but we had a lot more "slow" content that you could sit with and contemplate over a day, week or month.
Even those of us who don't see ads see the structure that the ad-driven internet economy creates. Listicles, clickbait and AI-generated slop web pages, just trying to get more ad impressions. Sure, with an ad blocker I can see the low-quality content without an ad, but without the ad economy hopefully there'd be less incentive to create low-quality content to begin with.
Majority of people use their mobile devices these days to browse the Internet. Installing an ad blocker on your iPhone is a significantly bigger challenge than on desktop.
Use Firefox/Fennec which allow you to install a variety of the add-ons you can install on the desktop version such as UBO, Stylus, ViolentMonkey, Bitwarden, SponsorBlock, etc... or install Brave which comes with adblock by default. As for iPhone, you can install Brave which has adblock, I don't think Firefox has add-ons in that version though, not sure.
I don’t think you can write off Apple or Microsoft just because Thiel made some investment in them.
Being the VC to a company’s round B, C, and D (adding up to maybe 40% ownership/control) is VERY different from simply throwing some money at a trillion dollar company to see some returns.
Firefox on Android supports it without any issue. That would cover a significant enough segment of the population that it might encourage actual change in the industry if people started moving to that platform.
Firefox on Android has approximately 0.5% market share on mobile, less than Opera. I really doubt it's enough to spark any sort of industry-wide change.
I'm not saying that Firefox on Android has significant market share; rather that Android has significant market share, and those users could be served by switching to Firefox solely for the purpose of using an adblocker.
If all Android users did this, something would change.
The point is it’s easy. It’s near frictionless. Unlike a lot of pie in the sky statements I see here like how “easy” it is to install and run Linux (it isn’t), Firefox adoption is truly trivial for any smartphone user and presents a stronger baseline than chrome does. People here often get critical of Firefox/Mozilla, and I totally get it, but compared to Google Chrome it doesn’t, well, compare.
Firefox runs great 99.99% of the time. It’s easy to add extensions. So we should be pushing people to adopt it.
It’s becoming easier on iPhone (even uBlock origini is now available, if only the lite version), which is nice because internet is becoming more and more unusable without them.
AdGuard installs through the App Store and integrates seamlessly with Safari. It's not as perfect as some of the desktop class adblockers, but it's free and can be up and running in a couple minutes.
If you're on Android, Firefox supports many full desktop extensions, including uBlock Origin.
There have been mobile Safari ad blockers for 10 years now, free or paid, and many of them can now be unified with desktop Safari. Many alternative iOS browsers include ad blocking directly, since they can't use the Safari plugins (despite all being powered by WebKit).
Not anymore. You can just find one on the app store and install it, almost exactly the same as you do in a browser's extension "store". It won't be as good as uBlock but it certainly works fine even in Safari.
ublock origin lite is straight up on the app store now, should work with any moderately recent version of iOS/iPadOS. Installed this on my family's Apple devices and it works pretty well.
There's also been other adblock apps for a long while, though (adguard comes to mind).
Can't speak for IOS but for android users I highly recommend Firefox for android, since you can install ublock origin within it.
Let's be real, browsing the modern internet is downright impossible without it today.
Every browser should have ad blocking technology included and enabled by default. I do not understand why Apple in particular has not pushed this with Safari, as they like to portray that they care about privacy.
I get why Chrome doesn't, and that's why you should not use it. But Netscape? Edge? What is stopping them?
Browsing the web without an ad blocker is a miserable experience. Users who have never tried or don't know how to set one up would be delighted.
Google pays Apple 20+ billion dollars annually to be the default search engine in Safari. I don't know whether the absence of ad blocking is a stipulation in that deal or not, but I have to imagine that if Apple blocked ads in Safari by default, that deal would not be renewed.
Apple is worth nearly $4T. I think they can afford to take a principled stand here, especially considering the current mood about big tech.
And I don't think Google would lightly give up being the default search engine on the dominant mobile platform in the USA, and significantly more dominant among upper-income users.
At least with Chrome i can use ublock - not so with safari.
The best browser is ofc Firefox but everyone seems to have forgotten that bc of bad publicity or whatever
This implies they had some sinister plan to claim all your data as theirs or something which is ridiculous - they didn’t back down from anything but changed the wording of the legal text to make it easier to parse for non-lawyers.
It’s worse than that. My mom wants to see ads. I thought I was doing her a favor adding her to my pihole but she really likes ads, especially Facebook ads.
It's probably better to let them spy on your highly encrypted traffic going overseas than use a US based service considering that they can march into any US company and start collecting every bit of data (https://en.wikipedia.org/wiki/Room_641A)
> the average person's response is ... I'll just go ahead and continue to suffer with invasive ads
The real reason is that the average person neither suffers with ads nor finds ads invasive, despite what a vocal online minority would have you believe. We just ignore them and get on with life. ::shrug::
Ignoring (post-impact) and moving on is the natural thing to do, but it seems like a stretch to imply that the average person neither suffers or finds ads invasive.
The suffering isn't acute, it's death by a thousand cuts as your mind erodes into a twitchy mess. Look at the comment section of a nice youtube video and see people outraged at getting blasted with an ad at the wrong moment.
Most people don't like ads, but we love the stimulation of the screen more so we suffer them, regardless of the damage done.
>... it seems like a stretch to imply that the average person neither suffers or finds ads invasive.
The average person has never heard of HN. It isn't the case that the average person's experience with today's internet ads is that of having their "... mind erode[s] into a twitchy mess."
The average person doesn't look at the comment section of a nice YouTube video.
>Most [HN] people don't like ads....
Most people don't suffer — at least not consciously — as a result of ads.
I don't know why you're inserting HN into it? We're talking about average people, not nerds with ad-blockers. Are you suggesting that the average person enjoys being interrupted with ads?
> It isn't the case that the average person's experience with today's internet ads is that of having their "... mind erode[s] into a twitchy mess."
Perhaps I was a bit dramatic with my wording, but my point still stands. Since you're flatly denying it, perhaps you have some references? As far as I can tell, all signs are pointing to widespread ADHD increases correlated to computer use, which may not be directly tied to ads exclusively, it stands to reason that they're big offenders given their nature of being short, attention-grabbing, context-breaking, non-interactive engagements. There's plenty of studies that support this.
> The average person doesn't look at the comment section of a nice YouTube video.
Um, really?
> Most people don't suffer — at least not consciously — as a result of ads.
My point was it's death by a thousand cuts, boiling the frog, etc. The average attention span has been cut in half over the last 20 years. Also, I'd argue that sensitive people who may already be mentally stressed, which seems to be a growing group, might actually suffer in the short term or immediately.
You've made some strong statements, but I'm having a hard time buying them.
YT made sure adblockers ruin the experience. We really need a good YT alternative, as it has become AI slop (shorts) and most new videos are of real poor quality.
"Ad blockers" nowadays do much more. From the horse’s mouth, which describes itself as a “wide-spectrum content blocker” [1]:
“uBlock Origin (uBO) is a CPU and memory-efficient wide-spectrum content blocker for Chromium and Firefox. It blocks ads, trackers, coin miners, popups, annoying anti-blockers, malware sites, etc., by default using EasyList, EasyPrivacy, Peter Lowe's Blocklist, Online Malicious URL Blocklist, and uBO filter lists. There are many other lists available to block even more [...]
Ads, "unintrusive" or not, are just the visible portion of the privacy-invading means entering your browser when you visit most sites. uBO's primary goal is to help users neutralize these privacy-invading methods in a way that welcomes those users who do not wish to use more technical means.”
Appreciate the clarification, I would clarify to say the origin story of Ad blockers are ads, and the underlying behaviours may not capture everything that fingerprinting may do where people don't advertise.
Ublock is great, but I am finding fingerprinting that gets past it and that's what I'm referring to.
I'd like to install uBlock Origin, when I try, Chrome warns it needs the permission to, "Read and change all your data on all websites". That seems excessive, to give that much power to one extension. I currently use no extensions to keep my security posture high.
I never get the fear behind extensions, at least not to the level where you wouldn't use an open-source extension that's extremely well vetted. And even if that isn't good enough for you, choosing to browse the web without using a content blocker is a far, far greater security risk.
I use uBlock Origin with basically every filter list enabled on Brave with their default blocker enabled. I just confirmed that this does not prevent the script from loading and scanning extensions. The browser tools network tab on LinkedIn is absolutely frightening.
NoScript will prevent that script from loading and scanning extensions. JS is required for almost all fingerprinting and malware spread via websites. Keeping it disabled, at least by default, is the best thing you can do to protect yourself.
According to the EFF fingerprinting website, Firefox + uBlock Origin didn't really make my browser particularly unique.
But turning on privacy.resistfingerprinting in about:config (or was it fingerprintingProtection?) would break things randomly (like 3D maps on google for me. maybe it's related to canvas API stuff?) and made it hard to remember why things weren't working.
Not really sure how to strike a balance of broad convenience vs effectiveness these days. Every additional hoop is more attrition.
fingerprint.com seems to be some fingerprinting vendor, they don't even offer a demo without logging in. https://coveryourtracks.eff.org is EFFs demo site is non-profit and doesn't require login
I have a lot of browser extensions running and am using Brave as my browser. I have their built in adblocker enabled as well as some of their privacy features turned on in the settings. I am also using a self hosted adblock instance for my DNS servers. I actually appear as random and not unique which is really nice to see. I know Brave does intentionally lean on some of the privacy side of things and it also has options to specifically prevent sites from fingerprinting by blocking things like seeing language preferences. I have to assume it is also doing some things in the backend to try and prevent other fingerprinting methods.
It is not telling you that the test site has never seen you before, because the eff isn't storing your fingerprint for later analysis and tracking
It could actually tell you about which real tracking vendors are showing you as "Seen and tracked" so it's pretty annoying they don't do that.
If that site shows you as having a unique fingerprint, I guarantee you are being tracked across the web. I've seen the actual systems in usage, not the sales pitch. I've seen how effective these tools are, and I haven't even gotten a look at what Google or Facebook have internally. Even no name vendors that don't own the internet can easily track you across any site that integrates with them.
The fingerprint is just a set of signals that tracking providers are using to follow you across the internet. It's per machine for the most part, but if you have ever purchased something on the internet, some of the providers involved will have information like your name.
Here is what Google asks ecommerce platforms to send them as part of a Fraud Prevention integration using Recaptcha:
> the EFF isn't storing your fingerprint for later analysis and tracking
Yes they are, quoting that very page:
> Your browser fingerprint appears to be unique among the 312,935 tested in the past 45 days
So clearly they store the information for at least 45 days. This raises the question what they actually mean by unique. If I change my IP and re-test, I get the same
> Your browser fingerprint appears to be unique among the 312,941 tested in the past 45 days
So does that mean that my fingerprint changed, and they can't track me anymore? Or do they mean to tell me that they still track me and I'm still as uniquely identified.
Their methodology and linked articles does not seem to answer this [0] [1]
It's all very complicated, because the fingerprinting needs to be unique enough to identify you while still being "persistent" enough not to identify you as somebody else if you change just one bit of it.
Exactly because no one in his right mind is going to work in "state". So the "state" is more like 95% "fucking idiots" as you put it, and that is self-reinforcing.
When has infantilizing adults resulted in positive outcomes? What if the group of idiots decide you're the idiot and start making decisions for your own good?
I asked an LLM to create a plan for a 'digital rebirth' in order to minimize privacy harms. It's a lot of work, but increasingly: a worthwhile endeavor.
I disagree, I think we should push back hard on behavior like this. What business is it of LinkedIn's what browser extensions I have installed? I think the framing for this is appropriate.
Why is it possible for a web site to determine what browser extensions I have installed? If there are legitimate uses, why isn't this gated behind a permission prompt, like things like location and camera?
This, to me, seems like the more salient point. A headline like “Major browsers allow websites to see your installed extensions” seems more appropriate here.
We’ve known for a long time that advertisers/“security” vendors use as many detectable characteristics as possible to constrict unique fingerprints. This seems like a major enabler of even more invasive fingerprinting and that seems like the bigger issue here.
It's possible to write a headline that directs blames at both parties: "Major Browsers Fail to Block Websites that Invade Your Privacy"
The fact that the website is doing this is a bigger problem than the browser not preventing it. If someone breaks into a house, it's the burglar who is prosecuted, not the company that made the door.
If you scanned LinkedIn's private network, you'd be criminally charged. Why are they allowed to scan yours with impunity? And why is this being normalized?
The best solution is a layered defense: laws that prohibit this behavior by the website and browsers that protect you against bad actors who ignore the law.
> If you scanned LinkedIn's private network, you'd be criminally charged. Why are they allowed to scan yours with impunity? And why is this being normalized?
First, I think it’s a major issue that Chrome is allowing websites to check for installed extensions.
With that said, scanning LinkedIn’s private network is not analogous to what is going on here. As problematic as it is, they’re getting information isolated to the browser itself and are not crossing the boundary to the rest of the OS much less the rest of the internal network.
Problematic for privacy? Yes. Should be locked down? Yes. But also surprisingly similar to other APIs that provide information like screen resolution, installed fonts, etc. Calling those APIs is not illegal. I’m curious to know what the technical legal ramifications are of calling these extension APIs.
If a company leaks my sensitive data, I get some nice junkmail offering me some period of time of credit monitoring or whatever so what are browsers doing to prevent this?
The issue should never be 'We want entities to have this data but only use it in some constrained and arbitrary manner that we can't even agree about it's definition.' instead 'This data shouldn't be made available to X'
This is a Chrome thing. It’s a safe bet that if you use Google products you don’t care about privacy anyway. “Google product collects info about you: news at 11.”
Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone else unless you ask them to.
Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone who hasn't paid them for it or can compel them to give it up.
There's a fourth amendment case on the Supreme Court docket (Chatrie v. U.S.) about Google searching a massive amount of user data to find people in a location at a specific time, at police request. The case is about whether the police's warrant warranted such a wide scope of search (if general warrants are allowed).
Point being: Google will 100% give your info to the police, regardless of whether the police have the legal right to it or not, and regardless of whether you actually committed a crime or not.
Bonus points: the federal court that ruled on the case said that it likely violated the fourth amendment, but they allowed the police to admit the evidence anyway because of the "good faith" clause, which is a new one for me. Time to add it to the list of horribly abusable exceptions (qualified immunity, civil asset forfeiture, and eminent domain coming to mind).
The breaking point with me that caused me to de-google myself was finding out that Google was buying Mastercard records in order to cross-reference them with Android phone data. That shit is not okay.
So no compelling here. The police asked for it and google gave it, either for free or in exchange for money. They didn't say "no" to the police, they didn't wait for a court order.
The bad guy here is google. And the people that champion data collection by private companies because of free market == good.
In that case, the main bad guy was the police who didn't bother to do even the most basic investigating after "check Google's GPS records to see who was at the house" including "Check Google's GPS records to see how how long they were there" which would have shown them this was a drive by, but yeah Google is absolutely a villain
Ah yes, I should have said I was describing the official line, not the behaviour. In all fairness the “can compel them to give it up” doesn’t seem to be optional but otherwise, yeah. Agreed.
This only works if the web page knows the random per-install id associated with an extension.
That can only happen if the extension itself leaks it to the web page and if that happens, scanning isn't necessary since it already leaked what it is to the webpage. It also doesn't tell you what extension it is, unless again, the extension leaks it to the webpage.
The attack on Chrome is far more useful for attackers as web pages can scan using the chrome store's extension ID instead.
1. Do a request to `chrome-extension://<extension_id>/<file>`. It's unclear to me why this is allowed.
2. Scan the DOM, look for nodes containing "chrome-extension://" within them (for instance because they link to an internal resource)
It's pretty obvious why the second one works, and that "feels alright" - if an extension modifies the DOM, then it's going to leave traces behind that the page might be able to pick up on.
The first one is super problematic to me though, as it means that even extensions that don't interact with the page at all can be detected. It's unclear to me whether an extension can protect itself against it.
> 1. Do a request to `chrome-extension://<extension_id>/<file>`. It's unclear to me why this is allowed.
Big +1 to that.
The charitable interpretation is that this behavior is simply an oversight by Google, a pretty massive one at that, which they have been slow to correct.
The less-charitable interpretation is that it has served Google's interests to maintain this (mis)feature of its browser. Likely, Google or its partners use similar to techniques to what LinkedIn/Microsoft use.
This would be in the same vein as Google Chrome replacing ManifestV2 with ManifestV3, ostensibly for performance- and security-related purposes, when it just so happens that ManifestV3 limits the ability to block ads in Chrome… the major source of revenue for Google.
The more-fully-open-source Mozilla Firefox browser seems to have had no difficulty in recognizing the issues with static extension IDs and randomizing them since forever (https://harshityadav.in/posts/Linkedins-Fingerprinting), just as Firefox continues to support ManifestV2 and more effective ad-blocking, with no issues.
> This would be in the same vein as Google Chrome replacing ManifestV2 with ManifestV3, ostensibly for performance- and security-related purposes, when it just so happens that ManifestV3 limits the ability to block ads in Chrome… the major source of revenue for Google.
uBlock Origin Lite (compatible w/ ManifestV3) works quite well for me, I do not see any ads wherever I browse.
The mv3 problem was never about "does it work now". It was about "can it keep up". Ad blocking is a cat and mouse game, and the mouse is kneecapped now. You're being slow boiled.
Well said. I'm glad that as blockers have managed to develop effective approaches under Mv3, but it took a tremendous amount of engineering effort that was only necessary because Google was trying to impose these very large costs on them.
These are web accessible resources, e.g. images and stylesheets you can reference in generated HTML. Since content scripts operate directly on the same DOM, it’s unclear how you can tell an <img> or <link> came from the modification of a content script or a first party script. You might argue it’s possible to block these in fetch(), but then you also need to consider leaks in say Image’s load event.
This behavior has been improved in MV3, with option to make the extension id dynamic to defeat detection:
> Note: In Chrome in Manifest V2, an extension's ID is fixed. When a resource is listed in web_accessible_resources, it is accessible as chrome-extension://<your-extension-id>/<path/to/resource>. In Manifest V3, Chrome can use a dynamic URL by setting use_dynamic_url to true.
For widget style services:
If you need the functionality of an extension to operate, then you can check if it's already installed so you don't ask to install it again.
This is better than forcing the extension to announce it's presences on every web site.
Agreed, but also, permission prompts are way overused and often meaningless to anyone at all, even fellow software engineers. “This program [program.exe] wants to do stuff, yes/no?” How should I know what’s safe to say yes to?
I think Android’s ‘permissions’ early on (maybe it’s improved?) and Microsoft’s blanket ‘this program wants to do things’ authorisation pop up have set a standard here that we shouldn’t still be following.
Generally the whole thing needs to be flipped upside down. Extensions is the easy one, there's not reason a random website can list your installed extensions, zero.
For other capabilities, like BlueTooth API, rather than querying the browser, assume that the browser can do it and then have the browser inform the user that the site is attempting to use an unsupported API.
> Of course Google is going to back door their browser.
Aside from the fact that other browsers exist, this makes no sense because Google would stand to gain more by being the only entity that can surveil the user this way, vs. allowing others to collect data on the user without having to go through Google's services (and pay them).
To broaden my point, I think we’d find that many websites we use are doing this.
My point isn’t that this is acceptable or that we shouldn’t push back against it. We should.
My point is that this doesn’t sound particularly surprising or unique to LinkedIn, and that the framing of the article seems a bit misleading as a result.
I've love it if LinkedIn got successfully sued for millions and it resulted in similar lawsuits against every other website that did this sort of thing.
> To broaden my point, I think we’d find that many websites we use are doing this.
Your point of "I think we’d find that many websites we use are doing this" doesn't make LinkedIn's behavior ok!
By your logic, if our privacy rights are invaded which is illegal in most jurisdiction, and then it become ok because many companies do illegal things??
Absolutely not. At no point am I saying this is ok.
I’m saying that the framing of the article makes this sound like LinkedIn is the Big Bad when the reality is far worse - they’re just one in a sea of entities doing this kind of thing.
If anything, the article undersells the scale of the issue.
> What business is it of LinkedIn's what browser extensions I have installed?
The list of extensions they scan for has been extracted from the code. It was all extensions related to spamming and scraping LinkedIn last time this was posted: Extensions to scrape your LinkedIn session and extract contact info for lead lists, extensions to generate AI message spam.
This doesn’t fit the description of scraping by any normal definition. It’s a classic feature probe structure, where the features happen to be scraping extensions.
I think it’s kind of funny that HN has gone so reactionary at tech companies that the comments here have become twisted against the anti-spam measures instituted on a website that will never trigger on any of their PCs, because HN users aren’t installing LinkedIn scrape and spam extensions.
HackerNews users used to be the type that would do the scraping, so they could Hack the data into whatever format or integration they desired.
It's unfortunate to see folks here who don't support that – interoperability is at the heart of the Hacker Ethic. LinkedIn (along with any other big tech companies locking down and crippling their APIs) is wrong to even try to block it.
Is it an issue of the resources scrapers consume? No: Even ordinary users trying to get API access on a registered persistent account linked to their name are stymied in accessing their own data. LinkedIn simply doesn't want you to access your own data via API, or in any manner that isn't blessed by them. That ain't right.
Accessing other users' LinkedIn data via the API requires their OAuth consent, as it should be. But you are welcome to access your own data via the API.
> The list of extensions they scan for has been extracted from the code. It was all extensions related to spamming and scraping LinkedIn
Not according to the website which says:
The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify). Under GDPR Article 9, processing data that reveals religious beliefs, political opinions, or health conditions requires explicit consent. LinkedIn obtains none.
It also scans for every major competitor to Microsoft’s own products — Salesforce, HubSpot, Pipedrive — building company-level intelligence on which businesses use which software. Because LinkedIn knows your name, employer, and role, each scan aggregates into a corporate technology profile assembled without anyone’s knowledge.
Sounds a little like "OpenAI must protect itself against copyright infringement by any means necessary, including copyright infringement of everyone else"
If I had to guess, LinkedIn would be primarily searching for extensions that violate their terms of service (e.g. something that could be used to scrape data). They put a lot of effort into circumventing automated data collection. I could be wrong.
This has been covered several times including reverse engineering of the code. The list of extensions they check for doesn’t include common extensions like ad blockers. It’s exclusively full of LinkedIn spamming and scraping type of extensions.
They also logically don’t need to fingerprint these users because those people are literally logging in to an account with their credentials.
By all appearances they’re just trying to detect people who are using spam automation and scraping extensions, which honestly I’m not too upset about.
If you never install a LinkedIn scraper or post generator extension you wouldn’t hit any of the extensions in the list they check for, last time I looked.
it apparently scans for something like "PQC Checker", an extension for checking if TLS connection is PQC-enabled? how is that a spam extension (and thats just a random one i saw)
Probably compromised extensions or misleading extensions.
It’s common for malware extensions to disguise themselves as something simple and useful to try to trick a large audience into installing them.
That’s why the list includes things like an “Islamic content filter” and “anti-Zionist tagger” as well as “neurodivergent” tools. They look for trending topics and repackage the scraper with a new name. Most people only install extensions but never remove them if they don’t work.
well if they have evidence why they dont report it? why are these extensions on the store? im sure linkedin has enough motion to report it directly to google
also, having a PQC enabled extension doesnt seem like a good "large user base capture" tactic.
the source code is as usual obfuscated react but that doesnt mean its malicious...
EDIT: i debuged the extension quickly and it doesnt seem to do anything malicious. it only sends https://pqc-extension.vercel.app/?hostname=[domain] request to this backend to which it has permissions. it doesnt seem to exfiltrate anything else. it might get triggered later but it has very limited permissions anyway so it doesnt seem to be a malicious extension. (but im no expert)
> well if they have evidence why they dont report it? why are these extensions on the store?
We had a browser extension for our product. A couple times a month someone would clone it, add some data scraping or other malware to it, and re-upload it with the same or similar name.
We set up automated searches to find them. After reporting it could take weeks to get them removed, some times longer. That’s for extensions with clear copyright problems!
The extensions may not be breaking any rules of the extension stores if they’re just scraping a website. Many of the extensions on the list are literally designed to do that as their headline feature.
If you think sending data from a page to a server would disqualify an extension from an extension store then think again. Many of the plugins listed even have semi-plausible reasons for uploading the scraped data, like the “anti-Zionist tagger” extension on the list or the ones that claim to blur things that are anti-Islam. Manufacturing a reason to send data to their servers gives them cover.
I am aware that google will take looong time to act. that is why I mentioned that it is LinkedIn (Microsoft) or its contracted fingerprinting/"monitoring" partner who may have more direct ways to report this if they actually investigate malicious extensions.
but that doesn't really matter. for the sake of the argument assume the extensions are not malicious (as evidenced e.g. by the PQC one with ?16 users?) does that change the situation?
They're doing a lot more than scanning for "compromised or misleading extensions"; there are a lot of scummy/spammy extensions on the list, but among the extensions included in the list of those they probe are also extensions such as:
- "Highlight multiple keywords in a web page", an extension that re-implements the equivalent Firefox's "Highlight All" findbar button in Chrome—and happens to mention LinkedIn in the description when describing one use case <https://chromewebstore.google.com/detail/ngkkfkfmnclhjlaofbh...>
- "Delayed gratification Research", a study/focus extension created "for OS semester at CODE University of Applied Sciences" to "Temporarily Block distracting websites"—with all of 4 active users <https://chromewebstore.google.com/detail/mmibdgeegkhehbbadeb...>
It's pretty clear that LinkedIn, like many website operators, don't think of themselves as a source of information that it will send to your UA upon request. It's not even just that they want total visibility into your habits like the worst of the advertising/tracking companies. What they want is as control as they can manage to wrangle over the experience of what it's like when you're "on" their site (i.e. looking at something on your computer that came from their site)—not least of all so they can upsell their userbase on premium features. LinkedIn doesn't care so much that people are inundating other users/orgs that might not appreciate that they're being treated as a "lead", so much as LinkedIn cares that the people doing the inundating are doing it with tools where LinkedIn wasn't able to get a cut.
It is likely in response to scraping. Linked in is heavily scraped by scammers who do the BEC scams. So linked in is trying to find ways to link together banned accounts, to handle their ban evasion.
I run a site which attracts a lot of unsavoury people who need to be banned from our services, and tracking them to reban them when they come back is a big part of what makes our product better than others in the industry. I do not care at all about actually tracking good users, and I am not reselling this data, or anything malicious, it's entire purpose is literally to make the website more enjoyable for the good users.
>Linked in is heavily scraped by scammers who do the BEC scams.
It's also heavily scraped by businesses for lead generation for sales and recruiting. Either before their API became available or to not pay them or to get around the restrictions of their API.
Font measurement (4): fontFamily, fontSize, getBoundingClientRect, innerText. Creates a hidden div, sets a font, measures rendered text dimensions, removes the element.
Storage (5): storage, quota, estimate, setItem, usage. Also writes the fingerprint to localStorage under key 6f376b6560133c2c for persistence across page loads.
Scanning for 6000 extensions is anti-competitive, surveillant and immoral.
> I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister
This seems like a really weird argument to make. The fact that the platform doesn't provide a privacy-violating API is not an extenuating circumstance. LinkedIn needed to work around this limitation, so they knew they're doing something sketchy.
For the record, I don't think they're being evil here, but the explanation is different: they're don't seem to be trying to fingerprint users as much as they're trying to detect specific "evil" extensions that do things LinkedIn doesn't want them to do on linkedin.com. I guess that's their prerogative (and it's the prerogative of browsers to take that away).
Judging from the fact that 99% of the list seem like data-mining scam apps or spam tools, I suspect that's the answer in these cases too.
If LinkedIn really wanted to profile your religious beliefs, they would presumably go after the most popular religion-related extensions, not some "real-time AI for Islamic values" thing with 6k users.
Those profiling tools don't really care which features are going to be used for predictions. It's just machine learning, and it's indiscriminate. So if you have an extension that correlates with you being Muslim, it will be used for whatever ML predictions they give to other companies, and the worst case will be another "oh we didn't do this intentionally".
Of course, that's not the first time this ever happened in human history, so even if it's not "something inherently sinister", it's just "criminal negligence".
The page isn't allowed to know what extensions you have, instead LinkedIn is looking for various evidence that extensions are installed, like if an extension was to create a specific html element, LinkedIn could look for evidence of that element being there.
Since the extensions are running on the same page as LinkedIn (some of them are explicitly modifying the LinkedIn the website) it's impossible to sandbox them so that linked in can't see evidence of them. And yes this is how a site knows you have an ad blocker is installed.
However, there are other proof of concept of another attack vector to bypass this by using timing difference when fetching those resources.
I help maintaining uBO's lists and I've seen one real world case doing this. It's a trash shortener site, and they use the `web_accessible_resources` method as one of their anti-adblock methods. Since it's a trash site, I didn't care much later.
> The scan probes for thousands of specific extensions by ID, collects the results
Why exactly does Chrome even allow this in the first place!? This is the most surprising takeaway for me here, given browser vendors' focus on hardening against fingerprinting.
This only happens if the extension puts their `moz-extension://` links into the DOM. It's different to chrome case where extensions can be detected regardless of being activated on that site or not.
As I understand it, an extension could also leak its links via its own backend, e.g. to advertisers, who could then detect it even though no user-observable DOM modification is happening.
Much better than static global IDs, but still not ideal.
Yeah, anything happening in backend depends totally on the extensions. Unless I need something, I rarely use extensions that are closed-source or open-source but has some sending data in their features.
For what it's worth - and I'm not saying that LinkedIn is doing this for the right reasons - I can imagine a frontend QA team wanting to do this to understand how prominent certain extensions are for users of various parts of their product, correlating those extensions against frontend bug reports, and using that to guide QA procedures with real-world extension sets.
When you're literally the company that invented Kafka for your clickstreams, "everything looks like a nail."
(More likely, though, this is an anti-scraping initiative, since headless browsers are unlikely to randomize their use of extensions, and they can use this to identify potential scrapers.)
> the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).
Your computer is your private domain. Your house is your private domain. You don't make a "getAllKeysOnPorch()" API, and certainly don't make "getAllBankAccounts()" API. And if you do, you certainly don't make it available to anyone who asks.
> I’m certainly not endorsing it, do think it’s pretty problematic, and I’m glad it’s getting some visibility. But I do take some issue with the alarmist framing of what’s going on.
Speaking has someone who shares the same lack of surprise, perhaps some alarm is warranted. Just because it’s ubiquitous doesn’t mean it’s ok. This feels very much frog in boiling water for me.
Why do you think the alarmist framing is unwarranted?
To me, it seems like the authors pulled the fire alarm for a single building when in reality there’s a tornado bearing down.
And by doing so, everyone is scrambling about a fire instead of the response a tornado siren would cause.
They’re both dangerous and worthy of an immediate reaction, but the confusion and misdirection this causes seems deeply problematic.
When people realize the fire wasn’t real, they start to question the validity of the alarm. The tornado is still out there.
I realize this analogy is a bit stretched.
As someone who has spent quite a lot of time steeped in security/privacy research, the stuff described in the article has been happening pervasively across the industry.
People absolutely should be alarmed. Many of us have been alarmed for quite some time. Raising the alarm by saying “LinkedIn is searching your computer” isn’t it.
I think this is a great analogy. I read quite a bit of the site and it's wildly blown out of proportion and severely lacking in context.
How many phone apps do you think are trying to detect what else is installed on your phone? I was part of an acquisition of a company with a very large mobile user base and our new parent was shocked we weren't trying to passively collect device information like this. They for sure were.
And on the flip side, as others have done well to point out, there are a LOT of legitimate reasons to fingerprint users for anti-fraud/abuse and I am 100% convinced that we're all better off for this.
Maybe thats all this story is about, maybe not, but this article leaves out an incredible amount of complexity.
Just because someone lets the electrician (LinkedIn) into their home (browser) doesn't mean they can do whatever the hell they want that isn't expressly prohibited. If the electrician wants to rifle through my desk drawers, they should ask for permission, and I will politely tell them to leave.
I worked for a company that sold b2b contact data and they had (maybe still have) a linkedIn extension. It basically enriched the linkedIn profile. I wonder if linkedIn is trying to block these, or heavily target, in some way, these types of users to push folks towards their sales navigator.
Your post sounds like "it sounds bad, but it's no different from what others do, so it's not that bad."
I would put it more like: it sounds bad, and it's no different from what others do, so they're all that bad.
The fact that they're working around an API limitation doesn't make this better, it just proves that they're up to no good. The whole reason there isn't an API for this is to prevent exactly this sort of enumeration.
It's clear that companies will do as much bad stuff as they can to make money. The fact that you can do this to work around extension enumeration limits should be treated as a security bug in Chrome, and fixed. And, while it doesn't really make a difference, LinkedIn should be considered to be exploiting a security vulnerability with this code.
The bigger problem I see here is browser security and Javascript as a whole. Browsers should not be allowed to extract and send such vast amounts of information in the first place, especially without the user's consent. At most, they should return a few broad things such as browser type (major version), language perhaps, and device type (mobile/desktop). That's it. Other things, such as exact resolutions, time zones, and other hardware identifiers make it trivially easy to track users across the Internet. Now that it's too late to revise Web standards, browsers should default to return spoofed values for all the rest.
I get the point you're making, but to be clear, "they’re checking to see if you’re a Muslim" vs "they’re checking to see if your fingerprint matches that of known Muslims in our ever-expanding database" are not too far off.
I'm confused, you call this "misleading" then quote the claim, but say it's "what [you'd] expect to find in modern browser fingerprinting code".
So what is it? Misleading, or exactly what you expected to find? It cannot be both.
It sounds more like you object to the negative framing of Microsoft hoovering up as much data as possible for profit, even though this is objectively a crime in the jurisdictions they are being sued in.
I've been avoiding Chrome-based browsers for many years now but have only recently become aware of how catastrophically low the Firefox market share is. I'm kind of shocked that more people aren't choosing to avoid Chrome.
> It also seems like what I’d expect to find in modern browser fingerprinting code.
Time to figure out if I can make FireFox pretend to be Chrome, and return random browser extensions every time I visit any website to screw up browser fingerprinting...
To flip it around, if one of those chrome extensions saved parts of the contents of the page it was on into a database, and I had the chrome extension navigate around on LinkedIn for me, collecting information, LinkedIn would sue me for CFAA violations because I'm scraping them for email addresses and phone numbers. This is not theoretical either, as LinkedIn has sued people in the past for scraping.
> sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”)
Then why search for PordaAI or Deen Shield? Or more specifically, since getAllExtensions() would return them, why would they be on the "scan list", instead of just ignored?
Well great there is no avalable 'getAllFiles()' or such either because they'd be scanning your files for "fingerprinting" as well.
> alarmist framing
Well they literally searching your computer for applications/extensions that you have installed? (and to an extent you can infer what are some of the desktop applications you have based on that too)
There is clear rules around what you can and can't do to fingerprint users. if it's being done overtly, covertly, obscurely, indirectly, all for the same result through direct or indirect or correlated metadata it ends up with the same outcome.
My understanding is the rules and laws are to prevent the outcome, by any means, if it's happening.
But I do take some issue with the alarmist framing of what’s going on.
I’ve come to mostly expect this behavior from most websites that run advertising code
We should be alarmed that websites we go to are fingerprinting us and tracking our behavior. This is problematic, full stop. The fact that most websites are doing this doesn't change that.
This blows my mind. What good reason is there for giving javascript such permissions by default? This should at the minimum trigger an explicit permission request from the user.
My guess would be that the internet is run by developers. Apps will want this data so javascript provides it to make decisions about window sizing and user agent capabilities. Authorization would probably only occur if javascript was gated by non developers just as SSDP open and forwards ports on routers without user intervention or knowledge rather than an API that prompt the user. Just a guess.
> It also seems like what I’d expect to find in modern browser fingerprinting code.
Exactly what I think it is. It's all for tracking and ultimately for advertisement. Linkedin can get exactly who you are and then they share that data with ad companies to better target you.
Yes. I was expecting LinkedIn was connecting to extensions that are using their exhanced privileges to scan your computer, per the "LinkedIn Is Illegally Searching Your Computer" headline.
> But I do take some issue with the alarmist framing of what's going on.
On the contrary, your framing is quite defeatist IMO. The fact that stores get robbed frequently does not mean we should just normalize that and accept it as a fact of life.
It's important to note that this isn't fixed by ad blockers. To avoid this kind of fingerprinting, you need to disable JavaScript or use a browser like Firefox which randomizes extension UUIDs.
How does this scan happen. AFAIK there is no API for a webpage to scan for extensions. The most a page could do is try to figure out indirectly if an extension exists if that extension leaks info into the page.
The next step for a forensic investigator, is to found out how many of those extensions, are actually from a partner or fully owned subsidiary from LinkedIn... When you see a cockroach...
How? What exactly would a reader be "mislead" to believe
The part about "inherently sinister" seems to be a thought from the mind of an HN commenter not the authors of the submitted web page. The later only describe LinkedIn's actions as illegal, not "sinister". The laws cited by the authors do not appear to consider any "state of mind", e.g., "sinister", or intent as relevant
"But I do take some issue with the alarmist framing of what's going on."
AFAICT, the submitted web page does not suggest that anything LinkedIn does is "dangerous", i.e., cause for "alarm". What it suggests is that LinkedIn's actions _violate European privacy laws_. The authors claim LinkedIn's actions present an opportunity to enforce these laws, i.e., "take action"
This could be easily inferred from the depth, breadth, and interconnectedness of data in the website.
By downplaying it, it's allowing it to exist and do the very thing.
The issue here is this stuff is working likely despite ad blockers.
Fingerprinting technology can do a lot more than just what can be learned from ads.
From the site:
"The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify). Under GDPR Article 9, processing data that reveals religious beliefs, political opinions, or health conditions requires explicit consent. LinkedIn obtains none." https://browsergate.eu/extensions/
I don't have a linkedin acct. So imagine my shock when I "googled" myself and found a linkedin profile connecting my name to a company I presently have a consulting arrangement with (1099 not W2). I went ballistic and fired off an email to the consulting firm to take down the profile immediately or face legal action (a bluff). Couple days later, the company forwarded an email they received from linkedin confirming the profile had been taken down.
So this is just a heads up that even if you don't have a linkedin account, they will create one on your behalf so might better check (assuming you neither have nor want one).
Are companies now commonly uploading lists of employees to LinkedIn? Is this happening automatically because you got an e-mail account from the company and the company runs on MS Office and you're identified as am employee within it? What triggered it?
This seems like somewhat of a scandal that deserves its own post, but it also needs a lot more details to be trustworthy and for people to understand what exactly is happening.
Also, was there some way for you to take ownership of the profile? Did it depend on verifying a certain e-mail address? Does it require you to get the company to remove it, or could you take ownership and then delete the LinkedIn account/profile yourself?
I rather suspect the information was siphoned to linkedin from the payroll company the consulting firm was using. While there are a zillion small consulting firms, there are a small number of firms which process their payroll (whether to employees or independent contractors like myself). I have no evidence to back this up but after thinking it through, it made more sense than every little mom/pop/medium size niche company all cooperating with linkedin vs a hand full of mega payroll consolidators selling aggregated lists to linkedin. Again, speculation on my part.
What is the benefit that the company derives from that? Kickbacks from LinkedIn? I'm not saying it is, or isn't, I don't understand what the benefit to be gotten from it is. It seems like a lot of effort by one party or the other, unless it is "baked in" to an MS account or whatever.
Also, as the person above had asked: did you have any option/ability to "take control" of the account, or did it have to go through the consulting company was using? It almost feels like someone had a fake ID card made for you. Not a drivers license, but something that would be of greater concern to the person on the ID (LinkedIn profile) than the company making it.
Interesting. That's a possibility... but how much information did the LinkedIn account have? Did it have your full job title? I'm not sure how much information is shared with payroll providers.
Again, there's no real reporting on the internet of LinkedIn creating profiles for people without their consent. If you have any documentation and details, this is the kind of thing worth posting here in full detail and/or contacting a journalist about. Of course, if it was in the past you might not have any of that info anymore.
It reminds me of that thing I had heard of people doing on Facebook years ago. Someone wouldn't have a Facebook account "yet", so one of their friends/family/whomever would create one on their behalf with an assumption that they were being helpful to the other party. "It's all ready to go once you want to login! I knew your email address, so just do a password reset when you start using it. You're welcome!"
I believe even an episode of South Park covered it.
The difference there being that, with the Facebook relationship status stuff, spouses were feeling societal pressure to show a public declaration and "proof" of their partners existence/mutual status. With something like LinkedIn though...does that same sort of pressure exist? Are Hiring Managers (or whomever) feeling some kind of professional pressure to "prove" how many real life people work with/for their company? Does getting the number of users marked as working for that company above a threshold give them secret, special privileges in some locked-off business area of LinkedIn? Or is it just pure clout chasing? It's very odd. It feels like a violation in some way I can't really articulate. "Compulsory volunteer account-to-ID association"? I don't know what to call that. It's gross.
We used to have to destroy org charts and handbooks so that our companies wouldn't get hacked, not they just throw that out the windows and act shocked when something happens.
Yeah. Generally companies would prefer their employee lists not not public. It opens them up not just to social engineering hacking, but also everyday poaching.
I understand why LinkedIn would want more profiles. Hard to understand why a company you work for would be cooperating with them. And if they have the power to take your profile down then they're aware of it. Very strange.
I’ve seen fake accounts created by bad actors attempting to pose as others for gaining remote employment. It’s possible that is what was happening, and the takedown was from LI taking down the profile from the bad actor.
Other times they would just link to real LinkedIn profiles, but the LinkedIn profile will say that they’re not actively looking and are a victim of id fraud basically.
It’s been a huge issue spotting candidates falsifying information since remote work took off unfortunately. They payout is if they can get at least 1 or 2 paychecks before being found out, they’ve made a good profit.
Are you sure they took it down completely, not just removed from public eyes? Majority of LinkedIn income is from businesses, they might still sell it in some form (e.g. stats/aggregates).
A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are.
Anyway, what they're calling "spectroscopy", is a combination of extension probing and doing residue detection (looking for what extensions might leave behind in the DOM).
An ad blocker is not necessarily equipped to help since the script is embedded with the application code. Since they're targetting Chrome, switching browsers will help with the probing but not the detection part and you'll still be fingerprinted.
The only way forward is for browser vendors to offer a real privacy or incognito mode where sites are sandboxed by default. When the default profile is identical across millions of users there won't be anything unique to fingerprint.
It's the typical Microsoft playbook, where they release a product and convince everyone that it has to be used everywhere, and by the time people realize how unbelievably terrible the product is it's too late and it has entrenched itself everywhere.
They've run this experiment before; Windows is terrible and has been for a very long time, Microsoft Office is terrible and has been for a very long time, Sharepoint is terrible and has been for a very long time, LinkedIn is terrible and has been for a very long time, etc.
It's what they do, there is not a single thing that Microsoft does not half-ass, because all they focus on is getting embedded into places, and that does not require that any of their products be good.
> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are.
For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years.
That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my examples, but just saying fingerprinting itself without explicit disclosure has been around for quite a long time. It happens on literally every CAPTCHA service. I hate it of course, but the ship sailed a long time ago.
Have you (or anyone reading this) been able to "beat" fingerprint.com without Tor or turning JavaScript off outright?
I've tried it various times over the last couple years, using different browsers with various privacy settings enabled and a VPN.
I can get good partial results and am able to reset my fingerprint by changing my OS and browser at the same time, so it's not entirely there with regards to sniffing the hardware. But I can never revisit the site and have it not recognize me. Is there no one but me using (for example) Debian testing Librewolf with resistFingerprinting on Proton VPN? If there are others, then resistFingerprinting is doing a bad job hiding my hardware.
That's depressing! Despite our genuine best efforts, enough identifiers leak that it seems to me there's no practical solution. I am genuinely at a loss for what we can do.
(If you're reading this and think it doesn't matter, it's possible you're not realizing that this means that any site collecting and storing these identifiers now will be able to talk to any site in the future and link your identity. Your past actions on every website on a given piece of hardware are liable to be linked to create a detailed profile in the future, so even if Reddit and Pornhub and Discord and the government aren't talking to each other now, you can put some decent probability in the fact that if they decided to share identifiers, they could link all your historical (signed out) activity to your real-world identity without much effort. I use those sites as examples because they're sites where people tend to generate information that they may want private, but they visit using the same hardware identifiers.)
I can beat it, but only be changing my IP. Since I'm not using a shared IP like a university/company might, my IP is giving them a lot of bits about me since I'm the only entity using it... No matter the browser switch, if I hit it from the same IP, it correctly assumes that my IP is still me. But the moment I switch to a different browser and change IPs I get a new fingerprint. Haven't dug deep on it though, like would an incognito window in Chrome on a new IP, have the same fingerprint as a non-incognito Chrome window on another IP? Not sure
I would love to play around with that fingerprint demo while on a large shared IP, where they the IP itself provides less signal and is less unique.
Fingerprint (and its ilk) use a tiered identification system to identify you, with a decrease in confidence with each step down.
They start with a supercookie approach (first-party cookies, third party cookies, indexdb, localstorage, session storage, favicon timing, etc) which is a direct look up, and unique. This is tier-1.
Next they slam as many signals as they can get your browser and network to cough up into an ML db and find your nearest neighbor. If its greater than threshold ${x} - they return its ID with a confidenc of say 85%
If that misses, they slide down to tier 3 which is your IP address plus some browser signals on a TTL so they don't just call everyone with your IP address "you". This is maybe say 50% confident.
Below that, they create a new record.
If you want to beat it - tbh - Safari, especially on IOS is a monster. Most people with an iPhone default to it, and they remove their biggest entropy signals (offlineAudio, canvas profiling), so they're left with almost nothing to work with that is really unique.
Fingerprint _really_ pushes merchants to reverse proxy their services so that they can serve cookies as first party and Apple doesn't nuke them after 1 week. Its complicated and most merchants don't want to diddle with it - but it circumvents adblockers (ps - use an adblocker and call out fingerprint specifically if you want to hit them. LLM to see who else you need to include).
After that, if you're on Apple, use their Apple-VPN service (forget what its called) - which exists _literally_ for this.
It's definitely possible to bypass fingerprinting (just take a look at countless web scraping services that manage to do that) but consumer browser actively reject this.
If I were to wear a tin-foil hat I'd say that fingerprinting is a spyware feature not a bug but it can also be explained by the fact that current web market relies on fingerprinting too much thus blocking adoption of anti-fingerprinting features. Firefox half-ass tried to but now all the anti-fingerprint features are hidden deep in the about:config somewhere because people rather see less captchas than have privacy.
Unfortunately, there's no way to patch fingerprint ressistance into a compiled browser and even then nobody actually wants this because then cloudflare won't let you visit any web page.
The only way to get anti-fingeprinting would be to force it on everyone so that the tools that rely on it would be forced to respect the user. Considering that 2 major browsers are owned by mega corporations and 3rd one by a leech that just exists to leech billions from the first two we'll never actually defeat web fingerprinting until something absolutely catastrophic happens forcing everyone to start paying attention.
At least for now. Tried many browsers and Mullvad Browser and Konform Browser are the only two that I managed to beat them with. They both enforce bundled set of fonts like Tor Browser. Firefox and other forks are fingerprintable via variations in font rendering due to system fontconf or fonts differing.
I've been getting into making and breaking these antibots recently and it's funny to me how the person who wrote this post gave so much attention to what LinkedIn was doing and left the other antibots on the page as a footnote. They grab way more, they just don't let you see it. I haven't reversed PX or Recap yet but the antibot on twitch and Nike similarly checks if you have any of these 53 apps installed (when loaded on a WebKit browser) https://pastebin.com/raw/KACvjpTK
> The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify).
Many extensions designed to scrape data from social media websites are disguised as simple extensions that do something else.
If I had to guess: I sought that automatic content blurrer, neurodivergent website simplifier, or anti-Zionist tagger actually work. They’re all just piggybacking on trending topics to get users to install them and then forget about them, then they exfiltrate the data when you visit LinkedIn.
This. Do not install any extension unless you absolutely need. Assume they all leak your browsing data.
Not familiar with Google but if you can just vibe code your own extension then do that.
Sooner or later, yes. What stops it , other than layers of imperfect process? And it's the perfect vector to exploit anyone who doesn't review and understand the generated code before running it locally
If you mean by the website, then - surely not. What basis do you have to trust websites you visit? Especially a social network that owned by Microsoft to boot?
If you mean the _browser_, then I agree in principle, but - it is a browser offered to you by Alphabet. And they are known to mass surveillance and use of personal information for all sorts of purposes, including passing copies to the US intelligence agencies.
But of course, this is what's promoted and suggested to people and installed by default on their phones, so even if it's Google/Alphabet, they should be pressured/coerced into respecting your privacy.
There's an implicit trust that a site doesn't try to racially profile you, as it is illegal. There's no enforcement, but that's why trust is being violated.
It's probably not illegal for advertisers to racially profile you, but it certainly is illegal in the US to do those things as part of your hiring process:
LinkedIn's scanning for browser extensions used by protected groups allows them to provide illegal services to US-based recruiters. I have no idea if they actually do it or not, and am not a lawyer, but common sense suggests there's enough here for a class action suit to move into discovery.
These extensions sound like straight up malware anyway
LinkedIn scans for Anti-woke (“The anti-wokeness extension. Shows warnings about woke companies”), Anti-Zionist Tag (“Adds a tag to the LinkedIn profiles of Anti-Zionists”), Vote With Your Money (“showing political contributions from executives and employees”), No more Musk (“Hides digital noise related to Elon Musk,” 19 users), Political Circus (“Politician to Clown AI Filter,” 7 users), LinkedIn Political Content Blocker, and NoPolitiLinked.
Almost certainly they are using that for audience segmentation and ad targeting. Clever and disgusting. This isn't the invention of some evil moustache-twirling executive, this was the invention of an employee or group of employees who value money more than morals. We should think of such employees as henchmen.
if they do a better job at showing me an ad that might be relevant to me, how is that disgusting? if I have to see an ad at all I at least want them to give it their best shot
I cant believe that people still have the attitude that the trillions of dollars being invested in all this technology and tracking is just to give them a more relevant ad.
Do people really not remember scandals like Cambridge Analytica, and realise that these ads combined with social media feeds can be used to literally control and manipulate peoples decisions and behavoir?
Theres a reason Facebook and Youtube just got sued for being intentionally addictive attention machines.
You're glossing over the nuance of the Cambridge Analytica scandal or at least I don't see how it's connected here.
Facebook was a party, but not the protagonist.
- a Cambridge researcher (Aleks Kogan) created a personality quiz FB app advertised as academic research
- users had to consent to download the app
- the app nefariously scraped users' friends' data (300k users unlocked 87 million users' data)
- the information was sold to Cambridge Analytica
- who then used the information to profile American voters
LinkedIn already has all of this information from the information you feed it. Scanning for more information provides more refined views, but LinkedIn already has your graph.
> if they do a better job at showing me an ad that might be relevant to me, how is that disgusting?
To me that signalled that the author of the comment doesnt really care what is gonig on behind the scenes if the result is a better and more relevant ad.
I see this attitude often from people who dont seem to understand the severity and seriousness of online tracking which leads to psychological profiling which leads to manipulation.
> who then used the information to profile American voters
You seem to have missed off the most serious bit at the end.
Cambridge Analytica then used the data to profile millions of voters, and purposefully target divisive and flammable political material to specific suggestible people in order to manipulate outcomes.
This same thing is done all the time by all tracking and ad companies. I think this thread has gone beyond just LinkdIn scanning your browser extensions.
I agree that it could come off as gross negligence to not care about what happens with your data.
My point is that LinkedIn already has enough information (We've willingly given them!) to manipulate outcomes and if they're doing something nefarious, then it's already too late.
Whereas Cambridge Analytica involved bad actors (not Facebook) duping customers and re-selling their data. I don't think those elements are necessarily in play here.
I think I was just getting on my high horse at the fact that the whole internet ad machine is doing this terrible thing for society and nobody really seems to care that much.
This thread was more about Linkdin specifically scraping data instead of maniuplative ads, so apologies for derailing.
is the manipulation of decisions and behavior not just a way of saying sales and marketing? I agree that it def can be used for bad things, but so can most tools/systems
It's not just about ads. The same data and tech is also about locking you up and identifying you for deportation you if this admin thinks you are in the USA without permission.
And laundering responsibility. If the government uses a contractor to identify deportation candidates using this data, and they get it wrong, the government can at least try to shrug it off and blame the contractor, whose job is in part to absorb public outrage for these sorts of things. Whereas if the FBI wiretaps you and still gets it wrong, it's a lot harder to deflect blame.
Imagine if someone was following you around with a clipboard writing down everything you do, then rifling through your bookshelf to make note of certain books on the bookshelf, and then using that to target ads at you.
You'd say that's a ridiculous and illegal thing to do without you explicit consent, right?
Maybe you personally don't mind and would be happy to offer that consent. But they're doing it without your consent, regardless of whether you want it or not.
$$$, one of the classic bad faith motives. Most of tech nowadays is subsidized by advertising and profiling to some degree, often quite a large degree.
Aside from the fact that no one is asking for that, there is no law that prevents that ad targeting data from being sold to the government for the purposes of…whatever they want.
The claims made on the website linked here are plain wrong. The person behind them is subject to an account restriction for scraping and other violations of LinkedIn’s Terms of Service.
To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members’ consent or otherwise violate LinkedIn’s Terms of Service.
Here’s why: some extensions have static resources (images, javascript) available to inject into our webpages. We can detect the presence of these extensions by checking if that static resource URL exists. This detection is visible inside the Chrome developer console. We use this data to determine which extensions violate our terms, to inform and improve our technical defenses, and to understand why a member account might be fetching an inordinate amount of other members' data, which at scale, impacts site stability. We do not use this data to infer sensitive information about members.
For additional context, in retaliation for this website owner’s account restriction, they attempted to obtain an injunction in Germany, alleging LinkedIn had violated various laws. The court ruled against them and found their claims against LinkedIn had no merit, and in fact, this individual’s own data practices ran afoul of the law.
Unfortunately, this is a case of an individual who lost in the court of law, but is seeking to re-litigate in the court of public opinion without regard for accuracy.
All illegal or unethical means can be explained, but not justified, by their ends.
I'm quite sure having unfettered insight into the browser environments of your users makes enforcing your Terms of Service much easier, but held against the (even minute) risk of exposing one of users' political, religious or sexual preferences, any of which might carry with it massive risk of bodily injury or death in many parts of the globe? I'm sorry but ToS enforcement does not even begin to clear that bar.
If you don't want your users to scrape large parts your website, have you considered just blocking users with outsized traffic usage and not violating their privacy in the process?
Justifying this invasion of privacy as a means of defending LinkedIn against the apparently existential threat posed by something as pedestrian as scraping is especially ridiculous when considering how LinkedIn managed to even get off the ground in the first place: By invading the privacy of its unwitting users by scraping their contacts and impersonating them via email[1].
> To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members’ consent or otherwise violate LinkedIn’s Terms of Service.
What a nightmare! Are your findings and this list of malicious extensions published somewhere?
I look forward for you to post a rationale for the site reliably for these 6,000 extensions.
Not clear why it needs to scan for Amazon image downloaders, Rufus conversation extracters, Amazon delivery scheduler, Product Scanner, or pharmacy operations.
I have trouble trusting anything run by Microsoft, and in particular anything run by LinkedIn considering it is the absolute worst site that I have to use.
Microsoft has lied in the past about what information that they do and don't store, why should we believe you now?
Micrôsoft does indeed have a lofty and sturdy moral high ground from which to denounce scrapers and breaches of intellectual property rights and website TOS violations, having never invested in OpenAI.
This entire response is full of lies. Having done a cursory search of the extensions, you do target ones that are based on religious affiliation regardless of the DOM actions they take.
Your comment is disingenuous, insulting and has only served to make me check more extensions and only browse LinkedIn in a secure, private window.
The Bavarian Central Cybercrime Prosecution Office in Bamberg has opened a investigation into this matter (Case File No 650 UJs 2809/26) and I am sure they are interested in talking to you.
They would love to hear how this is all plain wrong.
All I'm seeing is that Chrome apparently is failing to properly sandbox websites against extension fingerprinting.
Sure, this can be solved at the legal layer, but in this case, there seems to be a much simpler and more effective technical solution, so why not pursue that instead?
Well, the developers of Chrome aren't exactly incentivized to prevent tracking (though perhaps tracking done by their competitors). But anyway, you can try to prevent it with a technical solution while also being outraged that they did it. If someone has their home broken into, perhaps they should have better locks, but the burglar is still responsible for their actions.
Chrome extensions can expose internal files to web pages through the web_accessible_resources field in their manifest.json. When an extension is installed and has exposed a resource, a fetch() request to chrome-extension://{id}/{file} will succeed. When the extension is not installed, Chrome blocks the request and the promise rejects.
This looks intentional enough that I wonder if there's a legit reason for it.
>the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch)
Why should a website be able to scan for extensions at all?
Or if there's a legitimate need (like linkedin.com wants to see if you installed the linkedin extension), leave it up to the extension to decide if it wants to reveal itself. The extension can register a list of URL patterns it will reveal itself to. So the linkedin extension might reveal itself only to *.linkedin.com, a language translation extension might reveal itself to everyone, and an adblocker extension might not choose to reveal itself to anyone.
extensions choose on which site they're active and if they provide any available assets (e.g. some extensions modify CSS of the website by injecting their CSS, so that asset is public and then any website where the extension is active can call fetch("chrome-extension://<extension_id>/whatever/file/needed.css" if it knows the extension ID (fixed for each extension) and the file path to such asset... if the fetch result is 404, it can assume the extension is not installed, if the result is 200 it can assume the extension is installed.
This is what LinkedIn is doing... they have their own database of extension IDs and a known working file path, and they are just calling these fetches... they have been doing it for years, I've noticed it a few years back when I was developing a chrome extension which also worked with LinkedIn, but back then it was less than 100 extensions scanned, so I just assumed they want to detect specific extensions which break their site or their terms of use... now it's apparently 6000+ extensions...
Fwiw... I now run personal and professional browser profiles from two different jails / cgroups. It's a pain in the arse to set up, and I have to verify my config still works after every update, but I get a good feeling knowing my personal chocolate is not mixing in with my professional peanut butter.
I set up the cgroups hack so I could route traffic from a dev profile into a VPS vpn, and may not be that useful for everyone.
But I think this is a reminder that you may want to have at least two profiles: one public and the other private. Do you really want Microsoft to know you installed the "Otaku Neko StarBlazers Tru-Fen Extendomatic" package to change every picture of a current political figure to an image from the cast of Space Battleship Yamato?
> I now run personal and professional browser profiles from two different jails / cgroups. It's a pain in the arse to set up, and I have to verify my config still works after every update
You may be interested in Qubes OS. My daily driver. Can't recommend it enough.
There is no reason to trust any big tech company. Folks should be using containers in their browser if they care about privacy. I previously published a LinkedIn container extension for FireFox: https://addons.mozilla.org/en-US/firefox/addon/linkedin-cont... although as many know you can achieve the same results with Firefox containers without a specific extension like mine if you configure it manually.
I will work on an improvement to that extension so that it can block these scans if they attempt them in firefox.
So these extensions allow linkedin to do this though, it's literally them saying "yes, this site can ping this resource" - called "web_accessible_resources".
This is fair from Linkedin IMO as I've seen loads of different extensions actually scraping the linkedin session tokens or content on linkedin.
> Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions.
It's not clear though, either they only tested against chrome-based browsers or Firefox isn't enabling them to do so.
edit: I answered before I go fully through the article but it does say it's only Chrome based.
> The extension scan runs only in Chrome-based browsers. The isUserAgentChrome() function checks for “Chrome” in the user agent string. The isBrowser() function excludes server-side rendering environments. If either check fails, the scan does not execute.
> This means every user visiting LinkedIn with Chrome, Edge, Brave, Opera, Arc, or any other Chromium-based browser is subject to the scan.
A lot of people mistakenly refer to Chromium-based browsers as being Chrome-based.
I feel like this is obvious and you know that this is the exact mistake being made, but rather than drop an actual correction, you take the insufferable approach of pretending you don't know what's happening and forming the correction as a question.
> A lot of people mistakenly refer to Chromium-based browsers as being Chrome-based
This seems to be a case where the poison seeps through the cracks. From Google and Chrome to other Chromium-based browsers. In very correct ways, in this case, they are Chrome based.
Because what they're scanning for is scrapers. So much linkedin scraping. And I'd bet that the majority of the innocuous-looking extensions are scrapers hidden as other extensions to get users to unknowingly use them.
Firefox uses randomised IDs for installed extensions, so the method highlighted won't work on Firefox. That's not to say they aren't trying other methods on Firefox.
> The “how it works” page suggests it only works on chrome based browsers. Anyone able to determine if firefox or safari are affected too?
The code filters out non-chrome browsers:
>The extension scan runs only in Chrome-based browsers. The isUserAgentChrome() function checks for “Chrome” in the user agent string. The isBrowser() function excludes server-side rendering environments. If either check fails, the scan does not execute.
It will sound like finessing on details, but details are important in these kind of claims, and this seems incorrect
> Microsoft has 33,000 employees and a $15 billion legal budget
Microsoft has more than 220k employees (it's hard to follow with all the layoffs), and the G&A in which bankrolls legal expenses (but not only - it also contains basically every employee who's not engineering or sales) was only 7B in 2025 - so legal budget is much lower than that.
I remember the LinkedIn app that got all your contacts from your phone and tried to add them to your network. I had random people from internet-deals (local craigslist) that where popping up. So strange that this was allowed.
> Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers
And thought, "no way in hell this gets by Safari."
And then, under "The Attack: How it Works":
> Every time you open LinkedIn in a Chrome-based browser
Shocker. If you use a Chromium-based browser, you should expect to be trading away your privacy, IME.
I know, I know, pretty terrible and all, but can we take a moment to appreciate we’re able to ship to every browser a script that does 6000+ fetches in parallel. Sure, doesn’t go through network stack, but still impressive how far JS has come in terms of efficiency .
A lot of extensions on LinkedIn are necessary because of their total lack of innovation. You really cannot do anything in B2B sales or recruiting with only LinkedIn tools. These are not random extensions, but crucial extensions literally saving billions of dollars in wasted time or creating massive opportunities in the global economy.
I wonder how much of this is also used for audience segmentation for their advertisements? Linkedin ads are some of the most expensive out of any social media platform, but they also tend to have the highest conversion since you can get pretty niche with your targeting.
If I understand this correctly, LinkedIn fingerprints your browser. And browsergate, now, shows how harmful this can be, combined with private data (like your job, full-name and ID) been sold to 3rd-party.
Companies are in it to make money, and if something is free, you're the product.
If you think about, to protect yourself: The EFF privacy badger browser add-on [1] try to block fingerprinting.
Also, browser fingerprints are a common tracking pattern nowadays. You can test [2] your browser and please start protect your self: E.g. use add-ons like U-Block and Privacy Badger to block tracking and/or use different browser and devices for different use cases. DNS-blocking with block-list like hegazi [3] is IMO the best option, but also a bit more involved, when you host you own DNS forwarder(s). For example AdGuard Home [4] helps you with hosting your own DNS infrastructure. It's also possible to add block-lists to dnsmasq or unbound and run them on you notebook as forwarders.
Despite the misleading headline, I really don't understand why anyone uses linkedin, there will inevitably be a trailing rely of comments claiming it has some irreplaceable value in professional networking, but I don't buy it. Nobody I've ever talked to has been able to articulate any actual value provided by "connecting" to another person on a social networking site. If you want to build professional connections go to lunch, join community calls, attend professional events, and go to conferences.
"allowed" by the web browser, but almost certainly not by the end user. The law is pretty clear on this in the US:
> 'the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;'
The problem, of course, is that by clicking on a LinkedIn link, you agree to a non-negotiated contract that can change at any time, and that you have never seen. If that weren't allowed, then this sort of crap would correctly be considered "unauthorized access":
https://browsergate.eu/how-it-works/: “Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions”
Well, they're able to do it; “allowed” to do it is an ambiguous enough phrasing that it's practically begging to have an argument whose crux is fundamentally about a differing interpretation.
If you hadn’t written that post using AI, it might’ve received more attention. Also, (1) if you’d put LinkedIn in the title, rather than the very bottom of the post, and (2) if you’d provided any insight, rather than just speculation, as to what the data might be being used for.
I have written something about Linkedin although not, about browser fingerprinting but certainly somewhat of an extremely bad experience with Linkedin.
Not sure if this counts but my post was actually sandwiched between two large Linkedin posts (the 2 tabs = 8 gb and now this) within the timing [0]
I always write things myself, even if they might take hours.
But I also believe that my post had overlapped with larger things of AI (OpenAI getting funded, Claude being leaked), I have seen some cool projects lately on Hackernews which aren't getting attention as all of that attention gets redirected to AI related news.
[0]: to be honest, I write things for myself firstly and I just upload them here for discussion related purposes, I am perfectly fine with my posts not reaching traction, because, I try to/wish to write for myself first and foremost :), Also within that Linkedin incident, In that case I just wrote things to get it off my chest really.
Thank you for that post, it describes the invasion of privacy at a deeper level. I must have missed it but YCombinator is filled with people with a vested interest in keeping the clown show going.
I don’t see this article showing that. They query for extensions that could be used to do that, and that likely already is illegal, but those queries could solely be used to uniquely identify users (grabbing more bits makes it less likely to get collisions)
Those being in the list doesn't mean that's what they're looking for. Take a look at the database of extensions, there's far more extensions that don't seem limited to any particular group. The author just called those out specifically because they're perfect for implying nefarious intent.
It does suggest that’s what they’re collecting. That is per se a violation in many jurisdictions. It should trigger investigations in most others to ensure it wasn’t mis-used.
The claim I replied to is “They try to profile for things like political beliefs”.
I wasn’t contesting that they query extensions that can be used for that purpose, or that they use query results for that purpose, but indicated that the fact that they make such queries doesn’t necessarily imply that they try to do such profiling.
>LinkedIn scans for Anti-woke (“The anti-wokeness extension. Shows warnings about woke companies”), Anti-Zionist Tag (“Adds a tag to the LinkedIn profiles of Anti-Zionists”), Vote With Your Money (“showing political contributions from executives and employees”), No more Musk (“Hides digital noise related to Elon Musk,” 19 users), Political Circus (“Politician to Clown AI Filter,” 7 users), LinkedIn Political Content Blocker, and NoPolitiLinked.
>Each of these extensions reveals a political position. If LinkedIn detects any of them, it has collected data revealing that person’s political opinions. Article 9 prohibits this.
This website was difficult to follow but I found that this page https://browsergate.eu/extensions/ was the most helpful to understand what they were talking about
Essentially, they are labelling you, like most do, but against some interesting profiles given the kinds of extensions they are scanning for
They really don't want people scraping their data with extensions. The LI API response is the worst tangled mess I've ever seen... It's so bad, I have to assume it's intentional. Took me 3 days to parse their responses. I had to build a special rules-based scraping engine which allows me to filter and map items layer by layer based the relative positions of those items with flexible rules. A bit like CSS selectors but more complicated.
The hard part is that some APIs return items in a different order or with different indentation so my engine normalizes all the variants into consistent objects.
It's quite impressive that LI works at all given the complexity.
> Every time you open LinkedIn in a Chrome[actually Chromium]-based browser
There's a reason I continue to use Firefox (with uBlock Origin) and will never switch.
Also, when I got laid off from a previous job, I made a LinkedIn profile to help find a new job. Once I found a new job, I haven't logged into LinkedIn since - that was almost 2 years ago.
I don't like any of this, but I'm not totally clear how this is substantially different from other fingerprinting technologies which I assume are used by every large tech company. Could anyone elaborate? The post isn't very clear why this is different from other data surveillance.
LinkedIn is far from the only actor doing this. Browser extension fingerprinting is not new. LinkedIn‘s size, scope, network effects make this especially concerning.
They have! It's these developers either not knowing or not caring about it which is the issue!
I did a blog post about this a while back showing how they do it, and how you can get around it, it's not very complex for the devs.
> Chrome have fortunately recently released a "extension side panel" mode, and since only DOM changes can be easily identified, using the chrome extension side panel would be virtually un-detectable however this is far less intuitive to use and requires the user to perform some action to open the sidepanel every time they want to use the extension.
As an end user I could not find an option to open the side panel
Yeah I mean it's not very commonly used by extensions. I quite like it as it's completely isolated and not detectable.
I built my first extension which uses it as the primary interface yesterday: https://github.com/Am-I-Being-Pwned/PGP-Tools
Yeah I agree. All new extensions should have this for their web_accessible_resources.
With that said, the chrome web store ecosystem has bigger problems infront of them. For example, loads of extensions outright just send every URL you visit (inc query params) over to their servers.
Things like this just shouldn't happen, imagine you installed an extension from a few years back and you forgot about it, that's what happened to me with WhatRuns, which also scraped my AI chats.
I'm working on a tool to let people scan their extensions (https://amibeingpwned.com/) and I've found some utterly outrageous vulnerabilities, widespread affiliate fraud and widespread tracking.
There's nothing to patch, scanning is not possible.
It's either the extension's choice to become detectable ("externally_connectable" is off by default) or it makes unique changes to websites that allow for its detection.
If it were just a matter of detecting changes to the DOM then this could only detect extensions that alter the LinkedIn website itself. I agree that would be much harder to make undetectable, but this seems like it goes beyond that.
As mentioned, there's a way to expose your extension to the web even without making changes. The other way is a key called "web_accessible_resources".
All of these are opt-in by the extensions and MV3 actually force you to specify which domains can access your extension. So, again, each extension must explicitly allow the web to find it.
Seems like it. Which is serious but far from what I thought when I read the title. I suspect 90% of LinkedIn users don't even have a single browser extension installed.
I would debate that. Most work computers have some extensions installed by default. That's millions of laptops. Ex. Snow Inventory Agent, ad blockers etc.
This is a good reminder of how much trust we implicitly place in every website we visit. Most people have no idea that a site can silently probe their browser environment while they're just trying to scroll their feed. Even if LinkedIn's intent is benign (fraud detection, fingerprinting), the lack of transparency is what makes it feel wrong. You shouldn't have to inspect network traffic to know what a website is doing with your data.
”American-Israeli cybersecurity firm.” Feels like a dogwhistle to people who don’t like Israelis. Hardly relevant if the cybersecurity firm is Israeli, Canadian or Australian.
Interesting. I didn't know a extension’s web-accessible resource (e.g. chrome-extension://<id>/...) could be abused to learn about the user's installed extensions by checking whether it resolves or not.
I want to know what power I have as just some guy to do anything about this? (even if just for myself)
I ask because it seems like every job I apply to asks for a linkedin profile, and I've heard floating around that if it's not filled in enough most employers assume you're a bot. Heck, one of the forms from the "who's hiring" thread yesterday straight up said if you have < 100 connections they'd throw out your application. So, in order to get my foot in the door, I need to hand over vast and intricate data about my personal life to a third party?
For you personally, to solve this issue in particular? Use Firefox. Google is evil, and there's a good chunk of the Chrome team who are actively enemy combatants.
For the broader issue of not wanting to give even the information you'd need to choose to share to LinkedIn? Network the good ol' fashioned way: talking to random strangers in San Francisco bars.
Everyone involved in Chrome's most questionable decisions such as Manifest V3's anti-adblocking, the Topics API, etc, are not just working orthogonal to the people's interest, they are directly working against it. I couched my statement down from the entirety of the Chrome team because I hesitate to label "making constant, marginal feature additions that ultimately result in anti competitive behavior" openly malicious.
Everyone from the suit that made the ultimate calls down to the lowest code monkey who bugfixed such features are responsible for their choice to target the good, common user of the internet. I'm not asking for altruism, I just think people shouldn't choose to do evil, and that those who do anyway should be recognized as such.
What's really weird about this list is what's not there.
I'm not seeing my spicy extensions (e.g. BPC), or the ones I use to block content on LinkedIn (ViolentMonkey, Ublock). So this isn't about detecting what they might deem as bad behaviour.
Nor could it be a fingerprinting thing, right? You'd want a full list for a full ID.
But they are checking out your religion. Deeply creepy.
"searching your computer" -> using standard web fingerprinting techniques. They don't actually get to read your home directory, and the authors should be honest about this!
Amazing work, but it’s not surprising, I think anyone in cybersec space knows that LinkedIn is the number one source of information when it comes to track or ID someone, and I don’t mean just OSINT given the real data you have, but also three letters agencies love it, it’s a gold mine, wasn’t the silkroad owner was busted because of the same personal email used on LinkedIn? So yeah, delete it, never use it, it’s full of corporate cringy nonsense anyway
I'm certain that if LinkedIn were confronted, that they could produce a response that says they are covered by the TOS you had to agree to in order to use the site. I don't have time to spend scanning legalease. Or make use of LinkedIn. If my system is being scanned, they'll see that I'm using a legitimate licensed copy of Windows 7 on a MODERN computer. If anything is at fault, it includes web browsers that Identify themselves to web sites.
This title should be changed as no court found this is illegal, and this is pretty standard, if extensive, browser fingerprinting, however disagreeable it is
I'm not convinced by their page explaining "Why it's illegal and potentially criminal" [0]. It's written by security researchers and non-attorneys.
For example, this characterization seems overly broad:
> The Court of Justice of the European Union has ruled, in three separate cases, that data which allows someone to infer or deduce protected characteristics is covered by this prohibition, regardless of whether the company intended to collect sensitive data.
Go check out QueryAllPackages permission on Android and see which of your apps can scan and know about all the other apps on your Phone. Thanks Google!
* Anti-Zionist Tag (directly inferring political opinion)
* PordaAI (Islamic content filter)
* simplify (browsergate.eu specifically called out as a neurodivergent accessibility tool. Job search autofill that markets itself as particularly useful for people who struggle with forms)
* No more Musk ("Hides digital noise related to Elon Musk")
* Political Circus ("Politician -> Clown AI Filter")
* Job application trackers and utils ("Job Follow-Up Tracker" etc)
* Various "Distraction Blocker" type addons
LinkedIn scanning for tools that scrape LinkedIn:
* LinkedIn Cookie Sync for Headhunting Agent
* LinkedIn Cookie importer for Derrick (lol "for Derrick")
* MailMatics Cookie Grabber
* LinkedIn Fake Job Post Detector. Yes, they're detecting an addon that exposes fake job postings on their own platform.
* Most privacy/security tools (no uBO, no Privacy Badger, no FoxyProxy, no NoScript, etc.
For the latter category, the most interesting things there we found *were* searched-for are BuiltWith Technology Profiler, and some browser addons bundled from scanners (e.g. "Malwarebytes Browser Guard Beta").
The Anti-Zionist tag is interesting. It seems that it's actually an extension that would be used by Zionists, as it identifies anti-zionists, and the wording incorrectly claims that anti-Zionism is hate speech (whereas it is in fact Zionism that is hate-based ideology).
A lot of Zionists claim -- incorrectly -- that all Jews as Zionists. But certainly the major groups of Zionists are Christian zionists and Jewish Zionists. I would say there is a very very high chance that if you use the Anti-zionist Tag Chrome extension, that you are Jewish.
So it seems quite likely that Linkedin is actually tracking Jews with this.
If you use both from the same IP without using a VPN… the profiles are most certainly grouped. There are commercial datasets on IP addresses with almost 100% accuracy with tags like “school”, “house”, “apartment block” etc. Furthermore, if you ever logged into both sites from within the same browser by accident, the link by fingerprinting was made right there and then. The final profile on you may not be 100% accurate, but certainly is in the 98% range.
It's one thing if they have a shadow profile on you (and dozens of companies almost certainly do), but it's another thing if you give them meaningful info about you to enrich that profile with. They can figure out roughly what block you live on, OK fine, but unless you're in a rural area with no neighbors they might not be able to do much better than that.
> They can figure out roughly what block you live on
Its nothing to do with the specific house you live in, and everything to do with the activity being grouped together with all other activity you have done, which they know from fingerprinting and IP addresses.
They dont need to know where you live to have a very accurate personal and psychological profile opn you, and switching browsers is not going to help that in the slightest Im afraid.
Yes and no. If you block Linkedin SDK scripts on 3rd party sites, it's likely that Linkedin specifically doesn't actually have a good profile on you.
Realistically you're probably exposed and identified. But if you're meticulous and careful, you might not be, or at least not as completely as someone who is unaware or not careful. But it's not at all the same as if, say, a state actor was motivated to spy on you specifically.
What's an optimistic future for Web fingerprinting? Currently, a website's ability to fingerprint the browser, the device, and the user is absolutely ridiculous.
DDG searches say this is something for linkedin.
- I had two tabs for linkedin open but left behind as I opened other tabs to research.
So I had not reopened these tabs in over 9 hours and they are still just humming along sucking down almost 10% of cpu and a couple gigs of ram for what?
This is firefox with ublock origin - quick searches saw malwarebytes browser guard considered it (protechts.net) malware for a bit and then took it off the list of things it blocked / warned about.
Not sure this is related to the scan mentioned, but it may be related to the overall concerns about data and unknown usage of resources.
I'm considering blocking this at the dns hosts level at this point.
Since the list of extensions they query targets certain religious groups and medical conditions, it's almost certainly in violation of US federal employment and hiring law.
LinkedIn also violates SPAM regulations on a regular basis. Despite of me having disabled all emails from this service I consistently receive promotional emails. LinkedIn defines a new "type of promotional email" for which it assumes it has implicit consent to send unsolicited emails and proceeds to do so. It then has a fake compliance apparatus by allowing the victim to once again "unsubscribe" from the newly created email subscription which they never consented to on the first place. I really hope there is a class action and these scumbags get fined.
There are a lot of browser extensions designed to create LinkedIn msgs using ai. You create a search list and it creates outbound and then you can deploy auto or review before sending. You can also then auto respond
How is it even possible that we've reached a point where "yes, this is obvious and pretty unsurprising" is the default response to spying on an industrial scale.
Not mine. And why do we say LinkedIn, it is just Microsoft, just like Github is Microsoft and a whole raft of other companies are just Microsoft in a trenchcoat.
You can guaranteed that this is a data protection and anti-scraping measure. I used to work with some recruiters and there are several third party recruiter tools that scrape linked in data to the third party sites database under the guise of supporting recruiters. I would rather this than having my LinkedIn data siphoned off other parts of the internet for god know what purpose.
LinkedIn is in a different category than your standard website or social site due to the amount of PII. I'm not saying it's right to scan your environment, but as someone with a LinkedIn account I would prefer they tried to protect my data than be lazy about it. You have more to worry about from Adobe's online tracking than LinkedIn checking your installed extension for scrapers.
I have uBlock installed, and it blocks these kinds of requests. However every request returns an error and they enter a constant request loop, causing the LinkedIn tab to slow down as the errors pile up after few minutes. Attached a screenshot [0] from DevTools.
LinkedIn has been overtly evil for decades, and their power users are the most insufferable sort of middle management yuppy scum. I know job searching can be hard, but I don't go near LinkedIn with a ten foot pole.
Sounds like containers and potentially adblocking and js blocking prevent this. For my part, I use linked in on my "god dammnit I hate corporate websites so much" browser which is used only for medical bill pay and amazon / wal mart purchases and then monthly bills. Could LinkedIn get something from me there? Potentially, but they're also not really following me around the web. I think given this I'll go install a 3rd browser for linkedin only, or maybe finally just delete my account. It never got me a job and it's a cesspool.
You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles.
Firefox with a non-default profile can be created like that:
./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/"
# For linkedin that would be:
./firefox -CreateProfile "linkedin /home/user/.mozilla/firefox/linkedin/"
And you can launch it like that:
./firefox -profile "/home/user/.mozilla/firefox/profile-dir/"
# For linkedin that would be:
./firefox -profile "/home/user/.mozilla/firefox/linkedin/"
So, given that /usr/bin/firefox is just a shell script, you can
- create a copy of it, say, /usr/bin/firefox-linkedin
- adjust the relevant line, adding the -profile argument
If you use an icon to run firefox (say, /usr/share/applications/firefox.desktop), you'll need to do copy/adjust line for the icon.
Of course, "./firefox" from examples above should be replaced with the actual path to executable. For default installation of Firefox the path would be in /usr/bin/firefox script.
So, you can have a separate profiles for something sensitive/invasive (linkedin, shops, etc.) and then you can have a separate profile for everything else.
And each profile can have its own set of extensions.
No it isn't.
Performing fingerprinting on user's devices, to ultimately profit of financially or worse is misleading. Especially doing this while knowing the user isn't aware what this really means and just deciding it for them.
The headline is just an exaggerated way of saying what is really happening.
This gave someone the opportunity to add in "Jeffery_Epstein_did_not_kill_himself" to linkedin's client facing code base through this.
If you open dev tools -> network tab -> network search icon (magnifying glass) -> search for "epstein" and load up linkedin, you should see it for yourself too!
I really don't think they're "illegally" searching your computer, they're checking for sloppy extensions that let linkedin know they're there because of bad design.
I am the one who published the findings at browsergate.eu and I think most of the debate here misses the point.
This is not about sandboxed or not. That's not the point.
The point is this is being done on a platform with 1 billion users with REAL NAMES, with REAL JOBS, working for REAL EMPLOYERS.
This is a privacy violation by every meaning of the term. But it is a lot more: It is the largest INDUSTRIAL ESPIONAGE operation I have ever heard of.
Literally every company on the planet (and every institution) have their employees browsers scanned for installed extensions. Some 200 are DIRECT COMPETITORS to Microsoft.
This is not about the behavior or a rando website trying to stop malicious actors.That's simply misses the point. By far.
linkedin is full of dark patterns, it's really unfortunate it became the business default, all other social platforms get more criticism while being only a fraction as bad
I hate the way they just started saying you have a new message when you really don't. Now I'm going to miss when I really have new messages for a while because I'm not going to go to that site anymore when they say that.
And not letting you read your messages when on your mobile phone unless you use their app is particularly mean. Considering again where they are sending all the information they scrape.
The real story is what's going on behind the scenes. The charges are relatively flimsy (for the reason I mentioned in my other comment). But here's the cool thing: the site is basically taken from Microsoft's playbook. For years, they pretty transparently bankrolled shadowy, single-issue "grassroots advocacy" groups that went after their competitors under flimsy pretenses. These organizations attacked others but somehow never had an opinion about stuff like Windows Copilot.
This feels very similar, except now it's taking a swing at Microsoft. It's apparently paid for by some mysterious "trade association and advocacy group for commercial LinkedIn users" that runs out of a private PO box in a small German town - uh huh. I'm not going to feel bad for Microsoft, but I would love to read some investigative reporting down the line.
I'm shocked, shocked to find that a Microsoft product will actively do a bunch of horrible invasive stuff while simultaneously not caring about security of this private data.
This is ridiculous click-bait, and it wouldn't surprise me if the main point was to just come up with a headline that would go viral and drive people to their website which conveniently has an option to donate to their "legal fund".
I mean, come on. Do I like that they are making use of browser fingerprinting? Not really. But to make it sound like they are "illegally" scanning my computer is ridiculous.
The fact that every job application wants a link to my profile on a platform that tries to push "brain training puzzle and games" on me just makes me angry every single time. I really hate LinkedIn and my active rebellion against it is hurting my ability to find a new job.
I know there has been other LinkedIn hate on HN this week. I know they have some good tools for job searching and hiring. I still wish we as a society could move on and leave this one with MySpace.
I removed my LinkedIn premium subscription because of this. It was always very suspicious and expensive so they were already on thin ice. This is unacceptable and LinkedIn crossed the line with yet another fascist social media platform.
If they are genuinely only using the information to detect bad actors and maintain site stability as the affidavit states, and if they can prove it, this seems like potentially a non-issue?
I am not a lawyer, but site stability seems like a GDPR "Legitimate Interest" in my book anyway.
The only explanation of linkedin being worth 44B is the prominent appearance of both bill gates (who started spending a day a week at MS after nadella became ceo), and reid hoffman appear prominently in epstein files. The deal itself was finalized during Trump's first term. So everything checks out
because corporate greed corrupts every nice thing: it pushes the other (maybe more moral) 'nice thing' alternatives out of the ecosystem by subsiding using VC funding to provide 'NiceThing!' for free until 'NiceThing!' is the monopoly or bought by another entity to become part of the monopoly (due to weak/not enforced antitrust laws).
Because we let them get away with it. Take something they're going to miss and can't replace (e.g. their freedom or their head) and it will stop as long as enforcement is reliable enough that they expect to get caught.
These aren't good people, but if you make the fine to the organisation much more expensive than the expected return, lock up the whole board and leave their families without a pot to piss in we will see this become the exception instead of the norm.
I get it — it can be frustrating to encounter so much low effort AI content these days. But I think it’s worth looking at the bright side here: the increase in our production of entropy from GPU consumption will hasten the heat death of the universe.
Would you like me to suggest some AI summarizer tools you could use to more efficiently read AI generated content in the meantime?
It might be normal language but lets say maybe 5% of real human blog writers use short punchy phrases like that. The noticeable problem is now its 50% of blog posts because almost every single AI authored post uses the same phrasing, it's tiring knowing you are just reading ChatGPT output. Its usually part of a low-effort funnel to guide you to some product/service.
The other replies have explained what's jumping out but I'd agree that without the other surrounding sentences of the article's introduction I'd be inclined to think that quoted sentence by itself might be human. The full text, however, doubles down on the AI-smelling constructions and IMHO almost certainly indicates some AI provenance.
Human journalists and marketing copy writers have been writing like this for at least 50 years, if not considerably longer.
I am exhausted by so many people calling writing out as AI without sufficient proof other than writing style. Some things are more obvious, sure... maybe I'm just too stupid to see a lot of the rest of it? But so much of what gets called out seems incredibly familiar to me compared with traditional print media I've been reading my entire life.
I'm starting to wonder if a lot of people just have poor literacy skills and are knee-jerk labeling anything that looks well written as AI.
I think one factor is the lack of variation. Sure, a copywriter might use those techniques as a hook, but there’s far more content using them paragraph after paragraph after paragraph than I’ve ever seen before.
You might also reframe how you read those comments. Perhaps when people are labeling a piece as “written by AI,” they’re just conveying that they perceive it to use the same “voice” that LLMs use, and judge that voice negatively. Sometimes people say things non-literally and don’t need proof.
You're right that (some) marketing copy writers have been writing in this style for decades, but suddenly every second tech blogger has assumed the same voice in the past 2 years. Not everyone is as sensitive to it. I read this crap daily so I've developed an awareness and I'm confident in calling it out.
I don't think I've personally seen a single false positive on HN. If anything, too much slop goes through uncontested.
> If anything, too much slop goes through uncontested.
It's actually insane opening up /r/webdev and similar subreddits and seeing dozens of AI authored posts with 50+ comments and maybe a single person calling it out. Makes me feel crazy. It's not as much of a problem here, but there is absolutely a writing style that suddenly 50% of submissions are using. It's always to promote something and watching people fall for it over and over again is upsetting.
Reading (and even more so, using the tools to produce) a bunch of LLM-output writing also affects one’s writing style. Ever sat down and blown through 3-4 books by a favorite author, then written something and found yourself using similar structure, word choice, style…? This could very well be a human author that’s been exposed to a lot of LLM output (ie 95% of this site’s audience).
I find myself doing this a lot, and I’m sure even more slips without my notice.
I agree that that line reads GPT-like, but it's far from a conclusive tell. One option that I wonder about is if frequent interaction with AI will begin to influence people's organic writing style.
The OP's complaint is literally about a one-sentence paragraph, the second in the article. Plenty of warning to avoid the rest and move on, but LLM shaming is it's own reward perhaps?
How is that quote in any way demonstrative of this being written by LLM? You do know that LLMs were trained on the internet and every digitized text they could get their hands on? You are jumping at shadows, calm down already.
LinkedIn is definitely one of the most by far worse companies I have had to ever interact with.
Literally 2 days ago, I submitted a post: LinkedIn "final decision", restricting my account and making me feel unheard[0] explaining all of some of the worst customer support I have seen
I wish to give a TLDR, but essentially Linkedin will simply reject your account or give you immense headache if your id's aren't being detected by persona (persona is a really shady-company in it of itself with really not the best security practices) I actually lost count of how many times their customer support just responded with a bland message and just didn't even read my message
This is why, being frustrated out of all of this, I actually sent a linkedin customer support message that I don't feel heard, I want to be heard by human, so if you are a human especially when they were asking ME to go to a public notary to sign an affadavite to get a 1 day old restricted Linkedin account (oh btw, its also illegal for a minor to sign an public notary in my country the way they mentioned and I mentioned it about as many times as I could and that I am willing to share my ID like Aadhaar to them but they genuinely don't hear your messages)
Honestly, my experience just says that there is no human customer support in Linkedin, its really a customer support nightmare worse than even some of the telecom horror stories. Perhaps I should contact browsergate.eu if my incident within my country can also be a case of legality or not, essentially I was cooperating with them to give any document that I can reasonably provide but linkedin forms and everything redirect to 404 as well.You can read my experience in depths but my experience really shows me as to Linkedin customer support being so unhelpful that you question how a company can be so bad. I wish for more ethical alternatives to Linkedin and its nightmare to appear within this space.
(I also had a minor idea of asking Linkedin support to see if they read my messages and literally as I told them that I feel unheard, I would like it if they can make me feel heard and that they are reading my messages so If they are actually reading my message, then respond to me with value of 351/13 and I asked the person who joined Linkedin as to why they joined Linkedin, essentially just one line would suffice to know if I am talking to human or not, they did not respond to any of this and essentially, as far as I can tell, pasted another pre-generated response not hearing me)
Several years ago I heard the company I worked for say they had a way to get notified if it seemed like an employee might be thinking of leaving, so they could take some kind of action. I now wonder if LinkedIn, or various job sites, were selling them data.
LinkedIn might not need to sell the data. You can set your profile to “open for work” privately, and only recruiters can see it. So if your company has people with LinkedIn recruiter accounts, they could see your profile set to looking for work
PS: I guess given that recruiter accounts are paid, LinkedIn is technically selling access to the data in a way
It is pretty easy to signal stuff on linkedin without intending to do so. For example whenever I get an old coworker adding me on linkedin, they are 100% of the time job seeking. Inevitably they start a new role some weeks later.
All one has to do is just measure employees linkedin activity. I mean truthfully people don’t use the site at all if they aren’t actively looking for work. It is corporate dystopia otherwise. It is trivial to find these signals.
Are you kidding? They've probably been selling a datastream of who in the company has been job searching to company HR departments the whole time. Search for a job on LinkedIn and I bet anybody with a paid corporate account can find that out if they care to.
LinkedIn actually sued HiQ Labs, which scraped LinkedIn to do exactly this (and this extensions scanning is likely a defense mechanism against similar attacks):
> HiQ has created two specific data products targeted at employers: (1) “Keeper,” which informs employers which of their employees are at “risk” of being recruited by competitors; and...
In any case, this lawsuit was discussed a few times on HN at the time, and IIRC there were a fair bit of support for allowing free scraping of "public information." Interesting how the sentiment here has turned these days...
Exactly how is it "illegal" to run code that exercises some aspect of the legitimate browser API surface? Are there functions marked as legal, and others marked as illegal?
The headline seems pretty misleading. Here’s what seems to actually be going on:
> Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers.
This does seem invasive. It also seems like what I’d expect to find in modern browser fingerprinting code. I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).
I’m certainly not endorsing it, do think it’s pretty problematic, and I’m glad it’s getting some visibility. But I do take some issue with the alarmist framing of what’s going on.
I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.
How is probing your browser for installed extensions not "scanning your computer"?
Calling the title misleading because they didn't breach the browser sandbox is wrong when this is clearly a scenario most people didn't think was possible. Chrome added extensionId randomization with the change to V3, so it's clearly not an intended scenario.
> vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”)
They chose to put that particular extension in their target list, how is it not sinister? If the list had only extensions to affect LinkedIn page directly (a good chunk seem to be LinkedIn productivity tools) they would have some plausible deniability, but that's not the case. You're just "nothing ever happens"ing this.
> How is probing your browser for installed extensions not "scanning your computer"?
I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate.
But this is not happening. What actually is happening is still a problem. But the hyperbole undermines what they’re trying to communicate and this is why I objected to the title.
> They chose to put that particular extension in their target list, how is it not sinister?
Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible.
If we step back for a moment and ask the question: “I’ve been tasked with building a unique fingerprint capability to combat (bots/scrapers/known bad actors, etc), how would I leverage installed extensions as part of that fingerprint?”
What the article describes sounds like what many devs would land on given the browser APIs available.
To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed.
But the authors have chosen to frame this in language that is hyperbolic and alarmist, and in doing so I thing they’re making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.
> What the article describes sounds like what many devs would land on given the browser APIs available.
> To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed.
These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects. What the article describes should not be "what many devs would land on" naturally. What many devs should land on is "scanning the user's browser in order to try to fingerprint him without consent is wrong and we cannot do it."
To put it more extreme: If a developer's boss said "We need to build software for a drone that will autonomously fly around and kill infants," The developer's natural reaction should not be: "OK, interesting problem. First we'll need a source of map data, and vision algorithm that identifies infants...." Yet, our industry is full of this "OK, interesting technology!" attitude.
Unfortunately, for every developer who is willing to draw the line on ethical grounds, there's another developer waiting in the recruiting pipeline more than willing to throw away "doing the right thing" if it lands him a six figure salary.
I completely agree.
Fighting against these kinds of directives was a large factor in my own major burnout and ultimately quitting big tech. I was successful for awhile, but it takes a serious toll if you’re an IC constantly fighting against directors and VPs just concerned about solving some perceived business problem regardless of the technical barriers.
Part of the problem is that these projects often address a legitimate issue that has no “good” solution, and that makes pushing back/saying no very difficult if you don’t have enough standing within the company or aren’t willing to put your career on the line.
I’d be willing to bet good money that this LinkedIn thing was framed as an anti-bot/anti-abuse initiative. And those are real issues.
But too many people fail to consider the broader implications of the requested technical implementation.
Oh yeah. Must be an anti-fraud/child abuse/money laudering/terrorism/fake news thing. All real problems with no known good solution (to my knowledge, please prove me wrong).
Edit: typos
> These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects.
One reason your boss is eager to replace everyone with language models, they won’t have any “ethical backbone” :’)
Many developers overestimate their agency without extremely high labor demand. We got a say because replacing us was painful, not because of our ethics and wisdom. Without that leverage, developers are cogs just like every other part of the machine.
No-one replaced developers when we got IDEs and CIs and such. We just produced more software faster.
Same with LLMs. This is a race. Competent people are in demand.
You can't actually push back as an IC. Tech companies aren't structured that way. There's no employment protection of any kind, at least in the US. So the most you can do is protest and resign, or protest and be fired. Either way, it'll cost you your job. I've paid that price and it's steep. There's no viable "grassroots" solution to the problem, it needs to come from regulation. Managers need to serve time in prison, and companies need to be served meaningfully damaging fines. That's the only way anything will get done.
> There's no viable "grassroots" solution to the problem
Does something like running the duckduckgo extension not help?
I'm hoping the Ladybird project's new Web browser (alpha release expected in August) will solve some issues resulting from big tech controlling most browers.
Yes, that might be good. I use Firefox with the dog plugin, and Proton login aliases, and hope for the best.
> There's no viable "grassroots" solution to the problem, it needs to come from regulation. Managers need to serve time in prison,
No, yes
Yes, giving these people short (or long, mēh) prison sentences is the only thing that will stop this.
No, the obvious grassroots response is to not use LinkedIn or Chrome. (You mean developers not consumers, I think. The developers in the trenches should obey if they need their jobs, they are not to blame. It is the evil swine getting the big money and writing the big cheque's...)
Yes, what I meant was there's no way ICs will change any of this. Using this or that extension, or choosing not to use some service won't really change anything either. The popular appetite just isn't there. Personally I use a variety of adblockers and haven't had a linkedin or anything for many years, but I fully accept that's an extremist position and most consumers will not behave that way. The only way these companies' behavior will improve is when they are meaningfully, painfully punished for it. There's very little we as consumers or ICs can do until then. Unless of course their risk management fails and they alienate a sufficiently large number of users that it becomes "uncool" to use the product. But all we need to do is look to twitter to see just how bad it'll get before then...
> The popular appetite just isn't there.
Cory Doctorow, if he is to believed, states 50% of web users use ad blockers. So maybe?
I integrate these kinds of systems in order to prevent criminals from being able to use our ecommerce platform to utilize stolen credit cards.
That involves integrating with tracking providers to best recognize whether a purchase is being made by a bot or not, whether it matches "Normal" signals for that kind of order, and importantly, whether the credit card is being used by the normal tracking identity that uses it.
Even the GDPR gives us enormous leeway to do literally this, but it requires participating in tracking networks that have what amounts to a total knowledge of purchases and browsing you do on the internet. That's the only way they work at all. And they work very well.
Is it Ethical?
It is a huge portion of the reason why ecommerce is possible, and significantly reduces credit card fraud, and in our specific case, drastically limits the ability of a criminal to profit off of stolen credit cards.
Are people better off from my work? If you do not visit our platforms, you are not tracked by us specifically, but the providers we work with are tracking you all over the web, and definitely not just on ecommerce.
Should this be allowed?
No, credit card companies should be made to develop robust solutions to protect themselves from cards being able to be stolen. It's not like secure authentication isn't a relatively solved problem. They've obviously managed to foist the problem on you and make you come up with shitty solutions. But that's bad.
What I'm wondering is if this requires sending the full list of extensions straight to a server (as opposed to a more privacy-protecting approach like generating some type of hash clientside)?
Based on their privacy policy, it looks like Sift (major anti-fraud vendor) collects only "number of plugins" and "plugins hash". No one can accuse them of collecting the plugins for some dual-use purpose beyond fingerprinting, but LinkedIn has opened themselves up to this based on the specific implementation details described.
The SOP of this entire industry is "Include this javascript link in your tag manager of choice", and it will run whatever javascript it can to collect whatever they want to collect. You then integrate in the back end to investigate the signals they sell you. America has no GDPR or similar law, so your "privacy" never enters the picture. They do not even think about it.
This includes things like the motion of your mouse pointer, typing events including dwell times, fingerprints. If our providers are scanning the list of extensions you have installed, they aren't sharing that with us. That seems overkill IMO for what they are selling, but their business is spyware so...
On the backend, we generally get the results and some signals. We do not get the massive pack of data they have collected on you. That is the tracking company's prime asset. They sell you conclusions using that data, though most sell you vague signals and you get to make your own conclusions.
Frankly, most of these providers work extremely well.
Sometimes, one of our tracking vendors gets default blackholed by Firefox's anti-tracking policy. I don't know how they manage to "Fix" that but sometimes they do.
Again, to make that clear, I don't care what you think Firefox's incentives are, they objectively are doing things that reduce how tracked you are, and making it harder for these companies to operate and sell their services. Use Firefox.
In terms of "Is there a way to do this while preserving privacy?", it requires very strict regulation about who is allowed to collect what. Lots of data should be collected and forwarded to the payment network, who would have sole legal right to collect and use such data, and would be strictly regulated in how they can use such data, and the way payment networks handle fraud might change. That's the only way to maintain strong credit card fraud prevention in ecommerce, privacy, status quo of use for customers, and generally easy to use ecommerce. It would have the added benefit of essentially banning Google's tracking. It would ban "Fraud prevention as a service" though, except as sold by payment networks.
Is this good? I don't know.
Mandating that tracking for anti-fraud be vertically integrated with the payment network seems unnecessary. Surely the law could instead mandate the acceptable uses of such data? The issue at present appears to be the lack of regulation, not scofflaws.
I'm not convinced tracking is the only or even a very good way to go about this though. Mandating chip use would largely solve the issue as it currently stands (at least AFAIK). The card provider doing 2FA on their end prior to payment approval seems like it works just as well in practice.
At this point my expectation is that I have to do 2FA when first adding a new card to a platform. I'm not clear why they should need to track me at that point.
> Even the GDPR gives us enormous leeway to do literally this, but it requires participating in tracking networks that have what amounts to a total knowledge of purchases and browsing you do on the internet. That's the only way they work at all.
That data sounds like it would be very valuable.
But I think if I sell widgets and a prospective customer browsers my site, telling my competitors (via a data broker) that customer is in the market for widgets is not a smart move.
How do such tracking networks get the cooperation of retailers, when it’s against the retailers interests to have their customers tracked?
I suspect a lot of retailers simply aren’t aware that that data is being collected and sold off to their competitors (or to ad networks so their competitors can poach their audience)
They get demographic data on their customers and can use that for marketing and setting prices.
[dead]
[dead]
> These two sentences highlight the underlying problem: Developers without an ethical backbone, or who are powerless to push back on unethical projects. What the article describes should not be "what many devs would land on" naturally. What many devs should land on is "scanning the user's browser in order to try to fingerprint him without consent is wrong and we cannot do it."
I think using LinkedIn is pretty much agreeing to participate in “fingerprinting” (essentially identifying yourself) to that system. There might be a blurry line somewhere around “I was just visiting a page hosted on LinkedIn.com and was not myself browsing anyone else’s personal information”, but otherwise LinkedIn exists as a social network/credit bureau-type system. I’m not sure how we navigate this need to have our privacy while simultaneously needing to establish our priors to others, which requires sharing information about ourselves. The ethics here is not black and white.
The difference is between the data you give out voluntarily and what is taken from you without consent
If you voluntarily visit my website and my web server sends a response to your IP address, have I “taken” your IP address, or did you give it to me “voluntarily”? What if I log your IP address?
One works for money. And money is important. Ethics isn’t going pay mortgage, send kids to university and all that other stuff. I’m not going to do things that are obviously illegal. But if I get a requirement that needs to be met and then the company legal team is responsible for the outcome.
In short, you are not going to solve this problem blaming developer ethics. You need regulation. To get the right regulation we need to get rid of PACs and lobbying.
You are transfering moral agency from yourself, to the government.
Will you do the same for your kids ? WOuld you let the government decide for you whats right, and what's wrong ?
Regulation does not necessarily need to be about deciding what's right and what's wrong. It's about making life better for people. That's supposed to be why we have government. If they are not improving people's lives, why do we even have them? Too many people see the government doing nothing to improve their lives and think there's totally nothing wrong with that.
I fail to see how some of the octogenarians in DC, who are making a kiling for decades in trading on market moves that they initiate/regulate themselves, are making life better for your family, or mine.
Because at least half the country thinks that government can't/shouldn't help them, and reliably votes for people who can't/won't make their lives better. We get the government we vote for, and too many people think the government's job is to grief people.
> You are transfering moral agency from yourself, to the government
That is the deal in a state based society. There are alternatives, but are you ready for Council Communism and it's ilk?
> WOuld you let the government decide for you whats right, and what's wrong ?
Yes, in a state based society
In a state based society fight for democracy and civil rights. Freedom must be defended
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself.
Yes, but I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox. The fact that there's no getAllExtensions API is deliberate. The fact that you can work around this with scanning for extension IDs is not something most people know about, and the Chrome developers patched it when it became common. So I don't think describing it as something everybody would expect is totally fine and normal for browsers to allow is correct.
> I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox
I think that’s a far more reasonable framing of the issue.
> I don't think describing it as something everybody would expect is totally fine and normal for browsers to allow is correct.
I agree that most people would not expect their extensions to be visible. I agree that browsers shouldn’t allow this. I, and most privacy/security focused people I know have been sounding the alarm about Chrome itself as unsafe if you care about privacy for awhile now.
This is still a drastically different thing than what the title implies.
> Yes, but I also think that most people would interpret "Getting a full list of all the Chrome extensions you have installed" as a meaningful escape/violation of the browser's privacy sandbox.
I don't think so, because most people understand that extensions necessarily work inside of the sandbox. Accessing your filesystem is a meaningful escape. Accessing extensions means they have identification mechanisms unfortunately exposed inside the sandbox. No escape needed.
It's extremely unfortunate that the sandbox exposes this in some way.
Microsoft should be sued, but browsers should also figure out how to mitigate revealing installed extensions.
Y'all are letting "most people" carry an awful lot of water for this scummy behavior here.
In my experience, most people - even most tech people - are unaware of just how much information a bit of script on a website can snag without triggering so much as a mild warning in the browser UI. And tend toward shock and horror on those occasions where they encounter evidence of reality.
The widespread "Facebook is listening to me" belief is my favorite proxy for this ... Because, it sorta is - just... Not in the way folks think. Don't need ears if you see everything!
> The widespread "Facebook is listening to me" belief is my favorite proxy for this ... Because, it sorta is - just... Not in the way folks think. Don't need ears if you see everything!
Getting folks to install “like” and “share” widgets all over their websites was a genius move.
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself.
That is exactly how I interpreted it, and that is why I clicked the link. When I skimmed the article and realized that wasn't the case, I immediately thought "Ugh, clickbait" and came to the HN comments section.
> To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed.
100% Agree.
So, in summary: what they are doing is awful. Yes, they are collecting a ton of data about you. But, when you post with a headline that makes me think they are scouring my hard drive for data about me... and I realize that's not the case... your credibility suffers.
Also, I think the article would be better served by pointing out that LinkedIn is BY FAR not the only company doing this...
[dead]
But LinkedIn is the one social network many people literally cannot escape to put food on the table.
I don't care about how much spying is going on in ESPN. I can ditch it at the shadow of a suspicion. Not so with LinkedIn.
This is very alarming, and pretending it's not because everyone else does it sounds disingenuous to me.
That sounds problematic and is only supported by people mindlessly agreeing to it. I know someone who got jobs at google and apple with no linkedin, and he wasn't particularly young. What do you do in the face of it? I say quit entirely. It was an easy decision because I got nothing out of it during the entire time I was on it.
I have heard people say that LinkedIn was vital to their career.
For myself, I agree with you: one should quit (and I will)
After getting laid off at age 52 (2nd time, 1st time day after my 50th birthday, took an inter-company transfer), and searching for a year, applying to maybe 5-10 companies a week, I got my current job (2 years+) through a random LinkedIn button.
You can also just browse LinkedIn with a browser that doesn’t have extensions installed, if privacy is that important to you.
Like everyone else on this thread, I’m not condoning it or saying it’s a good thing, but this post is an exaggeration.
yeah yeah or we can do it from a contained virtual environment over VPN etc
it is a different angle of looking at this issue, and kind of shifts responsibility from their shitty practices over to us users
slippery slope approach, as we can see everywhere, this leads to more and more of such
I don't know I just started mocking everything and anything in there, its wall of shite and AI slop predominantly anyways, so why bother
> Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible.
To take a step back further: what you're saying here is that gathering more data makes it less sinister. The gathering not being targeted is not an excuse for gathering the data in the first place.
It's likely that the 'naive developer tasked with fingerprinting' scenario is close to the reality of how this happened. But that doesn't change the fact that sensitive data -- associated with real identities -- is now in the hands of MS and a slew of other companies, likely illegally.
> But the authors have chosen to frame this in language that is hyperbolic and alarmist, and in doing so I thing they’re making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.
The article is not hyperbolizing by exploring the ramifications of this; and it's true that this sort of tracking is going on everywhere, but neither is it alarmist to draw attention to a particularly egregious case. What wrong things does it focus on?
> The gathering not being targeted is not an excuse for gathering the data in the first place.
I’m not saying it is. My point is that they appear to be trying to accomplish something like getInstalledExcentions(), which is meaningfully different from a small and targeted list like isInstalled([“Indeed.com”, “DailyBibleVerse”, “ADHD Helper”]).
One could be reasonably interpreted as targeting specific kinds of users. What they’re actually doing to your point looks more like a naive implementation of a fingerprinting strategy that uses installed extensions as one set of indicators.
Both are problematic. I’m not arguing in favor of invasive fingerprinting. But what one might infer about the intent of one vs. the other is quite different, and I think that matters.
Here are two paragraphs that illustrate my point:
> “Microsoft reduces malicious traffic to their websites by employing an anti-bot/anti-abuse system that builds a browser fingerprint consisting of <n> categories of identifiers, including Browser/OS version, installed fonts, screen resolution, installed extensions, etc. and using that fingerprint to ban known offenders. While this approach is effective, it raises major privacy concerns due to the amount of information collected during the fingerprinting process and the risk that this data could be misused to profile users”.
vs.
> “Microsoft secretly scans every user’s computer software to determine if they’re a Christian or Muslim, have learning disabilities, are looking for jobs, are working for a competitor, etc.”
The second paragraph is what the article is effectively communicating, when in reality the first paragraph is almost certainly closer to the truth.
The implications inherent to the first paragraph are still critical and a discussion should be had about them. Collecting that much data is still a major privacy issue and makes it possible for bad things to happen.
But I would maintain that it is hyperbole and alarmism to present the information in the form of the second paragraph. And by calling this alarmism I’m not saying there isn’t a valid alarm to raise. But it’s important not to pull the fire alarm when there’s a tornado inbound.
> But what one might infer about the intent of one vs. the other is quite different, and I think that matters.
That's where we disagree: intent doesn't matter here, because the intent of the person gathering the data is not the same as those who have access to the data. I don't care if the team tasked with implementing this believed they were saving the world, because once this data is in the hands of a big corporation, in perpetuity, and the thousands of people that entails, and it diffuses across advertisers and governments, be it through leaks, backroom deals, or perfectly above-board operations, it makes no difference how it got there.
The two paragraphs given:
> “Microsoft reduces malicious traffic to their websites by employing an anti-bot/anti-abuse system that builds a browser fingerprint consisting of <n> categories of identifiers, including Browser/OS version, installed fonts, screen resolution, installed extensions, etc. and using that fingerprint to ban known offenders. While this approach is effective, it raises major privacy concerns due to the amount of information collected during the fingerprinting process and the risk that this data could be misused to profile users”.
vs.
> “Microsoft secretly scans every user’s computer software to determine if they’re a Christian or Muslim, have learning disabilities, are looking for jobs, are working for a competitor, etc.”
The latter is the tangible effect of the former. The two aren't mutually exclusive, and considering the former has long gone unaddressed in its most charitable form, it only makes sense to use a particularly egregious example of it taken to its natural conclusion to address in courts and the public consciousness.
Calling out the fingerprinting users' extensions is not hyperbolic. Defending that action is.
Calling out the fingerprinting of extensions is appropriate and can be achieved without hyperbole.
As I’ve stated clearly throughout this thread, the fingerprinting they’re doing is a problem.
Calling it “searching your computer” is also a problem.
> Defending that action is
Nowhere have I defended what LinkedIn is doing.
It's `searching your computer`, period. The extensions are part of my computer. They don't exist in my refrigerator.
> Nowhere have I defended what LinkedIn is doing.
Yep. You feel the same taste of your own. You are accusing the site being hyperbole and alarmism. I'm accusing you being defendant of linkedin.
It is equally “searching your home network” as it is “searching your computer”. This is not searching your computer. It is searching your browser. Being contained to the browser is completely different than having access to the OS behind the browser.
The issue here is that even if the original goal is the first thing, once you have the data you can do that second thing. From where we stand, nothing changes - same information is collected. But now, it's also used for affinity targeting or worse.
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself.
Which they would, if they could.
They are scanning users' computers to the maximum extent possible.
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate.
But at the end of the day, the browser is likely where your most sensitive data is.
> Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible.
If that's all it takes to fool you then its pretty trivial way to hide your true intentions.
> making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.
No, LinkedIN has much more sensitive data already. Combined with which the voracious fingerprinting, this stands out as a particularly dystopian instance of surveillance capitalism
When "the browser is the OS", scanning that is a pretty big chunk of "your computer".
but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough.
If it has the ability to scan your bookmarks, or visited site history, that would lend more credence to using the term "computer".
The title ought to have said "linkedIn illegally scans your browser", and that would make clear what is being done without being sensationalist.
Extensions are files installed on your computer, though?
So are fonts. But running Window.queryLocalFonts() is not equivalent to “illegally searching your computer”.
I’m not defending the act of scanning for these extensions, and I’m of the opinion that such an API shouldn’t even exist, but just pointing out that there are perfectly legitimate APIs that reveal information that could be framed as “files installed on your computer” that are clearly not “searching your computer” like the title implies.
it doesn't have to be files. it could be in memory on the browser. Extensions don't imply files for anyone but the most technical of conversations. Certainly not to the laymen.
Having sensationalist titles should be called out at every opportunity.
> it doesn't have to be files. it could be in memory on the browser.
How'd that work? If it's in memory, the extensions would vanish everytime I shutdown Chrome? I'll have to reinstall all my extensions again everytime I restart Chrome?
Have you seen any browser that keeps extension in memory? Where they ask the user to reinstall their extensions everytime they start the browser?
I'm just using it as a possible example. There's also tampermonkey which installs not via files but via urls from another site.
The point is to call out the sensationalism in the title.
Reminds me of https://xkcd.com/1200/
But it's not getting access to real user data, just a partial list of things that are installed.
> but the language of "your computer" implies files on your computer, as it would be what people commonly call it. Merely just the extension is not enough.
But the language of "your computer" also implies software on your computer including but not limited to Chrome extensions.
It implies more than just the browser, which is likely why it was used for the post title. If it is exclusively limited to the browser, then "scans your browser" is more correct, and doesn't mislead the reader into thinking something is happening which isn't commonplace on the internet.
Are you defending LinkedIn’s behavior right now or are you just happy to be more technically correct (the best kind of correct!) than those around you? Trying to understand the angle
The browser fingerprinting described is ubiquitous on the internet, used by players large and small. There are even libraries to do this.
Like OP, I don't consider behavior confined to the browser to be my computer. "Scans your browser" is both technically correct and less misleading. "Scans your computer" was chosen instead, to get more clicks.
Something may be bad, but accurately describing why it is bad significantly elevates the discourse.
Eg, someone could use the phrase "Won't someone think of the children?" to describe a legitimately bad thing like bank fraud, but the solutions that flow from the problem that "children are in danger" are significantly different from the solutions that flow from "phishing attacks are rampant".
The two issues in this case aren't quite as different as child-endangerment and bank fraud. But if the problem was as the original title describes, the solution is quite different (better sandboxing) than what the actual solution is. Which I don't know, but better sandboxing ain't it.
So technically correct. Got it
attacking people for having more nuance and accuracy than you have is how polarization and tribal epistemology happens
'ignore the facts! ENEMY!!!' generally doesn't end well for anybody
[dead]
And I spend a lot of my time at home on my computer. The article should have said LinkedIn is searching my house.
This is just the next iteration of the issues with Linux file permissions, where the original threat model was “the computer is used by many users who need protection from each other”, and which no longer makes much sense in a world of “the computer is used by one or more users who need protection from each other and also from the huge amounts of potentially malicious remote code they constantly execute”.
It looks like it's also gathering info on your OS and graphics card which seems very much "your computer"
Scanning your computer is an entirely different thing than scanning browser extensions. By maximizing the expectation via "Illegally searching your computer", the truth suddenly appears harmless.
Where do browser extensions exist? I've got a dreadful feeling they might be on my computer.
Similarly, CSS font fallbacks are when websites break into your computer and steal your data, just because their font didn’t load!
>Where do browser extensions exist? I've got a dreadful feeling they might be on my computer.
all of the browser extensions I'm aware of are on planet earth, so i guess you'd have it linkedin is searching the planet for your browser extensions?
>Calling the title misleading because they didn't breach the browser sandbox is wrong
By this logic we could also say that LinkedIn scans your home network.
Websites could scan your local network covertly up until a few years ago; now it requires explicit permission (like notifications, location, etc)
XSS never a thing in your world?
I personally think its misleading and even when you start reading the page it links to is even more misleading in my opinion.
>Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm.
When I read that, I think they have escaped the browser and checking which applications I have installed on my computer. Not which plugins the browser has in it. Just my 2cents.
>How is probing your browser for installed extensions not "scanning your computer"?
The same way taking a photo of a house from the street is not the same as investigating the contents of your pantry.
Because "scanning your computer" technically could include scanning plugins, but it could also include scanning your files, your network or your operating system.
While "scanning your browser" would be more accurate and would exclude the interpretation that it scans your files.
The reason the latter is not used is that, even though more precise and more communicative, it would get less clicks.
There are rules and laws about fingerprinting too, I thought.
Lol, lmao even. Lawmakers are banning privacy as fast as they can, this kind of personally identifiable stuff is perfectly aligned with their end goals.
Checking for extensions is barely anything when you consider the amount of system data a browser exposes in various APIs, and you can identify someone just by checking what's supported by their hardware, their screen res, what quirks the rendering pipeline has, etc. It's borderline trivial and impossible to avoid if you want a working browser, and if you don't the likes of Anubis will block you from every site cause they'll think you're a VM running scraper bot.
It 100% implies that it's looking for locally installed binaries.
And could possibly access private documents if it wanted to, etc.
In the same way that scanning and identifying your microwave for food you put inside it is not the same as scanning your house and reading the letters in your postbox.
Your browser is a subset of your computer and lives inside a sandbox. Breaching that sandbox is certainly a much more interesting topic than breaking GDPR by browser fingerprinting.
> I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.
Expecting and accepting this kind of thing is why everyone feels the need to run an ad-blocker.
An ad-blocker also isn’t full protection. It’s a cat and mouse game. Novel ideas on how to extract information about you, and influence behavior, will never be handled by ad-blockers until it becomes known. And even then, it’s a question of if it’s worth the dev time for the maker of the ad-blocker you happen to be using and if that filter list gets enabled… and how much of the web enabling it breaks.
To be clear, expecting != accepting.
The point was more that the headline frames this as some major revelation about LinkedIn, while the reality is that we’re getting probed and profiled by far more sites than most people realize.
LinkedIn's whole business model is gatekeeping their database.
They're scanning your extensions to make sure you aren't using third party tools to scrape LinkedIn.
It's stupid, but they're trying to stop people from making money on LinkedIn when they feel like they're the only ones that should be able to do that.
Has anyone published useful parts of their database? It'd be kinda nice to use a rolodex that wasn't slimed with the rest of LI's taint.
Regulation is also a cat-and-mouse game. Life is a cat-and-mouse game.
[flagged]
>... everyone feels the need to run an ad-blocker.
I don't: never have and never will. I don't notice the ads, they don't bother or distract me: I'm online 4-8 hours/day.
diaphimisticophobia: fear of advertisements or commercials
I would bet HN has the highest proportion of people with diaphimisticophobia of any group on the planet.
I dont fear advertisements. I resent them.
Studies show most people who don’t think they’re impacted by advertisements are wrong. Advertisements don’t just drive you to buy something, they can also be used to create brand recognition, positive feeling associations and force the brand to front of mind.
You don’t notice ads when they pop up in front of content? When they lead to nearly full page breaks between paragraphs in an article? When they contain auto-play videos? When the video resizes itself and moves to stay in the viewport as the user scrolls? When so many ads load that the page crashes? When you do a Google search and there is only a single organic result without scrolling?
They introduced ads like a frog into tepid water. The water is now boiling and many still think everything is fine, because at this point it’s all they know.
It’s not a fear, it’s annoyance and a resentment. I’m annoyed that the ads make web pages so much worse. I resent that everything being “free” with ads has made it next to impossible for other business models to take hold and that new companies need burden themselves with investors, because the expectation is that things online should be free. I’m annoyed that a profile of who I am has been built and sold without my consent and without giving me a cut of the profit. I resent the companies that do this and have no respect for them or their leadership. It’s most certainly not fear of advertisements.
The fear is what will happen to that data, or what may already be happening, if it is controlled by some deceitful individuals or groups.
The fear doesn’t come from the ads, it comes from the invasive data collection that increases the profit of the ads. It’s compounded by the extremely frequent hacks and data leaks that have made it very clear that most of these companies cannot keep the data they collect secure. As such, they have no business collecting and storing it in the first place.
A billboard is an advertisement, so is a magazine ad. The world would be a more aesthetically pleasing place without them, sure, but I don’t go out of my way to avoid them like with the online ads. Billboards and magazines aren’t monitoring me and using hyper-targeted ads. A knitting magazine is going to show ads for knitting stuff. A billboard in Orlando is going to point a driver toward Disney. That’s just fine. Those ads meet people where they are, they don’t follow them around.
I don’t like shopping at Target due to what I’ve read about their data collection and how it’s used. I don’t fear big box stores, I just don’t want to be part of their data set. A store should be a store that profits from the margins of the products they sell. Now, the retail arm is just the front of their advertising or credit card arm of the business, where all the real money is. I don’t want to play that game. I’m a simple man, I want things to be what they are and that’s it.
Excuse the rant.
When I look up diaphimisticophobia, it seems specific about the commercial and their content being the fear. I think most people on HN have an issue with the data collection and use, not the content of the ads themselves.
> this is why I run ad blockers.
It's pretty wild that we live in a world where the actual FBI has recommended we use ad blockers to protect ourselves, and if everyone actually listened, much of the Internet (and economy) as we know it would disappear. The FBI is like "you should protect yourself from the way that the third largest company in the world does business", and the average person's response is "nah, that would take at least a couple of minutes of my time, I'll just go ahead and continue to suffer with invasive ads and make sure $GOOG keeps going up".
>the average person's response is "nah, that would take at least a couple of minutes of my time,
As a data point I, a technical person who tweaks his computer a lot, was against adblocking for moral reasons (as a part of perceived social contract, where internet is free because of ads). Only later I changed mi mind on this because I became more privacy aware.
The social contract was "your ads aren't annoying or invasive, and don't waste my time, so I earn you some money"
But ads are all of those things now, so I feel no obligation. I only got an ad blocker around the time ads were becoming excessively irritating.
Figure this: You could plaster a page with the most obtrusive ads imaginable without ever showing a cookie banner, when they collect no private info.
Most people, including folks on here, think cookie banners are a problem, but they are just an annoying attempt to phish your agreement. As long as these privacy loopholes exist, we will keep hearing such stories even from large corporations with much to loose, which means the current privacy regulations do not go far enough.
Beyond just invasive/annoying, ad networks explicitly spread malware and scams/fraud. There's not much incentive for them to clamp down on it, though, as that would cost them money both in lost revenue and in paying for more thorough review.
It'd not even be hard for them to stop it, but they just had to be annoying instead.
When I first started out on the internet, ads were banners. Literally just images and a link that you could click on to go see some product. That was just fine.
However, that wasn't good enough for advertisers. They needed animations, they needed sounds, they needed popups, they needed some way to stop the user from just skimming past and ignoring the ad. They wanted an assurance that the user was staring at their ad for a minimum amount of time.
And, to get all those awful annoying capabilities, they needed the ability to run code in the browser. And that is what has opened the floodgate of malware in advertisement.
Take away the ability for ads to be bundled with some executable and they become fine again. Turn them back into just images, even gifs, and all the sudden I'd be much more amenable to leaving my ad blocker off.
> The social contract was "your ads aren't annoying or invasive
Even back in the 1990s the internet was awash with popups, popunders and animated punch-the-monkey banner ads. And with the speed of dial up, hefty images slows down page loads too.
You must be a true Internet veteran if you remember a time ads weren’t annoying!
I remember a time before ads. I remember the first time I got "spam" email - email not directly addressed to me that ended up in my inbox. I was very confused for some time about why this email was sent to me.
I remember how I felt the first time I saw an ad come across my browser, it seems so long ago - I guess it was more than a quarter century ago now. I knew it was going to be downhill from there, and it has been.
Well by 2000 the guy at Tripod had already developed pop-up ads. I honestly don't remember ads before the pop-ups, but it must have already been maturing.
I strongly believe in paying journalists but I started blocking ads after nytimes.com served me a Windows malware download from a Doubleclick domain. It couldn’t have harmed my Mac but it was clear that the adtech industry had no interest in cleaning shop if it cost them a dime in revenue.
You mean the internet you pay to access and which was around before the ads were even on it? That internet?
I'm not trying to be mean I'm just trying to historically parse your sentence/belief.
Because for me this is a simplified analogy of what happened on the internet:
a) we opened a club house called the internet in the early 1990s, just after the time of BBSs
b) a few years later a new guy called commercial business turned up and started using our club house and fucking around with our stuff
c) commercial business started going around our club house rearranging the furniture and putting graffiti everywhere saying the internet is here and free because of it. We're pretty sure it might have even pissed in the hallway rather than use the toilet and the whole place is smelling awful.
d) the rest of us started breaking out the scrubbing brushes and mops (ad blockers, extensions, VPNs, etc) trying to clean up after it
e) some of its friends turned up and started repeating something about social contracts and how business and ads built this internet place
f) the rest of us keep crying into our hands just trying to meet up, break out the slop buckets to clean up the vomit in the kitchen and some of us now have to wear gloves and condoms just to share things with our friends and stop the whole place collapsing
Ya, back when 'we' were fucking around on BBS's there was the equivalent of 10 people online at the time.
Quantity is a quality in itself. Your BBS was never going to support a million users. Once people figured out the network effect it was over for the masses. They went where the people are, and we've all suffered since.
Honestly, I still prefer webboards, the closest thing to a BBS, for specific topics like specific car brands/models. WAY better signal-to-noise ratio. Alas, for my car model, all the recent stuff has moved to Fbook. FML.
> a) we opened a club house called the internet in the early 1990s, just after the time of BBSs
"we" is doing a lot of work here. No clubhouse got optical switching working and all that fiber in the ground for example. Beyond POC, the Internet was all commercial interests.
"we" paid ISP's ... which in turn, paid for infrastructure. Some of "we" pay cable providers for internet service, which in turn paid for (in my case) fiber-to-the-curb. Advertising basically supported social media, search engines, etc.
No. The internet was not a commercial enterprise, it was first and foremost a military enterprise, just like GPS.
> it was first and foremost a military enterprise, just like GPS
This is sort of like arguing cutlery is a military enterprise. Like yes, that’s where knives came from. But that’s disconnected enough from modern design, governance and other fundamental concerns as to be irrelevant. The internet—and less ambiguously, the World Wide Web—are more commercial than military.
This is moving the goalposts. The commenter above is talking about the enthusiast-populated internet of the late 80s/early 90s, at which point it still wasn't even clear if it was legal to use the internet for commercial purposes. If all you mean to say is that the internet is currently commercialized, yes, that is obviously true, in much the same way that a disgusting ball of decomposing fungus may have once been an apple.
> commenter above is talking about the enthusiast-populated internet of the late 80s/early 90s, at which point it still wasn't even clear if it was legal to use the internet for commercial purposes
Source? Not doubting. But I have a friend who was buying airline tickets through CompuServe in the late 80s/early 90s.
Compuserve was NOT the internet. Compuserve / Prodigy / GEnie were early versions of Facebook. They also inter-operated (email) for some period of time. IIRC.
An important distinction, although I do remember AOL making a strong go at "branding" the internet by the late 90s.
This is ignoring things like newspapers that were made obsolete by the internet. At some point someone does need to actually pay for the content we see online. That is if we want that content to actually be good.
not sure why you're talking about "commercial business" being the one inserting ads everywhere when even niche community run forums from the 2000s also had ads to help pay for their server costs. At the end of the day all this costs money. Whether its paid by ads or direct subscriptions. IMO the problem is more about concentration and centralization of the internet into a handful of sites than advertising.
I mean yeah, you pay for the internet. But many sites are free to use only due to ads.
Such as news and magazine sites, many of which are actively dying due to a lack of revenue.
I personally wish these sites could all switch to paid models, because I also don’t like ads.
But absent that, I’d like to support the sites I use so that they don’t go out of business.
I have expensive online subscriptions to New York Times, Wall Street Journal, and Washington Post. Nevertheless they are FILLED with ads/popups/videos that run automatically/dark patterns. Just saying: there's no refuge.
True, but that doesn’t invalidate what I said about the vast majority of sites that aren’t globally known, prestigious news companies that people are willing to pay an expensive subscription for.
Most publishers of content online are ad supported and struggling, and I want to make sure I’m contributing to their revenue somehow.
I don’t feel bad about blocking ads on sites I pay for though.
here's an idea: don't use those sites.
The average person — that would be me — thinks "nah, I have no idea how to install an ad blocker or how one works, and I'm afraid I'll screw up my computer."
Duckduckgo is free and with ads.
[dead]
The crazier part is that its an official government position, and we (people at large / the government) aren't immediately slapping down the actions of these companies.
Don't worry, soon you'll need to pay every website 5.99 a month because AI is destroying click through rates. The internet will likely be far worse without ads than with ads. Solving the tracking problem doesn't need to be mixed up with blocking ads outright. What's funny is that tracking isn't nearly as meaningful for click through rates on ads as relevance to what's on the page, and yet so much effort is placed onto tracking for the slim improvement it provides.
It would not be 5.99 to access a website because that's not what it costs and that's not what ads yield.
I think people think ads give way, way more money than they actually do. If you're visiting a website with mostly static ads then you're generating fractions of a cent in revenue for that website. Even on YouTube, you're generating mere cents of revenue across all your watch time for the month.
Why does YouTube premium cost, like, 19 dollars a month then? I don't know, your guess is as good as mine.
Point is, you wouldn't be paying 5.99. You could probably pay a dollar or two across ALL the websites you visit and you'd actually be giving them more money than you do today.
But there's no method or structure in place to pay a website a fraction of a cent. Ads are the only way we've found that actually implements a form of microtransactions... paying a tenth of a penny for a sliver of attention.
I don't want to defend ads, but whatever replaces them is going to be very disruptive. Maybe better, but very different.
In 2023 I did a deep dive into the crypto community with two main questions:
- do these people understand the principles of making good products?
- is anyone clearly working towards a microtransaction system that could replace advertising and subscription models?
After attending two conferences, hundreds of conversations and hours spent researching, my conclusion to both questions was no. The community felt more like an ouroboros. It was disappointing.
I don't want to pay NYT a subscription fee, I want to pay them some fraction of a cent per paragraph of article that I load in. Same goes for seconds of video on YouTube, etc.
Apparently I'm alone in this vision, or at least very rare...
I have also done similar research because I wanted to build something to handle microtransactions on a personal website that could scale if adopted to be usable by everyone if they wanted.
I looked at crypto currency because it seems like the obvious naive solution. it doesnt work. the cost of the transaction itself far outweighs the value of the transaction when dealing with fractions of a cent. you want an entire network to be updating ledgers with ~millions of records per ~$1000 moved. the fundamental tech of crypto leans towards slower, higher value transactions than high volume, small transactions. Lots of efforts have been made with some coins to bring down the bar of "high value, low volume" to meet everyday consumer usage rates and values - but a transaction history at the scale of every ad impression for every person is a tough ask and would perpetually be in an uphill battle against energy costs.
Ultimately, the conclusion I came to is that the service would need to be centralized, and likely treated as cash by not keeping track of history. Centralized company creates "web credits", user spends $5 for 10,000 credits, these credits are consumed when they visit websites. Websites collect a few credits from each user, and cash out with the centralized company. The issue is that since it would cost more to track and store all the transactions than the value of the transactions themselves, you have to fully trust the company to properly manage the balances.
I started building it and since I would be handling, exchanging, and storing real currency - it seemed subject to a lot of regulations. It is like a combination bank and casino.
i've thought about finishing the project and using disclaimers that buying credits legally owes the user nothing, and collecting credits legally owes the websites nothing, and operating on a trust system - but any smart person would see the potential for a rug pull on that and i figured there would not be much interest.
The alternative route of adhering to all the banking regulations to get the proper insurances needed to make the commitments necessary to users and websites to guarantee exchange between credits and $ seemed like too much for 1 person to take on as a side project for free
It would need to be mostly centralized, but keeping track of history would not be hard.
A typical credit is getting paid in, transacted once, and cashed out. And a transaction with a user ID, destination ID, and timestamp only needs 16 bytes to store. So if you want to track every hundredth of a penny individually, then processing a million dollars generates 0.16 terabytes of data. You want to keep that around for five years? Okay, that's around $100 in cost. If you're taking a 1% fee then the storage cost is 1% of your fee.
If your credits are worth 1/20th of a penny, and you store history for 18 months, then that drops the amount of data 17x.
(And any criticisms of these numbers based on database overhead get countered by the fact that you would not store a 10 credit transaction as 10 separate database entries.)
fair enough on tracking history in the centralized model. I had suspicions there would be hidden costs that might make it too expensive. i dont think the data storage would be as much of a problem as the cost to write it to storage.
I wasn't fully envisioning credits only being transacted once before cashout either. I was thinking more along the lines of being able to create something that goes viral, a lot of people use it and you rack up a bunch of credits, and then you can sit on those credits and spend them as you use the internet without ever having to connect to a bank yourself. So people who are contributing more than they are consuming would rack up credits. they could use those credits to enrich their contributions, maybe pay for cloud services, etc.
the credits could form its own mini web economy if it got popular enough. As cool as this would all be if done honestly, I know that if i saw a company telling me to buy web credits to use anywhere on the internet and the websites get to decide how much to charge and they charge it automatically when i visit the website, and if the company i buy the credits from goes out of business then i may not be able to cash out or get my money back, then I likely wouldnt be buying those credits... so idk
Even with user to user credits it would take a lot for the number of transactions to go above 2. That would mean more than half the money is going to viral payouts.
And was this assuming you'd only take a cut on the cash going in and out? Because even a 0.1% cut of the transactions would mean you have $1000 to handle the amount of data I described in the last comment.
>And was this assuming you'd only take a cut on the cash going in and out
I think fee needs to be per transaction, maybe not cash flowed per transaction but accrued per transaction.
Say we both self-host a website for our favorite daily game, and I use yours about as much as you use mine. We would transfer roughly the same amount of credits back and forth to each other ad-infinitum. but the credit service provider is accumulating only expenses with each transaction.
Say someone make a lot of bot accounts to simulate user traffic, and it sends each of them credits to use to visit their own site. the host collects the credits from the bots and transfers them back to the bots to keep them running.
you are not alone, people seriously proposed one thing after another in the early 2000s.. same time frame as RSS, roughly. Somehow, these proposals were undermined and slow-walked? merger and acquisition in Silicon Valley was aligned with very different things
>"Ads are the only way we've found that actually implements a form of microtransactions... paying a tenth of a penny for a sliver of attention."
Ads were the path of least resistance, and once entrenched, they effectively prevented any alternative from emerging. Now that we've seen how advertising scales, and how it's ruined our mediascape, we're finally looking at alternatives. Not dissimilar to how we reacted to pollution, once we saw it at scale.
Microtransactions have been done in various ways, in fact the word refers to those more than a hypothetical.
YouTube had an estimated $40 billion in ad revenue in 2025: https://techcrunch.com/2026/03/10/youtube-surpasses-disney-p...
And has roughly 2.7 billion monthly active users. This means the average YouTube user brings in around $1.23 per month. When you consider that CPM's can easily swing by 20X based on how wealthy the user demographic is, and willingness to pay a subscription is a strong signal for purchasing power, I would not be at all subscribed if a YouTube premium subscription was revenue-neutral for Google.
I believe this and it makes a web 3.0 solution seem viable if only we could escape the collective action trap
This may be a hot take but I'd be willing to pay my ISP $10 extra that they would distribute to sites I visit, if it meant zero tracking and ads. I use an ad blocker but I genuinely want to support content creators in a way that doesn't optimize for ads or clicks.
There would need to be a way for ISPs to know which websites are getting my traffic in order to know who to distribute the money to, which I'm not a fan of. But I think something along those lines, with anonymized traffic data, would work a treat.
Oh ISPs are definitely collecting your browsing habits, and selling them to the highest bidder. It's one of the major reasons why I use a vpn.
Well what makes you think the VPN providers are not tracking?
You would have to either self-host your own VPN server somewhere (maybe on a public cloud provider) or if you are truly paranoid, use something like Tor.
They have been subject to warrant requests, and had nothing to turn over. There are only a few vpn providers that I genuinely trust. (Mullvad, airvpn, etc)
Really though, I am not worried about 3 letter agencies performing legitimate law enforcement duties. I am worried about corporations hovering up more data about me than I'd want to reveal, and either using that as a basis to charge me more, or worse, they get hacked, and that data is used by bad actors to target me.
Yeah that's the problem (and possibly why such a thing didn't exist).
But I kinda see it like TV. Cable providers know what channels and shows people are watching. Obviously web browsing data is more personal and intimate so it's not the same thing, but it's a good starting point for a thought experiment.
> This may be a hot take but I'd be willing to pay my ISP $10 extra that they would distribute to sites I visit, if it meant zero tracking and ads. I use an ad blocker but I genuinely want to support content creators in a way that doesn't optimize for ads or clicks.
The problem is that both the ISP and the websites would then go "Cool, we're getting $10 a month from them!" for about a minute before they started trying to come up with ways to start showing you ads anyways. With the level of customer appreciation ISPs tend to show, I'm sure they'd have no problem ignoring your complaints and would happily revoke your service if you stopped paying the now $10-higher price per month.
content creator is new speak
people with something to share, people with something to say, who share and say it because they want to
that's how pamphleteers worked, that's how the Internet worked
at scale, static (CMS-managed) information sites cost effectively nothing even for arbitrary amounts of traffic, and smoothed across a range of people sharing stuff, it approaches zero per person
publishing used to be free with your ISP, and edge CDN used to be (and still is) free to a point (an incredibly high volume point) as well
having people pay something nominal to say things instead of pay far too much in attention-distraction or money to consume things, would put this all back the right way round
I couldn’t disagree with this more if I tried. The biggest benefit of the internet is to make it easier to talk to each other and share ideas. Putting financial gates in front of that ability is hot garbage.
Also, I agree that the platforms and paradigms we have are fucked up, but do believe that people who put work into making something deserve to charge for it if there are folks who’d pay.
The ISP shouldn't necessarily be involved in this process, but some form of syndication does need to happen, and it seems crazy that it hasn't.
The closest we've come is something like Apple News, which allows me to pay for a selected (by them, not me) subset of features on a selected (by them, not me) subset of news sites. Can't somebody do this right?
Texture was incredible.
Apple News remained fantastic until renewal of agreements when publishers demanded rights to insert additional ads.
Apple can't not have premium sources in there, so...
I've never used Apple news but something like that sounds like a great idea!
internet will likely be far worse without ads than with ads
Not sure on that. It was far, far better before what drives ads today. I've gotten more value from random people's static HTML pages in 1999, than I ever have from something in the last 25 years.
This just led me to think of news sites, and how they've turned mostly into click-bait farms in the last decade to 15.
Gives me pause. Didn't the king of "doing it online" buy a newspaper, but the end result wasn't an improvement on its fate? If there is any way to make cash from news, shouldn't Bezos have been able to do it??
I would love to get something more akin to a monthly print issue of BYTE, Omni, Starlog, Reality Hackers, WIRED and Dr Dobbs Journal without blinky, shouty ads that cause the content to re-render every 10 seconds.
I would pay money for that.
E-ink is getting cheaper and cheaper, there's a lot of 6" screen devices for $100. If it dropped to $100 for a 11" screen, that would be a respectable size for a magazine. I cite eink as most are distraction free, or can be, and are very easy on the eyes.
Such content would also suck with flashy ads too.
It's pretty easy tech I think, it's just never hit a flash point. But it could.
You miss the point.
We literally had all of this. We had regular, affordable, high quality printed media for every hobby and interest and industry, that you could get delivered to your home address and collect in your own archive if you want, and your local library could do the same.
Those pieces of paper could not track anything about you. They tried, selling their subscriber lists, but that was the best tracking they could provide! You could easily ignore ads, and in return they had to make ads interesting enough in various ways that you might look at them anyway, or they had to make their ads directed at people who went looking for whatever you were selling.
It was an objectively better system in every way.
The Sears catalog was worlds better than Amazon. You weren't going to buy a fraudulent item for one.
Tech is a failure. It has made so much worse. It has only served to allow businesses to cut costs while extracting money from every single local community that used to allow such cash to circulate locally.
We should ban all internet advertising.
I might recomment a middle ground before banning all internet advertising.
What if we limited advertising to images which don't set tracking cookies, so you would get something sort of like banner headlines. Maybe say the image had to be served from the same place as the rest of the content so you don't get to track readers with image trackers
You make the argument from the consumer side, it's hard to argue, but digital systems are far more profitable. So that's how we got the world we got.
It turns out that "makes the most money for a small amount of people" is pretty much the same as "makes everything shitty for everyone else". It's time that we either stop accepting "most profitable" as an excuse for making things worse or start regulating/punishing bad behavior until it becomes so costly that it's no longer profitable.
Your response comes packaged with a pill that I believe many people would not swallow: If it makes more profit then we should do it.
You miss the point.
Hardly. I'm the guy upthread, lamenting the current state of things.
But with e-ink, you can be detached. Knowing someone buys a newspaper is hardly a surprising thing. To put it in perspective, a large number of people subscribed to the paper, and it was delivered daily. The same was true of magazines subscriptions. As long as the media is offline (eg, PDF, epub, similar), and the reader OSS, then the tracking and ads aren't an issue still.
--
I don't disagree with how poor things are, but one issue is government moves slowly. Laws being passed today, are the result of trends 20 years ago. For example, in my legal jurisdiction, vendors (eg, Best Buy, big box stores) are responsible for the thing they sell. It's not just "ship it back to manufacturer", for obvious reasons.
Eventually the issues with e-trade will be dealt with, just as issues with shoddy sellers were deal with a century ago. Here's an example...
Back in the 50s people would send items through the mail, then demand people pay for them, or pay for return shipping. I'm not kidding. Even when it wasn't easily defensible in civil court, all the legal threats would scare some into paying.
So laws were passed. If you receive something in the mail you didn't order? It's yours. Period.
But this took a decade to happen, if not more.
This is the sort of thing which will happen in this new market.
And yes, Amazon sucks as it is now.
It's really quite fascinating to me how a lot of new markets aren't about novel, but instead about not having terrible behaviour regulated. For example, Amazon has the worst customer service in all existence. It used to be good, but they now take immense pains to hide all support channels, and where I live, it's a maze of incomprehensible clicks to even attempt to get a chat.
So... I have to call now. Every time. And now they have the same wall of "noise" on the phone, so it's harder to get through there. In the past, I've done chargebacks when I can never reach a company, and that will be the inevitable conclusion here too.
Which shows how incredibly stupid Amazon is, when this household buys $4k of stuff a month from them, and just has edge-case returns sometimes. I'm sure they'll cancel my account first time, and, well, who cares.
When companies get to this level of "screw the consumer", they're at the edge of all ability to improve profits. There's no where left to go. I expect Amazon to have issues due to things like this, and the squeeze on foreign imports, and crash and burn on its side.
But back to your point? Yes, we should. Or, we should just pass laws which make centralized advertising, that is, the collection of Pii impossible.
Ban all Pii? Ban all transactions of Pii? And you end advertising as it is.
> If there is any way to make cash from news, shouldn't Bezos have been able to do it??
News only made money when the newspapers could leverage their circulation numbers to run their own ads network. The classifieds section was a money machine. I remember full-page ads in the Washington Post from local car dealerships showing every model they were selling. They likely ran different ads for distribution in other regions, probably 10Xing their money. Google and Facebook killed that.
What Bezos bought was a corpse of a business, but one with strong journalistic credibility known for historic investigative analyses such as the Watergate cover-up that earned public goodwill. He was buying that goodwill and slowly asphyxiating it to align with his own interests.
By the time Bezos bought the Post, most of that goodwill had evaporated, and since then, almost all of it has.
No company would treat it as either-or.
If websites could charge 5.99/month, they would.
If a website was charging 5.99/month, they would not stop spying on you.
This sounds possibly better. Aligns the interest of the website more with the users.
Ads are a weird game. People say you're ripping off the website if you adblock, but aren't you ripping off the advertiser if you don't buy the product? If I leave YouTube music playing on a muted PC, someone is losing.
>The internet will likely be far worse without ads than with ads.
Ads won't go away. They'll just move from infesting websites to infesting AI chatbots.
That'd be ideal because it would mean I could browse the internet without ads and just never use AI chatbots. Unfortunately I think ads are only going to spread and what we'll actually end up with is "more ads everywhere".
I would rather pay people and websites for content. I already do this today for journalism orgs and a handful of high value substacks, I'm happy to pay for more. I'd pay for HN. Free does not scale (with the caveat being orgs like Wikipedia, the Internet Archive, and others who have an endowment behind them and can self fund alongside donations; this, of course, is a model others can adopt), people need to eat, pay for rent, etc, and ads are ineffective when everyone can block them.
Ads are a symptom of the problem that people want human generated content for free; they either do not value the content enough to pay for it, or cannot afford it. Ads do not solve for those problems.
> Free does not scale
No disagreement there, except the early web was not about scale. The sites you visited may have been created by someone as a hobby, a university professor outlining their courses or research, a government funded organization opening up their resources to the public, a non-profit organization providing information to the public or other professionals, or companies providing information and support for their products (in the way they rarely do today).
> people need to eat, pay for rent
Those people were either creating small sites in their spare time, or were paid to work on larger sites by their employer.
There were undoubtedly gaps in the non-commercial web. On the other hand, I'm not sure that commercializing the web filled those gaps. If anything, it is so "loud" that the web of today feels smaller and less diverse than the web of the 1990's.
I agree there are hobbyists, for lack of a better term, who will always share for free "for the love of the game", passion, whatever you want to call it. Nothing stops them from doing this passion or charity work today, the evidence of that is clear from the content we see daily pass through /new here. That was never really ad driven, nor would it be in the future, and numerous mechanisms remain for them to share this content for free with the world. But that is a small minority of today's Internet and consumption of data, information, and content (imho).
How does HN exist? Wealthy benefactors. Do I appreciate it any less? I do not, I am very grateful. But solutions are needed where a wealthy benefactor has not stepped in or does not exist, a commercial business model is untenable, the government does not or will not fund it, and the scale is beyond a single person spending a few hours a week on it for free.
https://xkcd.com/2347/
I run into occasional articles, often linked from here, for say economist or ft.com or new york times
I'm not signing up for a subscription for that journal, but paying a small amount for access to that one article is a no brainer. I don't subscribe to a newspaper either, but I'll happily buy one.
The New European did this a decade ago using "agate" (named after the smallest font you'd get in a newspaper), top up with a few quid, then pay for each article.
Sadly didn't catch on. TNE dropped it in 2019[0]. Agate still exists, having been renamed to "axate", but consumers aren't willing to pay with anything other than their time.
[0] https://pressgazette.co.uk/news/new-european-drops-micro-pay...
While this works for some cohort of consumer, it doesn't work for organizations that need consistent cashflows to pay for consistent expenses, and so, those willing to subscribe on a recurring basis carry the economic burden of sustaining such operations.
Newspapers continue to run ads even after the paywalls went up everywhere a decade or so ago. Once "premium" offerings like HBO, which were ad-free on cable TV, now has ads on its paid streaming version. Even with the "premium" subscription tier, there's sponsored/co-branded content. And for some reason, it now has live sports, where they have no control over the ads shown.
The problem was less the scale of supply and more the scale of demand.
In the 19th century, economist William Stanley Jevons found that, as coal became more readily and easily available, demand for it went up. This was counter to the theories of others, and the principle became known as Jevons Paradox.
Jevons Paradox (a concept that is widely misunderstood, especially when it comes to tech and finance bros talking about AI) demonstrates that, a resource becomes more abundant and easily accessible, demand for that resource rises. As the web took off, people hungered more and more for digital content -- especially as internet accessibility became faster and cheaper.
To keep up -- and to pay for being able to keep up -- increasingly sophisticated monetization models were introduced.
In any case, ad models are one thing. But it's the data brokering that's even more insidious.
The irony is that if internet content were harder to access, the population on the whole wouldn't want it as much.
Now, the culmination of Jevons Paradox has spun itself around a bit in this case. We now live in a world where those profiting off of ad models and data brokering actively try to get people to demand internet content more. (Look no further than the recent social-media-addiction lawsuits.)
Sadly you are atypical and the vast majority are freeloaders, who even without ads or tracking will try and find another way not to pay.
There is no substance to this statement.
> Sadly you are atypical and the vast majority are freeloaders
Citation needed.
> who even without ads or tracking will try and find another way not to pay
Why is this relevant? People try to get free stuff all over the place and I don't find it makes my life difficult.
>> Sadly you are atypical and the vast majority are freeloaders
> Citation needed.
I think we need to agree upon a definition of freeloader before citing sources to support the claim. I've found that many people who use the word have a much more transactional view of the world than I do.
As opposed to morally upright people like yourself, who look for ways to pay for things that might be obtained freely?
> I would rather pay people and websites for content.
I do not think that this is a workable model. Firstly, because it leads inevitably to monopolization, because you don't want to pay 50,000 people for content, you want to pay 10 people for content. Secondly, because most content is bad and a waste of time and you don't find out until after you've bought it. Thirdly, and most importantly, is that there's no actual, clear separation between "news" and "advertising."
Content is generated because people who want that content generated sponsor it beforehand, and dictate the conditions under which the delivery of that content will be accepted as a fulfillment of that sponsorship. The people sponsoring that content can have any number of reasons for doing it; it can make them money directly (i.e. I have articles about cats, people who like cats subscribe to my cat website), which if you're a linear thinker you think is the only way, or it can make them money indirectly, maybe by leading consumers to particular products or political stances that they have a stake in.
This is simply the truth. Your preferences don't matter, and it's not a moral question. If you pay for content, you're more valuable to advertise to, not less. A lot of work is put into producing trash that you regret having read or watched, and was really intended to make you support Uganda's intervention in a Zambian election (or whatever.) If you "value" reading it, you've failed an intelligence test. Its value is elsewhere for the people to paid for it to be written.
What's recently shown itself to scale is small groups of people sponsoring journalists and outlets who put out tons of content for free. The motivation of those sponsors is usually to spread the points of view of the journalists they sponsor widely, because they believe them to be good.
There was never a pay model that supported things that people didn't feel passionate about or entertained by. Newspapers cost less than the paper they were written on. Television news was always a huge money loser that was invested in to raise the social status and respectability of the network. If you feel passionately about anything, you're far better off paying people to listen, to give you a chance, than to lock away content. Journalism as a luxury good can work, but only for Bloomberg terminals and Stratfor, when it is used to make other lucrative decisions by its buyers.
> orgs like Wikipedia, the Internet Archive, and others who have an endowment behind them
This is simply sponsorships by governments and billionaires. Never ever been any significant shortage of that (the patron saint of this is King Alfonso X.*) All of those people have wide interests that can often be served by paying for media to be produced or distributed. It's where we got our first public libraries from.
For me, the fact that Substack and Patreon almost work is more important, and is something that wouldn't have been as easy without the benefits that the internet brings for the collaboration of distant strangers.
-----
[*] https://en.wikipedia.org/wiki/Alfonso_X_of_Castile#Court_cul...
I don’t think it would necessarily have to be six bucks a month.
Something Awful is a one time fee of ten bucks (a few bucks more to get rid of ads).
I wouldn’t really mind a one-time fee for a lot of sites if it meant that they didn’t have to do a bunch of advertising bullshit,
Yes, but the Awful registration fee is more like a speedbump to make banned behavior at least a little expensive to the offending users. Most of the revenue comes from completely optional aesthetic purchases: avatars, avatars _for others_, smilies, etc. I suspect it's a whale based economy.
True, I think it was more sort of a natural filter than explicitly revenue for the website.
Still, I would be willing to pay a bit more for a website that I actually like if it's a one-time fee; I actually paid for the "Platinum" membership for Something Awful so that I would have access to search, and a custom icon, so I think the total damage was around $30.
Dunno, I guess I just feel like people will pay for things if those things don't suck. I think the fact that the only way that companies can really compete for people's time is giving it away for free [1] is a testament that most stuff on the internet is actually kind of shit.
[1] yeah I know something something you are the product something something.
ETA: I hate self-promotion but a friend of mine told me I should mention that I did write a blog post talking about this very specific example: https://blog.tombert.com/Posts/Personal/2026/02-February/Peo...
> whale based economy
Please explain this term. Google was not useful.
Also look up K shaped economies at the same time and you get a better answer.
But the gist of it is, companies do free to play systems that support themselves by a very small portion of their user base spending a very large amount of money. The free/low paying users find themselves with poor/no service as the companies do anything to attract more whales.
K based economies are somewhat related as you see a very small portion of the participants in an economy make a huge amount of money while everyone else gets poor.
Whales are the tiny percentage of users who spend large amounts of actual money on bullshit non-products offered by mobile apps and online platforms. AKA suckers.
> The internet will likely be far worse without ads than with ads
This is highly debateable. I wouldn't mind paying a bit for the websites I am using as there are just a few platforms and some blogs that I would be happy to pay a small amount for.
> soon you'll need to pay every website 5.99 a month
No, I won't. I'll just stop using them. So will almost everyone. I don't think there's a single ad-supported product that would survive by converting to a paid subscription, because they're all so profoundly unnecessary.
Yeah, the fact that the only way that these products can survive in the competition of how I spend my time is a testament to how shitty they are.
I'm happy to see that day. I'm already paying for stuff I need in life. There's no reasons to insist on not paying for the stuff I need in the web. Just kill those spywares stealing my personal actions and information.
yes, Google AdSense was like the cambrian explosion allowing tons of businesses to get traction in the early days.
There is a story of this PlentyOfFish founder (who exited to Match.com for 500m cash) that in the beginning he got 3-4 USD per click
I honestly don’t think “with ads” describes what we are experiencing. We are being all but violently fracked for data (and we don’t know what all they’re taking) for them to sell to 3rd parties we don’t know who then use decades of research and tooling + your personal data to psychologically manipulate you into not just buying things, but also into feeling and acting certain ways (socially, politically, etc).
This isn’t Nielsen ratings informing cable networks where to throw up which commercials in certain regions. This is far more dangerous and intense. So the conversation needs to be framed differently than the implied bar of “intrusive/annoying/incessant ads.”
But those websites would have to provide 5.99 a month of value, and many don't.
We used to have "static" banners on sites, that would just loop through a predefined list on every refresh, same for every user, and it worked. Not for millions of revenue, but enough to pay for that phpbb hosting.
The advertisers started with intrusive tracking, and the sites started with putting 50 ads around a maybe paragraph of usable text. They started with the enshittification, and now they have to deal with the consequences.
Nary a month goes by that I don't bemoan the loss of BYTE and Dr Dobbs Journal. WIRED is still hanging on, but it's more of a site where tech warehouses in Shenzhen hawk there latest wares.
There was a time when Boing Boing was a decent little print magazine. And the web site went a decade before turning into... whatever the heck it is now.
And Reality Hackers and Mondo 2000 were "guaranteed unreadable," but they were on the bleeding edge of desktop publishing style and technology.
I'm old enough to remember typing BASIC games from COMPUTE! into my C64 and reading about the latest Star Trek film in Starlog.
I sing the praises of Omni, even though it was clear they were probably snorting a lot of cocaine in their offices.
I can't be the only one who remembers Computer Shopper, but I have to admit it was years before I realized they had a bit of content and were more than just an ad sheet for Micro Center.
PC World wasn't my jam, but I respected the role it played. UnixWorld and Info World were more my thing.
And I even read the stories and articles in Playboy in the 70s. Believe it or not, they had some amazing authors publish stories there.
Omni was hands-down the sexiest thing Penthouse ever did with their money.
Hands-up... it was still pretty sexy.
Honestly, I'd rather see the internet wither and die than live with ads. True hate and contempt for them.
I'd be very happy with an internet without ads. Not that I see any ads anyway.
I think the damage is there even if you don't see the ads. News outlets and organizations that used to be magazine publishers focus on lowest common denominator stories they know will get the highest engagement. That usually means sexy anger-bait.
Sure we had that in the print times, but we had a lot more "slow" content that you could sit with and contemplate over a day, week or month.
> publishers focus on lowest common denominator stories they know will get the highest engagement
One of my favorite uses of AI is to ask it, "what are today's headlines?" You completely bypass all of the sensational nonsense.
Even those of us who don't see ads see the structure that the ad-driven internet economy creates. Listicles, clickbait and AI-generated slop web pages, just trying to get more ad impressions. Sure, with an ad blocker I can see the low-quality content without an ad, but without the ad economy hopefully there'd be less incentive to create low-quality content to begin with.
Majority of people use their mobile devices these days to browse the Internet. Installing an ad blocker on your iPhone is a significantly bigger challenge than on desktop.
Use Firefox/Fennec which allow you to install a variety of the add-ons you can install on the desktop version such as UBO, Stylus, ViolentMonkey, Bitwarden, SponsorBlock, etc... or install Brave which comes with adblock by default. As for iPhone, you can install Brave which has adblock, I don't think Firefox has add-ons in that version though, not sure.
Isn't Brave backed by Peter Thiel? That alone would make me not trust it but they also have baked in crypto and other weird stuff.
Here is a handy list of things that Thiel invested in
PayPal, Spotify, Stripe, LinkedIn, Airbnb, Facebook, ResearchGate, Flexport, Nubank, Rippling, Asana, Luft, Tesla, Microsoft, Apple, SpaceX
You can’t trust anything these days!
I don’t think you can write off Apple or Microsoft just because Thiel made some investment in them.
Being the VC to a company’s round B, C, and D (adding up to maybe 40% ownership/control) is VERY different from simply throwing some money at a trillion dollar company to see some returns.
Firefox on Android supports it without any issue. That would cover a significant enough segment of the population that it might encourage actual change in the industry if people started moving to that platform.
Firefox on Android has approximately 0.5% market share on mobile, less than Opera. I really doubt it's enough to spark any sort of industry-wide change.
I'm not saying that Firefox on Android has significant market share; rather that Android has significant market share, and those users could be served by switching to Firefox solely for the purpose of using an adblocker.
If all Android users did this, something would change.
The point is it’s easy. It’s near frictionless. Unlike a lot of pie in the sky statements I see here like how “easy” it is to install and run Linux (it isn’t), Firefox adoption is truly trivial for any smartphone user and presents a stronger baseline than chrome does. People here often get critical of Firefox/Mozilla, and I totally get it, but compared to Google Chrome it doesn’t, well, compare.
Firefox runs great 99.99% of the time. It’s easy to add extensions. So we should be pushing people to adopt it.
It’s becoming easier on iPhone (even uBlock origini is now available, if only the lite version), which is nice because internet is becoming more and more unusable without them.
AdGuard installs through the App Store and integrates seamlessly with Safari. It's not as perfect as some of the desktop class adblockers, but it's free and can be up and running in a couple minutes.
If you're on Android, Firefox supports many full desktop extensions, including uBlock Origin.
1Blocker has been great for me and includes blocking of many/most (almost all?) in-app trackers too.
There have been mobile Safari ad blockers for 10 years now, free or paid, and many of them can now be unified with desktop Safari. Many alternative iOS browsers include ad blocking directly, since they can't use the Safari plugins (despite all being powered by WebKit).
Not anymore. You can just find one on the app store and install it, almost exactly the same as you do in a browser's extension "store". It won't be as good as uBlock but it certainly works fine even in Safari.
Which do you use? I was unaware that Apple even let such apps on the App Store. I always assumed that their ToS would strictly prohibit it.
ublock origin lite is straight up on the app store now, should work with any moderately recent version of iOS/iPadOS. Installed this on my family's Apple devices and it works pretty well.
There's also been other adblock apps for a long while, though (adguard comes to mind).
AdGuard has never given me any trouble.
uBlock Origin Lite works great for me
Can't speak for IOS but for android users I highly recommend Firefox for android, since you can install ublock origin within it. Let's be real, browsing the modern internet is downright impossible without it today.
My pihole does a good enough job with phones. I know google wants to close this (hence pushing things like DoH)
Last time I tried firefox on the iphone it was rubbish compared with safari. Same with some ad blocking app I had back in the day
Browser extensions for iOS are bundled with Apps. It’s not “a significantly bigger challenge” to install an app than a Chrome extension.
How is installing uBlock Origin Lite on iPhone a big challenge? Installing it on my SO's device was quite trivial.
Lite doesn't actually protect you.
Brave has served me well in this regard. I don't even get ads on YouTube on mobile.
Not really - I use Brave browser on iPhone, a simple app install, and it blocks ads extremely well, even on YouTube and Instagram.
Every browser should have ad blocking technology included and enabled by default. I do not understand why Apple in particular has not pushed this with Safari, as they like to portray that they care about privacy.
I get why Chrome doesn't, and that's why you should not use it. But Netscape? Edge? What is stopping them?
Browsing the web without an ad blocker is a miserable experience. Users who have never tried or don't know how to set one up would be delighted.
>Browsing the web without an ad blocker is a miserable experience.
That is your experience. Mine is the opposite.
>Users who have never tried or don't know how to set one up would be delighted.
Perhaps.
"I would prefer not to." — Bartleby, The Scrivener
https://moglen.law.columbia.edu/LCS/bartleby.pdf
Google pays Apple 20+ billion dollars annually to be the default search engine in Safari. I don't know whether the absence of ad blocking is a stipulation in that deal or not, but I have to imagine that if Apple blocked ads in Safari by default, that deal would not be renewed.
Apple is worth nearly $4T. I think they can afford to take a principled stand here, especially considering the current mood about big tech.
And I don't think Google would lightly give up being the default search engine on the dominant mobile platform in the USA, and significantly more dominant among upper-income users.
Browsing the web without a web blocker for me is a wonderful experience every day and has been since the beginning. Diff'rent strokes.
At least with Chrome i can use ublock - not so with safari. The best browser is ofc Firefox but everyone seems to have forgotten that bc of bad publicity or whatever
The best browser is either Waterfox or Librewolf since they're Firefox-based but don't steal your data or claim copyright on it.
It would be news to me that Firefox steals data or claims copyright on my data - do you have anything concrete to back that up?
It was their terms of service change at the start of 2025. It caused quite a shitstorm.
So essentially a bunch of noise that didnt really mean anything concrete?
Mozilla backed down due to the backlash. It still means Mozilla is untrustworthy.
This implies they had some sinister plan to claim all your data as theirs or something which is ridiculous - they didn’t back down from anything but changed the wording of the legal text to make it easier to parse for non-lawyers.
It’s worse than that. My mom wants to see ads. I thought I was doing her a favor adding her to my pihole but she really likes ads, especially Facebook ads.
> and if everyone actually listened, much of the Internet (and economy) as we know it would disappear.
Would it really? It seems to me that most normal users spend most of their time and attention on apps, not in browsers.
The FBI also recommended people use commercial VPNs… coincidentally they don’t need a warrant to spy on communications that leave the country
It's probably better to let them spy on your highly encrypted traffic going overseas than use a US based service considering that they can march into any US company and start collecting every bit of data (https://en.wikipedia.org/wiki/Room_641A)
> the average person's response is ... I'll just go ahead and continue to suffer with invasive ads
The real reason is that the average person neither suffers with ads nor finds ads invasive, despite what a vocal online minority would have you believe. We just ignore them and get on with life. ::shrug::
Ignoring (post-impact) and moving on is the natural thing to do, but it seems like a stretch to imply that the average person neither suffers or finds ads invasive.
The suffering isn't acute, it's death by a thousand cuts as your mind erodes into a twitchy mess. Look at the comment section of a nice youtube video and see people outraged at getting blasted with an ad at the wrong moment.
Most people don't like ads, but we love the stimulation of the screen more so we suffer them, regardless of the damage done.
>... it seems like a stretch to imply that the average person neither suffers or finds ads invasive.
The average person has never heard of HN. It isn't the case that the average person's experience with today's internet ads is that of having their "... mind erode[s] into a twitchy mess."
The average person doesn't look at the comment section of a nice YouTube video.
>Most [HN] people don't like ads....
Most people don't suffer — at least not consciously — as a result of ads.
I don't know why you're inserting HN into it? We're talking about average people, not nerds with ad-blockers. Are you suggesting that the average person enjoys being interrupted with ads?
> It isn't the case that the average person's experience with today's internet ads is that of having their "... mind erode[s] into a twitchy mess."
Perhaps I was a bit dramatic with my wording, but my point still stands. Since you're flatly denying it, perhaps you have some references? As far as I can tell, all signs are pointing to widespread ADHD increases correlated to computer use, which may not be directly tied to ads exclusively, it stands to reason that they're big offenders given their nature of being short, attention-grabbing, context-breaking, non-interactive engagements. There's plenty of studies that support this.
> The average person doesn't look at the comment section of a nice YouTube video.
Um, really?
> Most people don't suffer — at least not consciously — as a result of ads.
My point was it's death by a thousand cuts, boiling the frog, etc. The average attention span has been cut in half over the last 20 years. Also, I'd argue that sensitive people who may already be mentally stressed, which seems to be a growing group, might actually suffer in the short term or immediately.
You've made some strong statements, but I'm having a hard time buying them.
YT made sure adblockers ruin the experience. We really need a good YT alternative, as it has become AI slop (shorts) and most new videos are of real poor quality.
You’re not going to get a YT alternative if it can’t make money with ads.
Ooh this one's easy
Nebula
[dead]
Ad blockers focus on ads, not fingerprinting.
"Ad blockers" nowadays do much more. From the horse’s mouth, which describes itself as a “wide-spectrum content blocker” [1]:
“uBlock Origin (uBO) is a CPU and memory-efficient wide-spectrum content blocker for Chromium and Firefox. It blocks ads, trackers, coin miners, popups, annoying anti-blockers, malware sites, etc., by default using EasyList, EasyPrivacy, Peter Lowe's Blocklist, Online Malicious URL Blocklist, and uBO filter lists. There are many other lists available to block even more [...]
Ads, "unintrusive" or not, are just the visible portion of the privacy-invading means entering your browser when you visit most sites. uBO's primary goal is to help users neutralize these privacy-invading methods in a way that welcomes those users who do not wish to use more technical means.”
[1] https://github.com/gorhill/uBlock?tab=readme-ov-file#ublock-...
Appreciate the clarification, I would clarify to say the origin story of Ad blockers are ads, and the underlying behaviours may not capture everything that fingerprinting may do where people don't advertise.
Ublock is great, but I am finding fingerprinting that gets past it and that's what I'm referring to.
I'd like to install uBlock Origin, when I try, Chrome warns it needs the permission to, "Read and change all your data on all websites". That seems excessive, to give that much power to one extension. I currently use no extensions to keep my security posture high.
> "Read and change all your data on all websites"
What a silly complaint. How is an ad blocker supposed to work if it can't read and change the data on a website?
You might as well complain that your Camera app wants access to your camera.
> I currently use no extensions to keep my security posture high.
Ironically, skipping uBlock Origin because of the security concern is lessening your security posture. Are you familiar with the term "malvertising"?
https://github.com/gorhill/uBlock/wiki/Permissions
https://github.com/gorhill/uBlock/wiki/Can-you-trust-uBlock-...
https://github.com/gorhill/uBlock/wiki/Privacy-policy
https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...
I never get the fear behind extensions, at least not to the level where you wouldn't use an open-source extension that's extremely well vetted. And even if that isn't good enough for you, choosing to browse the web without using a content blocker is a far, far greater security risk.
Disable JS and you've eliminated the vast majority of fingerprinting (besides "blocks JS")
alternatively, css can script quite a bit... :)
No joke, CSS has gotten out of hand!
Depends on what lists you use. If you use uBlock Origin, and enable most of the lists, it'll target both.
I use uBlock Origin with basically every filter list enabled on Brave with their default blocker enabled. I just confirmed that this does not prevent the script from loading and scanning extensions. The browser tools network tab on LinkedIn is absolutely frightening.
NoScript will prevent that script from loading and scanning extensions. JS is required for almost all fingerprinting and malware spread via websites. Keeping it disabled, at least by default, is the best thing you can do to protect yourself.
According to the EFF fingerprinting website, Firefox + uBlock Origin didn't really make my browser particularly unique.
But turning on privacy.resistfingerprinting in about:config (or was it fingerprintingProtection?) would break things randomly (like 3D maps on google for me. maybe it's related to canvas API stuff?) and made it hard to remember why things weren't working.
Not really sure how to strike a balance of broad convenience vs effectiveness these days. Every additional hoop is more attrition.
Go try it with fingerprint.com. Even post-sanitization, pi-hole, you name it, it will be surprising.
fingerprint.com seems to be some fingerprinting vendor, they don't even offer a demo without logging in. https://coveryourtracks.eff.org is EFFs demo site is non-profit and doesn't require login
I have a lot of browser extensions running and am using Brave as my browser. I have their built in adblocker enabled as well as some of their privacy features turned on in the settings. I am also using a self hosted adblock instance for my DNS servers. I actually appear as random and not unique which is really nice to see. I know Brave does intentionally lean on some of the privacy side of things and it also has options to specifically prevent sites from fingerprinting by blocking things like seeing language preferences. I have to assume it is also doing some things in the backend to try and prevent other fingerprinting methods.
This is the Fingerprint demo page (the page itself is a demo): https://fingerprint.com/demo There's also https://demo.fingerprint.com for use case specific demos and more detail on the API response.
coveryoutracks always tells me I'm unique
Which is concerning. Until you realise I do the same thing a few days later and I'm still unique.
It tells you that you have a unique fingerprint.
It is not telling you that the test site has never seen you before, because the eff isn't storing your fingerprint for later analysis and tracking
It could actually tell you about which real tracking vendors are showing you as "Seen and tracked" so it's pretty annoying they don't do that.
If that site shows you as having a unique fingerprint, I guarantee you are being tracked across the web. I've seen the actual systems in usage, not the sales pitch. I've seen how effective these tools are, and I haven't even gotten a look at what Google or Facebook have internally. Even no name vendors that don't own the internet can easily track you across any site that integrates with them.
The fingerprint is just a set of signals that tracking providers are using to follow you across the internet. It's per machine for the most part, but if you have ever purchased something on the internet, some of the providers involved will have information like your name.
Here is what Google asks ecommerce platforms to send them as part of a Fraud Prevention integration using Recaptcha:
https://docs.cloud.google.com/recaptcha/docs/reference/rest/...
> the EFF isn't storing your fingerprint for later analysis and tracking
Yes they are, quoting that very page:
> Your browser fingerprint appears to be unique among the 312,935 tested in the past 45 days
So clearly they store the information for at least 45 days. This raises the question what they actually mean by unique. If I change my IP and re-test, I get the same
> Your browser fingerprint appears to be unique among the 312,941 tested in the past 45 days
So does that mean that my fingerprint changed, and they can't track me anymore? Or do they mean to tell me that they still track me and I'm still as uniquely identified.
Their methodology and linked articles does not seem to answer this [0] [1]
It's all very complicated, because the fingerprinting needs to be unique enough to identify you while still being "persistent" enough not to identify you as somebody else if you change just one bit of it.
[0] https://www.eff.org/deeplinks/2010/01/primer-information-the...
[1] https://coveryourtracks.eff.org/about
It must store the fingerprints to determine if I'm unique, otherwise everyone would be unique.
If it doesn't store the fingerprints then how does it tell the difference between
5 identical looking browsers connecting from 5 different IPs
1 browser connecting 5 times from 5 different IPs
> Every time you open LinkedIn in a Chrome-based browser
I thought uBlock Origin was now dead in Chrome?
I remember a few hacks to keep it going but have now migrated to Firefox (or sometimes Edge…) to keep using it.
Full uBlock Origin is dead in Chrome, yes, but https://github.com/uBlockOrigin/uBOL-home is the next best thing if you cannot leave Chrome
or Vivaldi is chrome based, and it supports full uBlock Origin. If you don't need CHROME chrome, that's even better imo
Surprisingly full uBO still works on Chrome 146 if launched with the argument
https://brave.com/privacy-updates/28-sunsetting-strict-finge...
[flagged]
Please don't fulminate on HN. The guidelines make it clear we're trying for something better here. https://news.ycombinator.com/newsguidelines.html
I'm curious what protection by the state do you think Americans receive?
None because it's a corrupt cesspool?
Nihilist blathering sounds cool.
> the state is a corrupt cesspool.
Exactly because no one in his right mind is going to work in "state". So the "state" is more like 95% "fucking idiots" as you put it, and that is self-reinforcing.
When has infantilizing adults resulted in positive outcomes? What if the group of idiots decide you're the idiot and start making decisions for your own good?
I asked an LLM to create a plan for a 'digital rebirth' in order to minimize privacy harms. It's a lot of work, but increasingly: a worthwhile endeavor.
Might as well have asked a bottomless pit to do the same and get a better result from all the reverberations inside your empty head.
I disagree, I think we should push back hard on behavior like this. What business is it of LinkedIn's what browser extensions I have installed? I think the framing for this is appropriate.
Why is it possible for a web site to determine what browser extensions I have installed? If there are legitimate uses, why isn't this gated behind a permission prompt, like things like location and camera?
This, to me, seems like the more salient point. A headline like “Major browsers allow websites to see your installed extensions” seems more appropriate here.
We’ve known for a long time that advertisers/“security” vendors use as many detectable characteristics as possible to constrict unique fingerprints. This seems like a major enabler of even more invasive fingerprinting and that seems like the bigger issue here.
Well it would be more appropriate headline if it would be about broken browser behavior.
But this is about major corporation sneakily abusing this to ilegally extract specific sensitive data which they are abusing.
It's possible to write a headline that directs blames at both parties: "Major Browsers Fail to Block Websites that Invade Your Privacy"
The fact that the website is doing this is a bigger problem than the browser not preventing it. If someone breaks into a house, it's the burglar who is prosecuted, not the company that made the door.
If you scanned LinkedIn's private network, you'd be criminally charged. Why are they allowed to scan yours with impunity? And why is this being normalized?
The best solution is a layered defense: laws that prohibit this behavior by the website and browsers that protect you against bad actors who ignore the law.
> If you scanned LinkedIn's private network, you'd be criminally charged. Why are they allowed to scan yours with impunity? And why is this being normalized?
First, I think it’s a major issue that Chrome is allowing websites to check for installed extensions.
With that said, scanning LinkedIn’s private network is not analogous to what is going on here. As problematic as it is, they’re getting information isolated to the browser itself and are not crossing the boundary to the rest of the OS much less the rest of the internal network.
Problematic for privacy? Yes. Should be locked down? Yes. But also surprisingly similar to other APIs that provide information like screen resolution, installed fonts, etc. Calling those APIs is not illegal. I’m curious to know what the technical legal ramifications are of calling these extension APIs.
What law is it breaking?
If a company leaks my sensitive data, I get some nice junkmail offering me some period of time of credit monitoring or whatever so what are browsers doing to prevent this?
The issue should never be 'We want entities to have this data but only use it in some constrained and arbitrary manner that we can't even agree about it's definition.' instead 'This data shouldn't be made available to X'
This is a Chrome thing. It’s a safe bet that if you use Google products you don’t care about privacy anyway. “Google product collects info about you: news at 11.”
Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone else unless you ask them to.
Google cares deeply about privacy. Google defines privacy as them not giving your private data that they have collected to anyone who hasn't paid them for it or can compel them to give it up.
There's a fourth amendment case on the Supreme Court docket (Chatrie v. U.S.) about Google searching a massive amount of user data to find people in a location at a specific time, at police request. The case is about whether the police's warrant warranted such a wide scope of search (if general warrants are allowed).
Point being: Google will 100% give your info to the police, regardless of whether the police have the legal right to it or not, and regardless of whether you actually committed a crime or not.
Bonus points: the federal court that ruled on the case said that it likely violated the fourth amendment, but they allowed the police to admit the evidence anyway because of the "good faith" clause, which is a new one for me. Time to add it to the list of horribly abusable exceptions (qualified immunity, civil asset forfeiture, and eminent domain coming to mind).
They knowingly participated in PRISM, too.
Why would the police go to all that hassle of compelling google to give it up when it can simply buy it on the open market.
The breaking point with me that caused me to de-google myself was finding out that Google was buying Mastercard records in order to cross-reference them with Android phone data. That shit is not okay.
Police do hit up google for data though. https://www.nbcnews.com/news/us-news/google-tracked-his-bike...
So no compelling here. The police asked for it and google gave it, either for free or in exchange for money. They didn't say "no" to the police, they didn't wait for a court order.
The bad guy here is google. And the people that champion data collection by private companies because of free market == good.
In that case, the main bad guy was the police who didn't bother to do even the most basic investigating after "check Google's GPS records to see who was at the house" including "Check Google's GPS records to see how how long they were there" which would have shown them this was a drive by, but yeah Google is absolutely a villain
Ah yes, I should have said I was describing the official line, not the behaviour. In all fairness the “can compel them to give it up” doesn’t seem to be optional but otherwise, yeah. Agreed.
> This is a Chrome thing.
This is blatant misinformation. Firefox (and all of its derivatives) also does this.
https://bugzilla.mozilla.org/show_bug.cgi?id=1372288
This only works if the web page knows the random per-install id associated with an extension.
That can only happen if the extension itself leaks it to the web page and if that happens, scanning isn't necessary since it already leaked what it is to the webpage. It also doesn't tell you what extension it is, unless again, the extension leaks it to the webpage.
The attack on Chrome is far more useful for attackers as web pages can scan using the chrome store's extension ID instead.
And this bug was reported eight years ago, with no serious attempt to fix it since.
It does two things:
1. Do a request to `chrome-extension://<extension_id>/<file>`. It's unclear to me why this is allowed.
2. Scan the DOM, look for nodes containing "chrome-extension://" within them (for instance because they link to an internal resource)
It's pretty obvious why the second one works, and that "feels alright" - if an extension modifies the DOM, then it's going to leave traces behind that the page might be able to pick up on.
The first one is super problematic to me though, as it means that even extensions that don't interact with the page at all can be detected. It's unclear to me whether an extension can protect itself against it.
> 1. Do a request to `chrome-extension://<extension_id>/<file>`. It's unclear to me why this is allowed.
Big +1 to that.
The charitable interpretation is that this behavior is simply an oversight by Google, a pretty massive one at that, which they have been slow to correct.
The less-charitable interpretation is that it has served Google's interests to maintain this (mis)feature of its browser. Likely, Google or its partners use similar to techniques to what LinkedIn/Microsoft use.
This would be in the same vein as Google Chrome replacing ManifestV2 with ManifestV3, ostensibly for performance- and security-related purposes, when it just so happens that ManifestV3 limits the ability to block ads in Chrome… the major source of revenue for Google.
The more-fully-open-source Mozilla Firefox browser seems to have had no difficulty in recognizing the issues with static extension IDs and randomizing them since forever (https://harshityadav.in/posts/Linkedins-Fingerprinting), just as Firefox continues to support ManifestV2 and more effective ad-blocking, with no issues.
> This would be in the same vein as Google Chrome replacing ManifestV2 with ManifestV3, ostensibly for performance- and security-related purposes, when it just so happens that ManifestV3 limits the ability to block ads in Chrome… the major source of revenue for Google.
uBlock Origin Lite (compatible w/ ManifestV3) works quite well for me, I do not see any ads wherever I browse.
The mv3 problem was never about "does it work now". It was about "can it keep up". Ad blocking is a cat and mouse game, and the mouse is kneecapped now. You're being slow boiled.
Well said. I'm glad that as blockers have managed to develop effective approaches under Mv3, but it took a tremendous amount of engineering effort that was only necessary because Google was trying to impose these very large costs on them.
> chrome-extension://<extension_id>/<file>
These are web accessible resources, e.g. images and stylesheets you can reference in generated HTML. Since content scripts operate directly on the same DOM, it’s unclear how you can tell an <img> or <link> came from the modification of a content script or a first party script. You might argue it’s possible to block these in fetch(), but then you also need to consider leaks in say Image’s load event.
This behavior has been improved in MV3, with option to make the extension id dynamic to defeat detection:
> Note: In Chrome in Manifest V2, an extension's ID is fixed. When a resource is listed in web_accessible_resources, it is accessible as chrome-extension://<your-extension-id>/<path/to/resource>. In Manifest V3, Chrome can use a dynamic URL by setting use_dynamic_url to true.
This should really be the default though.
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
For widget style services: If you need the functionality of an extension to operate, then you can check if it's already installed so you don't ask to install it again.
This is better than forcing the extension to announce it's presences on every web site.
Agreed, but also, permission prompts are way overused and often meaningless to anyone at all, even fellow software engineers. “This program [program.exe] wants to do stuff, yes/no?” How should I know what’s safe to say yes to?
I think Android’s ‘permissions’ early on (maybe it’s improved?) and Microsoft’s blanket ‘this program wants to do things’ authorisation pop up have set a standard here that we shouldn’t still be following.
Generally the whole thing needs to be flipped upside down. Extensions is the easy one, there's not reason a random website can list your installed extensions, zero.
For other capabilities, like BlueTooth API, rather than querying the browser, assume that the browser can do it and then have the browser inform the user that the site is attempting to use an unsupported API.
Because Google.
Who makes browsers? Ad companies.
Of course Google is going to back door their browser.
> Who makes browsers? Ad companies.
> Of course Google is going to back door their browser.
Aside from the fact that other browsers exist, this makes no sense because Google would stand to gain more by being the only entity that can surveil the user this way, vs. allowing others to collect data on the user without having to go through Google's services (and pay them).
To broaden my point, I think we’d find that many websites we use are doing this.
My point isn’t that this is acceptable or that we shouldn’t push back against it. We should.
My point is that this doesn’t sound particularly surprising or unique to LinkedIn, and that the framing of the article seems a bit misleading as a result.
I've love it if LinkedIn got successfully sued for millions and it resulted in similar lawsuits against every other website that did this sort of thing.
> To broaden my point, I think we’d find that many websites we use are doing this.
Your point of "I think we’d find that many websites we use are doing this" doesn't make LinkedIn's behavior ok!
By your logic, if our privacy rights are invaded which is illegal in most jurisdiction, and then it become ok because many companies do illegal things??
Absolutely not. At no point am I saying this is ok.
I’m saying that the framing of the article makes this sound like LinkedIn is the Big Bad when the reality is far worse - they’re just one in a sea of entities doing this kind of thing.
If anything, the article undersells the scale of the issue.
You really need to work on your reading comprehension, dude.
> What business is it of LinkedIn's what browser extensions I have installed?
The list of extensions they scan for has been extracted from the code. It was all extensions related to spamming and scraping LinkedIn last time this was posted: Extensions to scrape your LinkedIn session and extract contact info for lead lists, extensions to generate AI message spam.
That seems like fair game for their business.
And instead LinkedIn is scraping all users computers?
This doesn’t fit the description of scraping by any normal definition. It’s a classic feature probe structure, where the features happen to be scraping extensions.
I think it’s kind of funny that HN has gone so reactionary at tech companies that the comments here have become twisted against the anti-spam measures instituted on a website that will never trigger on any of their PCs, because HN users aren’t installing LinkedIn scrape and spam extensions.
HackerNews users used to be the type that would do the scraping, so they could Hack the data into whatever format or integration they desired.
It's unfortunate to see folks here who don't support that – interoperability is at the heart of the Hacker Ethic. LinkedIn (along with any other big tech companies locking down and crippling their APIs) is wrong to even try to block it.
Is it an issue of the resources scrapers consume? No: Even ordinary users trying to get API access on a registered persistent account linked to their name are stymied in accessing their own data. LinkedIn simply doesn't want you to access your own data via API, or in any manner that isn't blessed by them. That ain't right.
LinkedIn has an API you can use at your convenience: https://learn.microsoft.com/en-us/linkedin/
Accessing other users' LinkedIn data via the API requires their OAuth consent, as it should be. But you are welcome to access your own data via the API.
Can I, an ordinary user, get access to that API and use it to fetch my messages?
Last time I checked, I could not.
> The list of extensions they scan for has been extracted from the code. It was all extensions related to spamming and scraping LinkedIn
Not according to the website which says:
The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify). Under GDPR Article 9, processing data that reveals religious beliefs, political opinions, or health conditions requires explicit consent. LinkedIn obtains none.
It also scans for every major competitor to Microsoft’s own products — Salesforce, HubSpot, Pipedrive — building company-level intelligence on which businesses use which software. Because LinkedIn knows your name, employer, and role, each scan aggregates into a corporate technology profile assembled without anyone’s knowledge.
Sounds a little like "OpenAI must protect itself against copyright infringement by any means necessary, including copyright infringement of everyone else"
If I had to guess, LinkedIn would be primarily searching for extensions that violate their terms of service (e.g. something that could be used to scrape data). They put a lot of effort into circumventing automated data collection. I could be wrong.
> I think we should push back hard on behavior like this.
Indeed, so I gather all of you have canceled your LI account over this?
I never made one in the first place because it was pretty clear to me that this company - even before the acquisition - had nothing good in mind.
So why not say that LinkedIn is murdering people? I mean, if all you care about is raising awareness with maximal clickbait...
[flagged]
This has been covered several times including reverse engineering of the code. The list of extensions they check for doesn’t include common extensions like ad blockers. It’s exclusively full of LinkedIn spamming and scraping type of extensions.
They also logically don’t need to fingerprint these users because those people are literally logging in to an account with their credentials.
By all appearances they’re just trying to detect people who are using spam automation and scraping extensions, which honestly I’m not too upset about.
If you never install a LinkedIn scraper or post generator extension you wouldn’t hit any of the extensions in the list they check for, last time I looked.
it apparently scans for something like "PQC Checker", an extension for checking if TLS connection is PQC-enabled? how is that a spam extension (and thats just a random one i saw)
Probably compromised extensions or misleading extensions.
It’s common for malware extensions to disguise themselves as something simple and useful to try to trick a large audience into installing them.
That’s why the list includes things like an “Islamic content filter” and “anti-Zionist tagger” as well as “neurodivergent” tools. They look for trending topics and repackage the scraper with a new name. Most people only install extensions but never remove them if they don’t work.
well if they have evidence why they dont report it? why are these extensions on the store? im sure linkedin has enough motion to report it directly to google
also, having a PQC enabled extension doesnt seem like a good "large user base capture" tactic.
the source code is as usual obfuscated react but that doesnt mean its malicious...
EDIT: i debuged the extension quickly and it doesnt seem to do anything malicious. it only sends https://pqc-extension.vercel.app/?hostname=[domain] request to this backend to which it has permissions. it doesnt seem to exfiltrate anything else. it might get triggered later but it has very limited permissions anyway so it doesnt seem to be a malicious extension. (but im no expert)
> well if they have evidence why they dont report it? why are these extensions on the store?
We had a browser extension for our product. A couple times a month someone would clone it, add some data scraping or other malware to it, and re-upload it with the same or similar name.
We set up automated searches to find them. After reporting it could take weeks to get them removed, some times longer. That’s for extensions with clear copyright problems!
The extensions may not be breaking any rules of the extension stores if they’re just scraping a website. Many of the extensions on the list are literally designed to do that as their headline feature.
If you think sending data from a page to a server would disqualify an extension from an extension store then think again. Many of the plugins listed even have semi-plausible reasons for uploading the scraped data, like the “anti-Zionist tagger” extension on the list or the ones that claim to blur things that are anti-Islam. Manufacturing a reason to send data to their servers gives them cover.
I am aware that google will take looong time to act. that is why I mentioned that it is LinkedIn (Microsoft) or its contracted fingerprinting/"monitoring" partner who may have more direct ways to report this if they actually investigate malicious extensions.
but that doesn't really matter. for the sake of the argument assume the extensions are not malicious (as evidenced e.g. by the PQC one with ?16 users?) does that change the situation?
Probably compromised extensions or misleading extensions.
You'll have to do better than "Probably."
What is it about the tech bubble that compels people to proactively apologize for and excuse the bad behavior of trillion-dollar companies?
To think that there's any one class of behavior motivating them is missing the point. This was all pretty well-documented a couple of months ago. (Previously: <https://github.com/mdp/linkedin-extension-fingerprinting> 244 comments. 2026 February 5. 534 points. <https://news.ycombinator.com/item?id=46904361>)
They're doing a lot more than scanning for "compromised or misleading extensions"; there are a lot of scummy/spammy extensions on the list, but among the extensions included in the list of those they probe are also extensions such as:
- "LinkedNotes" (basically the Personal Note feature from Mastodon, but on LinkedIn profiles) <https://chromewebstore.google.com/detail/neefoldancbjljnnnpn...>
- "Highlight multiple keywords in a web page", an extension that re-implements the equivalent Firefox's "Highlight All" findbar button in Chrome—and happens to mention LinkedIn in the description when describing one use case <https://chromewebstore.google.com/detail/ngkkfkfmnclhjlaofbh...>
- "Delayed gratification Research", a study/focus extension created "for OS semester at CODE University of Applied Sciences" to "Temporarily Block distracting websites"—with all of 4 active users <https://chromewebstore.google.com/detail/mmibdgeegkhehbbadeb...>
It's pretty clear that LinkedIn, like many website operators, don't think of themselves as a source of information that it will send to your UA upon request. It's not even just that they want total visibility into your habits like the worst of the advertising/tracking companies. What they want is as control as they can manage to wrangle over the experience of what it's like when you're "on" their site (i.e. looking at something on your computer that came from their site)—not least of all so they can upsell their userbase on premium features. LinkedIn doesn't care so much that people are inundating other users/orgs that might not appreciate that they're being treated as a "lead", so much as LinkedIn cares that the people doing the inundating are doing it with tools where LinkedIn wasn't able to get a cut.
It is likely in response to scraping. Linked in is heavily scraped by scammers who do the BEC scams. So linked in is trying to find ways to link together banned accounts, to handle their ban evasion.
I run a site which attracts a lot of unsavoury people who need to be banned from our services, and tracking them to reban them when they come back is a big part of what makes our product better than others in the industry. I do not care at all about actually tracking good users, and I am not reselling this data, or anything malicious, it's entire purpose is literally to make the website more enjoyable for the good users.
>Linked in is heavily scraped by scammers who do the BEC scams.
It's also heavily scraped by businesses for lead generation for sales and recruiting. Either before their API became available or to not pay them or to get around the restrictions of their API.
Understandable, and yet none of that makes it ok.
> it's entire purpose is literally to make the website more enjoyable for the good users.
There are people who actually enjoy using LinkedIn?
> expect to find in modern browser fingerprinting
No. Don't need extensions for that. See how Cloudflare Turnstile does it, recently popped up at https://news.ycombinator.com/item?id=47566865 cause ChatGPT uses it now:
Layer 1: Browser Fingerprint WebGL (8 properties): UNMASKED_VENDOR_WEBGL, UNMASKED_RENDERER_WEBGL, WEBGL_debug_renderer_info, getExtension, getParameter, getContext, canvas, webgl
Screen (8): colorDepth, pixelDepth, width, height, availWidth, availHeight, availLeft, availTop
Hardware (5): hardwareConcurrency, deviceMemory, maxTouchPoints, platform, vendor
Font measurement (4): fontFamily, fontSize, getBoundingClientRect, innerText. Creates a hidden div, sets a font, measures rendered text dimensions, removes the element.
DOM probing (8): createElement, appendChild, removeChild, div, style, position, visibility, ariaHidden
Storage (5): storage, quota, estimate, setItem, usage. Also writes the fingerprint to localStorage under key 6f376b6560133c2c for persistence across page loads.
Scanning for 6000 extensions is anti-competitive, surveillant and immoral.
> I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister
This seems like a really weird argument to make. The fact that the platform doesn't provide a privacy-violating API is not an extenuating circumstance. LinkedIn needed to work around this limitation, so they knew they're doing something sketchy.
For the record, I don't think they're being evil here, but the explanation is different: they're don't seem to be trying to fingerprint users as much as they're trying to detect specific "evil" extensions that do things LinkedIn doesn't want them to do on linkedin.com. I guess that's their prerogative (and it's the prerogative of browsers to take that away).
What are the religious-related extensions described in the article doing that's "evil"?
Judging from the fact that 99% of the list seem like data-mining scam apps or spam tools, I suspect that's the answer in these cases too.
If LinkedIn really wanted to profile your religious beliefs, they would presumably go after the most popular religion-related extensions, not some "real-time AI for Islamic values" thing with 6k users.
Well, that's precisely what is sinister here.
Those profiling tools don't really care which features are going to be used for predictions. It's just machine learning, and it's indiscriminate. So if you have an extension that correlates with you being Muslim, it will be used for whatever ML predictions they give to other companies, and the worst case will be another "oh we didn't do this intentionally".
Of course, that's not the first time this ever happened in human history, so even if it's not "something inherently sinister", it's just "criminal negligence".
Why is JavaScript running in a page even allowed to know what extensions I have? Is this also what sites use to see I've got an ad blocker?
Just run everything in a safe environment that it can't look out of.
The page isn't allowed to know what extensions you have, instead LinkedIn is looking for various evidence that extensions are installed, like if an extension was to create a specific html element, LinkedIn could look for evidence of that element being there.
Since the extensions are running on the same page as LinkedIn (some of them are explicitly modifying the LinkedIn the website) it's impossible to sandbox them so that linked in can't see evidence of them. And yes this is how a site knows you have an ad blocker is installed.
Page can know what your chrome extensions are, even when your extensions don't interact with the site, by fetching `web_accessible_resources`: https://browserleaks.com/chrome#web-accessible-resources-det... . uBO mitigates this partly by generating internal secret tokens for each request: https://github.com/gorhill/uBlock/tree/master/src/web_access... .
However, there are other proof of concept of another attack vector to bypass this by using timing difference when fetching those resources.
I help maintaining uBO's lists and I've seen one real world case doing this. It's a trash shortener site, and they use the `web_accessible_resources` method as one of their anti-adblock methods. Since it's a trash site, I didn't care much later.
> I’m not deeply familiar with what APIs are available for detecting extension
Here is what the article says:
Method 1
Method 2 The API is making an HTTP request to There is then a second stage where they walk the DOM looking for text signatures and element attributes indicative of the store_id valuesIt looks like the user has the freedom to manage this by launching chrome with this flag: --disable-extensions
It also seems there is an extension for extension management to deny extension availability by web site: https://superuser.com/questions/1546186/enable-disable-chrom...
> The scan probes for thousands of specific extensions by ID, collects the results
Why exactly does Chrome even allow this in the first place!? This is the most surprising takeaway for me here, given browser vendors' focus on hardening against fingerprinting.
Firefox FTW. I was relieved to find this was a Chrome-only problem.
Turns out Firefox has a similar issue, despite mitigations :( https://bugzilla.mozilla.org/show_bug.cgi?id=1372288
This only happens if the extension puts their `moz-extension://` links into the DOM. It's different to chrome case where extensions can be detected regardless of being activated on that site or not.
As I understand it, an extension could also leak its links via its own backend, e.g. to advertisers, who could then detect it even though no user-observable DOM modification is happening.
Much better than static global IDs, but still not ideal.
Yeah, anything happening in backend depends totally on the extensions. Unless I need something, I rarely use extensions that are closed-source or open-source but has some sending data in their features.
[dead]
For what it's worth - and I'm not saying that LinkedIn is doing this for the right reasons - I can imagine a frontend QA team wanting to do this to understand how prominent certain extensions are for users of various parts of their product, correlating those extensions against frontend bug reports, and using that to guide QA procedures with real-world extension sets.
When you're literally the company that invented Kafka for your clickstreams, "everything looks like a nail."
(More likely, though, this is an anti-scraping initiative, since headless browsers are unlikely to randomize their use of extensions, and they can use this to identify potential scrapers.)
> the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).
Your computer is your private domain. Your house is your private domain. You don't make a "getAllKeysOnPorch()" API, and certainly don't make "getAllBankAccounts()" API. And if you do, you certainly don't make it available to anyone who asks.
It absolutely is sinister.
> I’m certainly not endorsing it, do think it’s pretty problematic, and I’m glad it’s getting some visibility. But I do take some issue with the alarmist framing of what’s going on.
Speaking has someone who shares the same lack of surprise, perhaps some alarm is warranted. Just because it’s ubiquitous doesn’t mean it’s ok. This feels very much frog in boiling water for me.
Why do you think the alarmist framing is unwarranted?
I do think a degree of alarm is appropriate.
But it’s critical to sound the correct alarm.
To me, it seems like the authors pulled the fire alarm for a single building when in reality there’s a tornado bearing down.
And by doing so, everyone is scrambling about a fire instead of the response a tornado siren would cause.
They’re both dangerous and worthy of an immediate reaction, but the confusion and misdirection this causes seems deeply problematic.
When people realize the fire wasn’t real, they start to question the validity of the alarm. The tornado is still out there.
I realize this analogy is a bit stretched.
As someone who has spent quite a lot of time steeped in security/privacy research, the stuff described in the article has been happening pervasively across the industry.
People absolutely should be alarmed. Many of us have been alarmed for quite some time. Raising the alarm by saying “LinkedIn is searching your computer” isn’t it.
I think this is a great analogy. I read quite a bit of the site and it's wildly blown out of proportion and severely lacking in context.
How many phone apps do you think are trying to detect what else is installed on your phone? I was part of an acquisition of a company with a very large mobile user base and our new parent was shocked we weren't trying to passively collect device information like this. They for sure were.
And on the flip side, as others have done well to point out, there are a LOT of legitimate reasons to fingerprint users for anti-fraud/abuse and I am 100% convinced that we're all better off for this.
Maybe thats all this story is about, maybe not, but this article leaves out an incredible amount of complexity.
Just because someone lets the electrician (LinkedIn) into their home (browser) doesn't mean they can do whatever the hell they want that isn't expressly prohibited. If the electrician wants to rifle through my desk drawers, they should ask for permission, and I will politely tell them to leave.
If your electrician was known to be hostile like the Internet, then you'd put locks on your drawers.
The browser security model right now is more like those completely ineffective "gun free zone" signs cities tack up in public parks.
I worked for a company that sold b2b contact data and they had (maybe still have) a linkedIn extension. It basically enriched the linkedIn profile. I wonder if linkedIn is trying to block these, or heavily target, in some way, these types of users to push folks towards their sales navigator.
Your post sounds like "it sounds bad, but it's no different from what others do, so it's not that bad."
I would put it more like: it sounds bad, and it's no different from what others do, so they're all that bad.
The fact that they're working around an API limitation doesn't make this better, it just proves that they're up to no good. The whole reason there isn't an API for this is to prevent exactly this sort of enumeration.
It's clear that companies will do as much bad stuff as they can to make money. The fact that you can do this to work around extension enumeration limits should be treated as a security bug in Chrome, and fixed. And, while it doesn't really make a difference, LinkedIn should be considered to be exploiting a security vulnerability with this code.
The bigger problem I see here is browser security and Javascript as a whole. Browsers should not be allowed to extract and send such vast amounts of information in the first place, especially without the user's consent. At most, they should return a few broad things such as browser type (major version), language perhaps, and device type (mobile/desktop). That's it. Other things, such as exact resolutions, time zones, and other hardware identifiers make it trivially easy to track users across the Internet. Now that it's too late to revise Web standards, browsers should default to return spoofed values for all the rest.
I get the point you're making, but to be clear, "they’re checking to see if you’re a Muslim" vs "they’re checking to see if your fingerprint matches that of known Muslims in our ever-expanding database" are not too far off.
I'm confused, you call this "misleading" then quote the claim, but say it's "what [you'd] expect to find in modern browser fingerprinting code".
So what is it? Misleading, or exactly what you expected to find? It cannot be both.
It sounds more like you object to the negative framing of Microsoft hoovering up as much data as possible for profit, even though this is objectively a crime in the jurisdictions they are being sued in.
I've been avoiding Chrome-based browsers for many years now but have only recently become aware of how catastrophically low the Firefox market share is. I'm kind of shocked that more people aren't choosing to avoid Chrome.
> It also seems like what I’d expect to find in modern browser fingerprinting code.
Time to figure out if I can make FireFox pretend to be Chrome, and return random browser extensions every time I visit any website to screw up browser fingerprinting...
The tracking described is extremely invasive. You say you are not endorsing it but you are certainly normalizing it. This is unacceptable.
The people behind this URL are trying to hold Microsoft accountable. The power to them.
> I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.
We should not normalise nor accept this behaviour in the first place.
To flip it around, if one of those chrome extensions saved parts of the contents of the page it was on into a database, and I had the chrome extension navigate around on LinkedIn for me, collecting information, LinkedIn would sue me for CFAA violations because I'm scraping them for email addresses and phone numbers. This is not theoretical either, as LinkedIn has sued people in the past for scraping.
> sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”)
Then why search for PordaAI or Deen Shield? Or more specifically, since getAllExtensions() would return them, why would they be on the "scan list", instead of just ignored?
> no available getAllExtensions()
Well great there is no avalable 'getAllFiles()' or such either because they'd be scanning your files for "fingerprinting" as well.
> alarmist framing
Well they literally searching your computer for applications/extensions that you have installed? (and to an extent you can infer what are some of the desktop applications you have based on that too)
There is clear rules around what you can and can't do to fingerprint users. if it's being done overtly, covertly, obscurely, indirectly, all for the same result through direct or indirect or correlated metadata it ends up with the same outcome.
My understanding is the rules and laws are to prevent the outcome, by any means, if it's happening.
But I do take some issue with the alarmist framing of what’s going on.
I’ve come to mostly expect this behavior from most websites that run advertising code
We should be alarmed that websites we go to are fingerprinting us and tracking our behavior. This is problematic, full stop. The fact that most websites are doing this doesn't change that.
Javascript can query chrome extensions [1] and much more [2].
[1] - https://browserleaks.com/chrome
[2] - https://browserleaks.com/javascript
This blows my mind. What good reason is there for giving javascript such permissions by default? This should at the minimum trigger an explicit permission request from the user.
My guess would be that the internet is run by developers. Apps will want this data so javascript provides it to make decisions about window sizing and user agent capabilities. Authorization would probably only occur if javascript was gated by non developers just as SSDP open and forwards ports on routers without user intervention or knowledge rather than an API that prompt the user. Just a guess.
More [1]
[1] - https://www.whatsmyip.org/more-info-about-you/
> It also seems like what I’d expect to find in modern browser fingerprinting code.
Exactly what I think it is. It's all for tracking and ultimately for advertisement. Linkedin can get exactly who you are and then they share that data with ad companies to better target you.
Really gross behavior.
> The headline seems pretty misleading.
Yes. I was expecting LinkedIn was connecting to extensions that are using their exhanced privileges to scan your computer, per the "LinkedIn Is Illegally Searching Your Computer" headline.
Instead, LinkedIn is scanning for extensions.
> But I do take some issue with the alarmist framing of what's going on.
On the contrary, your framing is quite defeatist IMO. The fact that stores get robbed frequently does not mean we should just normalize that and accept it as a fact of life.
> i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”
But I bet they could reliably guess your religious affiliation based on the presence of some specific browser extensions.
They already have so much telemetry from your phone, IP, etc.
God forbid they make an educated guess based on your actual LinkedIn connections, name, interests, etc.
>this is why I run ad blockers.
It's important to note that this isn't fixed by ad blockers. To avoid this kind of fingerprinting, you need to disable JavaScript or use a browser like Firefox which randomizes extension UUIDs.
Yes, but FF also prevents the extension scanning. It's scandalous that Chrome allows this!
How does this scan happen. AFAIK there is no API for a webpage to scan for extensions. The most a page could do is try to figure out indirectly if an extension exists if that extension leaks info into the page.
The next step for a forensic investigator, is to found out how many of those extensions, are actually from a partner or fully owned subsidiary from LinkedIn... When you see a cockroach...
> this is why I run ad blockers.
What's been really obnoxious lately is the number of sites I try to do things on that are straight up broken without turning off my ad-blocker.
I wonder if their motivation for doing this is to detect the LinkedIn automation tools that power all the spam messaging and connection requests?
"The headline seems pretty misleading."
How? What exactly would a reader be "mislead" to believe
The part about "inherently sinister" seems to be a thought from the mind of an HN commenter not the authors of the submitted web page. The later only describe LinkedIn's actions as illegal, not "sinister". The laws cited by the authors do not appear to consider any "state of mind", e.g., "sinister", or intent as relevant
"But I do take some issue with the alarmist framing of what's going on."
AFAICT, the submitted web page does not suggest that anything LinkedIn does is "dangerous", i.e., cause for "alarm". What it suggests is that LinkedIn's actions _violate European privacy laws_. The authors claim LinkedIn's actions present an opportunity to enforce these laws, i.e., "take action"
https://browsergate.eu/why-its-illegal/
https://browsergate.eu/take-action/
*misled
I agree. The first paragraph on the page implies the javascript can natively search your machine (vs. via Browser Extensions)
Android had a similar feature, but google removed it because it was invasive and being misused to target people.
I wonder if this is part of the reason why LinkedIn tabs seem to use so much ram, and sometimes run away CPU processes.
> The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers.
Why is this even possible in the first place? It's nobodies business what extensions I have installed.
> "they're checking to see if you're a Muslim"
This could be easily inferred from the depth, breadth, and interconnectedness of data in the website.
By downplaying it, it's allowing it to exist and do the very thing.
The issue here is this stuff is working likely despite ad blockers.
Fingerprinting technology can do a lot more than just what can be learned from ads.
From the site:
"The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify). Under GDPR Article 9, processing data that reveals religious beliefs, political opinions, or health conditions requires explicit consent. LinkedIn obtains none." https://browsergate.eu/extensions/
My biggest gripe is why these JS APIs even exist in the first place
Which browsers in which mode (normal/private) are affected?
But what would be the benefit of them doing that?
>vs. something inherently sinister
This is inherently sinister.
this is obviously not fingerprinting code to anyone with a brain, it's about scraping
extensions create so many bug reports, I would do the same
Your expectations do not matter here frankly. This reads like CFAA to me, unauthorized access.
linked in is scummy but yes I was puzzled by how linked in could scan your comouter from the browser. when i saw they meant extensions I thought aha.
[dead]
[dead]
> The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them
And probably also vibe-coded therefore 2 tabs of LinkedIn take up 1GB of RAM (was on the front page a few days back).
I don't have a linkedin acct. So imagine my shock when I "googled" myself and found a linkedin profile connecting my name to a company I presently have a consulting arrangement with (1099 not W2). I went ballistic and fired off an email to the consulting firm to take down the profile immediately or face legal action (a bluff). Couple days later, the company forwarded an email they received from linkedin confirming the profile had been taken down.
So this is just a heads up that even if you don't have a linkedin account, they will create one on your behalf so might better check (assuming you neither have nor want one).
What's the path for that to even happen?
Are companies now commonly uploading lists of employees to LinkedIn? Is this happening automatically because you got an e-mail account from the company and the company runs on MS Office and you're identified as am employee within it? What triggered it?
This seems like somewhat of a scandal that deserves its own post, but it also needs a lot more details to be trustworthy and for people to understand what exactly is happening.
Also, was there some way for you to take ownership of the profile? Did it depend on verifying a certain e-mail address? Does it require you to get the company to remove it, or could you take ownership and then delete the LinkedIn account/profile yourself?
I rather suspect the information was siphoned to linkedin from the payroll company the consulting firm was using. While there are a zillion small consulting firms, there are a small number of firms which process their payroll (whether to employees or independent contractors like myself). I have no evidence to back this up but after thinking it through, it made more sense than every little mom/pop/medium size niche company all cooperating with linkedin vs a hand full of mega payroll consolidators selling aggregated lists to linkedin. Again, speculation on my part.
That is extremely disturbing to hear!
What is the benefit that the company derives from that? Kickbacks from LinkedIn? I'm not saying it is, or isn't, I don't understand what the benefit to be gotten from it is. It seems like a lot of effort by one party or the other, unless it is "baked in" to an MS account or whatever.
Also, as the person above had asked: did you have any option/ability to "take control" of the account, or did it have to go through the consulting company was using? It almost feels like someone had a fake ID card made for you. Not a drivers license, but something that would be of greater concern to the person on the ID (LinkedIn profile) than the company making it.
Interesting. That's a possibility... but how much information did the LinkedIn account have? Did it have your full job title? I'm not sure how much information is shared with payroll providers.
Again, there's no real reporting on the internet of LinkedIn creating profiles for people without their consent. If you have any documentation and details, this is the kind of thing worth posting here in full detail and/or contacting a journalist about. Of course, if it was in the past you might not have any of that info anymore.
It reminds me of that thing I had heard of people doing on Facebook years ago. Someone wouldn't have a Facebook account "yet", so one of their friends/family/whomever would create one on their behalf with an assumption that they were being helpful to the other party. "It's all ready to go once you want to login! I knew your email address, so just do a password reset when you start using it. You're welcome!"
I believe even an episode of South Park covered it.
The difference there being that, with the Facebook relationship status stuff, spouses were feeling societal pressure to show a public declaration and "proof" of their partners existence/mutual status. With something like LinkedIn though...does that same sort of pressure exist? Are Hiring Managers (or whomever) feeling some kind of professional pressure to "prove" how many real life people work with/for their company? Does getting the number of users marked as working for that company above a threshold give them secret, special privileges in some locked-off business area of LinkedIn? Or is it just pure clout chasing? It's very odd. It feels like a violation in some way I can't really articulate. "Compulsory volunteer account-to-ID association"? I don't know what to call that. It's gross.
We used to have to destroy org charts and handbooks so that our companies wouldn't get hacked, not they just throw that out the windows and act shocked when something happens.
Yeah. Generally companies would prefer their employee lists not not public. It opens them up not just to social engineering hacking, but also everyday poaching.
I understand why LinkedIn would want more profiles. Hard to understand why a company you work for would be cooperating with them. And if they have the power to take your profile down then they're aware of it. Very strange.
I’ve seen fake accounts created by bad actors attempting to pose as others for gaining remote employment. It’s possible that is what was happening, and the takedown was from LI taking down the profile from the bad actor.
Other times they would just link to real LinkedIn profiles, but the LinkedIn profile will say that they’re not actively looking and are a victim of id fraud basically.
It’s been a huge issue spotting candidates falsifying information since remote work took off unfortunately. They payout is if they can get at least 1 or 2 paychecks before being found out, they’ve made a good profit.
Of all the reading I've done on this story, your comment so far is the only post which would explain why linkedin is even doing this.
If anyone else as any more info on the why, please share.
Are you sure they took it down completely, not just removed from public eyes? Majority of LinkedIn income is from businesses, they might still sell it in some form (e.g. stats/aggregates).
A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are.
Anyway, what they're calling "spectroscopy", is a combination of extension probing and doing residue detection (looking for what extensions might leave behind in the DOM).
An ad blocker is not necessarily equipped to help since the script is embedded with the application code. Since they're targetting Chrome, switching browsers will help with the probing but not the detection part and you'll still be fingerprinted.
The only way forward is for browser vendors to offer a real privacy or incognito mode where sites are sandboxed by default. When the default profile is identical across millions of users there won't be anything unique to fingerprint.
It's the typical Microsoft playbook, where they release a product and convince everyone that it has to be used everywhere, and by the time people realize how unbelievably terrible the product is it's too late and it has entrenched itself everywhere.
They've run this experiment before; Windows is terrible and has been for a very long time, Microsoft Office is terrible and has been for a very long time, Sharepoint is terrible and has been for a very long time, LinkedIn is terrible and has been for a very long time, etc.
It's what they do, there is not a single thing that Microsoft does not half-ass, because all they focus on is getting embedded into places, and that does not require that any of their products be good.
> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are.
For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years.
That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my examples, but just saying fingerprinting itself without explicit disclosure has been around for quite a long time. It happens on literally every CAPTCHA service. I hate it of course, but the ship sailed a long time ago.
--
I like this demo for testing my browser's resilence against fingerprinting: https://fingerprint.com/demo/
Have you (or anyone reading this) been able to "beat" fingerprint.com without Tor or turning JavaScript off outright?
I've tried it various times over the last couple years, using different browsers with various privacy settings enabled and a VPN.
I can get good partial results and am able to reset my fingerprint by changing my OS and browser at the same time, so it's not entirely there with regards to sniffing the hardware. But I can never revisit the site and have it not recognize me. Is there no one but me using (for example) Debian testing Librewolf with resistFingerprinting on Proton VPN? If there are others, then resistFingerprinting is doing a bad job hiding my hardware.
That's depressing! Despite our genuine best efforts, enough identifiers leak that it seems to me there's no practical solution. I am genuinely at a loss for what we can do.
(If you're reading this and think it doesn't matter, it's possible you're not realizing that this means that any site collecting and storing these identifiers now will be able to talk to any site in the future and link your identity. Your past actions on every website on a given piece of hardware are liable to be linked to create a detailed profile in the future, so even if Reddit and Pornhub and Discord and the government aren't talking to each other now, you can put some decent probability in the fact that if they decided to share identifiers, they could link all your historical (signed out) activity to your real-world identity without much effort. I use those sites as examples because they're sites where people tend to generate information that they may want private, but they visit using the same hardware identifiers.)
It is depressing how robust it is!
I can beat it, but only be changing my IP. Since I'm not using a shared IP like a university/company might, my IP is giving them a lot of bits about me since I'm the only entity using it... No matter the browser switch, if I hit it from the same IP, it correctly assumes that my IP is still me. But the moment I switch to a different browser and change IPs I get a new fingerprint. Haven't dug deep on it though, like would an incognito window in Chrome on a new IP, have the same fingerprint as a non-incognito Chrome window on another IP? Not sure
I would love to play around with that fingerprint demo while on a large shared IP, where they the IP itself provides less signal and is less unique.
Fingerprint (and its ilk) use a tiered identification system to identify you, with a decrease in confidence with each step down.
They start with a supercookie approach (first-party cookies, third party cookies, indexdb, localstorage, session storage, favicon timing, etc) which is a direct look up, and unique. This is tier-1.
Next they slam as many signals as they can get your browser and network to cough up into an ML db and find your nearest neighbor. If its greater than threshold ${x} - they return its ID with a confidenc of say 85%
If that misses, they slide down to tier 3 which is your IP address plus some browser signals on a TTL so they don't just call everyone with your IP address "you". This is maybe say 50% confident.
Below that, they create a new record.
If you want to beat it - tbh - Safari, especially on IOS is a monster. Most people with an iPhone default to it, and they remove their biggest entropy signals (offlineAudio, canvas profiling), so they're left with almost nothing to work with that is really unique.
Fingerprint _really_ pushes merchants to reverse proxy their services so that they can serve cookies as first party and Apple doesn't nuke them after 1 week. Its complicated and most merchants don't want to diddle with it - but it circumvents adblockers (ps - use an adblocker and call out fingerprint specifically if you want to hit them. LLM to see who else you need to include).
After that, if you're on Apple, use their Apple-VPN service (forget what its called) - which exists _literally_ for this.
It's definitely possible to bypass fingerprinting (just take a look at countless web scraping services that manage to do that) but consumer browser actively reject this.
If I were to wear a tin-foil hat I'd say that fingerprinting is a spyware feature not a bug but it can also be explained by the fact that current web market relies on fingerprinting too much thus blocking adoption of anti-fingerprinting features. Firefox half-ass tried to but now all the anti-fingerprint features are hidden deep in the about:config somewhere because people rather see less captchas than have privacy.
Unfortunately, there's no way to patch fingerprint ressistance into a compiled browser and even then nobody actually wants this because then cloudflare won't let you visit any web page.
The only way to get anti-fingeprinting would be to force it on everyone so that the tools that rely on it would be forced to respect the user. Considering that 2 major browsers are owned by mega corporations and 3rd one by a leech that just exists to leech billions from the first two we'll never actually defeat web fingerprinting until something absolutely catastrophic happens forcing everyone to start paying attention.
Yes!
At least for now. Tried many browsers and Mullvad Browser and Konform Browser are the only two that I managed to beat them with. They both enforce bundled set of fonts like Tor Browser. Firefox and other forks are fingerprintable via variations in font rendering due to system fontconf or fonts differing.
I've been getting into making and breaking these antibots recently and it's funny to me how the person who wrote this post gave so much attention to what LinkedIn was doing and left the other antibots on the page as a footnote. They grab way more, they just don't let you see it. I haven't reversed PX or Recap yet but the antibot on twitch and Nike similarly checks if you have any of these 53 apps installed (when loaded on a WebKit browser) https://pastebin.com/raw/KACvjpTK
this should lead to the browser be the one doing human or robot user check, is that possible?
By GDPR this is illegal. But I assume no action will be forthcoming
this is a massive violation of trust
> The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify).
Many extensions designed to scrape data from social media websites are disguised as simple extensions that do something else.
If I had to guess: I sought that automatic content blurrer, neurodivergent website simplifier, or anti-Zionist tagger actually work. They’re all just piggybacking on trending topics to get users to install them and then forget about them, then they exfiltrate the data when you visit LinkedIn.
This. Do not install any extension unless you absolutely need. Assume they all leak your browsing data. Not familiar with Google but if you can just vibe code your own extension then do that.
Vibe supply chain attacks are coming btw.
Wdym? You vibe code your software. Are you saying the LLM will spit out malware?
Sooner or later, yes. What stops it , other than layers of imperfect process? And it's the perfect vector to exploit anyone who doesn't review and understand the generated code before running it locally
They're also the only avenue to breaking out of the browser sandbox.
[dead]
Your explanation makes sense if LinkedIn is blocking browsers with these extensions installed. Are they?
If you mean by the website, then - surely not. What basis do you have to trust websites you visit? Especially a social network that owned by Microsoft to boot?
If you mean the _browser_, then I agree in principle, but - it is a browser offered to you by Alphabet. And they are known to mass surveillance and use of personal information for all sorts of purposes, including passing copies to the US intelligence agencies.
But of course, this is what's promoted and suggested to people and installed by default on their phones, so even if it's Google/Alphabet, they should be pressured/coerced into respecting your privacy.
> this is a massive violation of trust
This is not. To violate trust, there should have been some.
There's an implicit trust that a site doesn't try to racially profile you, as it is illegal. There's no enforcement, but that's why trust is being violated.
It's probably not illegal for advertisers to racially profile you, but it certainly is illegal in the US to do those things as part of your hiring process:
https://www.eeoc.gov/prohibited-employment-policiespractices
LinkedIn's scanning for browser extensions used by protected groups allows them to provide illegal services to US-based recruiters. I have no idea if they actually do it or not, and am not a lawyer, but common sense suggests there's enough here for a class action suit to move into discovery.
These extensions sound like straight up malware anyway
Almost certainly they are using that for audience segmentation and ad targeting. Clever and disgusting. This isn't the invention of some evil moustache-twirling executive, this was the invention of an employee or group of employees who value money more than morals. We should think of such employees as henchmen.
if they do a better job at showing me an ad that might be relevant to me, how is that disgusting? if I have to see an ad at all I at least want them to give it their best shot
I cant believe that people still have the attitude that the trillions of dollars being invested in all this technology and tracking is just to give them a more relevant ad.
Do people really not remember scandals like Cambridge Analytica, and realise that these ads combined with social media feeds can be used to literally control and manipulate peoples decisions and behavoir?
Theres a reason Facebook and Youtube just got sued for being intentionally addictive attention machines.
You're glossing over the nuance of the Cambridge Analytica scandal or at least I don't see how it's connected here.
Facebook was a party, but not the protagonist.
- a Cambridge researcher (Aleks Kogan) created a personality quiz FB app advertised as academic research
- users had to consent to download the app
- the app nefariously scraped users' friends' data (300k users unlocked 87 million users' data)
- the information was sold to Cambridge Analytica
- who then used the information to profile American voters
LinkedIn already has all of this information from the information you feed it. Scanning for more information provides more refined views, but LinkedIn already has your graph.
The parent post said:
> if they do a better job at showing me an ad that might be relevant to me, how is that disgusting?
To me that signalled that the author of the comment doesnt really care what is gonig on behind the scenes if the result is a better and more relevant ad.
I see this attitude often from people who dont seem to understand the severity and seriousness of online tracking which leads to psychological profiling which leads to manipulation.
> who then used the information to profile American voters
You seem to have missed off the most serious bit at the end. Cambridge Analytica then used the data to profile millions of voters, and purposefully target divisive and flammable political material to specific suggestible people in order to manipulate outcomes.
This same thing is done all the time by all tracking and ad companies. I think this thread has gone beyond just LinkdIn scanning your browser extensions.
I agree that it could come off as gross negligence to not care about what happens with your data.
My point is that LinkedIn already has enough information (We've willingly given them!) to manipulate outcomes and if they're doing something nefarious, then it's already too late.
Whereas Cambridge Analytica involved bad actors (not Facebook) duping customers and re-selling their data. I don't think those elements are necessarily in play here.
Fair enough, thanks for the polite retort.
I think I was just getting on my high horse at the fact that the whole internet ad machine is doing this terrible thing for society and nobody really seems to care that much.
This thread was more about Linkdin specifically scraping data instead of maniuplative ads, so apologies for derailing.
is the manipulation of decisions and behavior not just a way of saying sales and marketing? I agree that it def can be used for bad things, but so can most tools/systems
Ugh, you are probably right and that makes me sick to think about it!
It's not just about ads. The same data and tech is also about locking you up and identifying you for deportation you if this admin thinks you are in the USA without permission.
And laundering responsibility. If the government uses a contractor to identify deportation candidates using this data, and they get it wrong, the government can at least try to shrug it off and blame the contractor, whose job is in part to absorb public outrage for these sorts of things. Whereas if the FBI wiretaps you and still gets it wrong, it's a lot harder to deflect blame.
Imagine if someone was following you around with a clipboard writing down everything you do, then rifling through your bookshelf to make note of certain books on the bookshelf, and then using that to target ads at you.
You'd say that's a ridiculous and illegal thing to do without you explicit consent, right?
Maybe you personally don't mind and would be happy to offer that consent. But they're doing it without your consent, regardless of whether you want it or not.
by that analogy this is not following me around in my house, it’s when I go into their house that they log it?
They share the data, so they have 24h coverage and peek inside from your windows when you're home.
The rules say we should default to assuming good faith in comments. But it's hard when I see this comment in 2026.
“A pensar male degli altri si fa peccato ma spesso ci si indovina.” — Giulio Andreotti
(it's a sin to assume bad intent, but you often get it right)
He was a very controversial italian politician.
what would the bad faith motive even be?
$$$, one of the classic bad faith motives. Most of tech nowadays is subsidized by advertising and profiling to some degree, often quite a large degree.
Aside from the fact that no one is asking for that, there is no law that prevents that ad targeting data from being sold to the government for the purposes of…whatever they want.
What if someone makes an ad thats not an ad at all, maybe its a rabbithole designed to fuck with you. Maybe its designed to enrage you.
It scans thousands so in thousands, some of them have these weird names
[flagged]
No, they mean Anti-Zionist Tag[0], an extension that is live on the Chrome Web Store and identifies anti-Zionists for the benefit of Zionists.
[0]https://chromewebstore.google.com/detail/anti-zionist-tag/ek...
Guess an anti-Zionist could use this too, to know who's cool. Except in reality this extension probably just scrapes data and mines bitcoin
[flagged]
It's for fingerprinting and possibly ad targeting.
It's no different from when you visit an Islamist or anti-Zionist website that has analytics/trackers/ads on it.
It's bad, but this "massive violation of trust" is happening everywhere and has been for decades. There's nothing that's unique to Microsoft here.
The claims made on the website linked here are plain wrong. The person behind them is subject to an account restriction for scraping and other violations of LinkedIn’s Terms of Service.
To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members’ consent or otherwise violate LinkedIn’s Terms of Service.
Here’s why: some extensions have static resources (images, javascript) available to inject into our webpages. We can detect the presence of these extensions by checking if that static resource URL exists. This detection is visible inside the Chrome developer console. We use this data to determine which extensions violate our terms, to inform and improve our technical defenses, and to understand why a member account might be fetching an inordinate amount of other members' data, which at scale, impacts site stability. We do not use this data to infer sensitive information about members.
For additional context, in retaliation for this website owner’s account restriction, they attempted to obtain an injunction in Germany, alleging LinkedIn had violated various laws. The court ruled against them and found their claims against LinkedIn had no merit, and in fact, this individual’s own data practices ran afoul of the law.
Unfortunately, this is a case of an individual who lost in the court of law, but is seeking to re-litigate in the court of public opinion without regard for accuracy.
All illegal or unethical means can be explained, but not justified, by their ends.
I'm quite sure having unfettered insight into the browser environments of your users makes enforcing your Terms of Service much easier, but held against the (even minute) risk of exposing one of users' political, religious or sexual preferences, any of which might carry with it massive risk of bodily injury or death in many parts of the globe? I'm sorry but ToS enforcement does not even begin to clear that bar.
If you don't want your users to scrape large parts your website, have you considered just blocking users with outsized traffic usage and not violating their privacy in the process?
Justifying this invasion of privacy as a means of defending LinkedIn against the apparently existential threat posed by something as pedestrian as scraping is especially ridiculous when considering how LinkedIn managed to even get off the ground in the first place: By invading the privacy of its unwitting users by scraping their contacts and impersonating them via email[1].
[1] https://en.wikipedia.org/wiki/LinkedIn#Use_of_e-mail_account...
Why is scraping even an issue? If people don't want others to find this info, just don't put it out there in the public?
The world isn't binary. People want to look for jobs and network.
At the same time they don't want their data turned over and sold to the kind of people who scrape LinkedIn.
Plus - Your data is LinkedIn's cash cow. They're not going to leave it out for every Tom, Dick, and Harry to export en masse whenever they want.
> To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members’ consent or otherwise violate LinkedIn’s Terms of Service.
What a nightmare! Are your findings and this list of malicious extensions published somewhere?
And you should be trusted because…
You state a lot, but not once you give even the slightest proof to your claims.
Call me doubtful at best.
If you expect a reply from the damage control team, you'll be disappointed.
I would never expect that. But I am not even sure, it is from anyone at LinkedIn (at least in an official position).
I look forward for you to post a rationale for the site reliably for these 6,000 extensions.
Not clear why it needs to scan for Amazon image downloaders, Rufus conversation extracters, Amazon delivery scheduler, Product Scanner, or pharmacy operations.
That was a two minute search here:
https://browsergate.eu/extensions/
I have trouble trusting anything run by Microsoft, and in particular anything run by LinkedIn considering it is the absolute worst site that I have to use.
Microsoft has lied in the past about what information that they do and don't store, why should we believe you now?
Micrôsoft does indeed have a lofty and sturdy moral high ground from which to denounce scrapers and breaches of intellectual property rights and website TOS violations, having never invested in OpenAI.
This entire response is full of lies. Having done a cursory search of the extensions, you do target ones that are based on religious affiliation regardless of the DOM actions they take.
Your comment is disingenuous, insulting and has only served to make me check more extensions and only browse LinkedIn in a secure, private window.
Can you please state your name for the record?
The Bavarian Central Cybercrime Prosecution Office in Bamberg has opened a investigation into this matter (Case File No 650 UJs 2809/26) and I am sure they are interested in talking to you.
They would love to hear how this is all plain wrong.
All I'm seeing is that Chrome apparently is failing to properly sandbox websites against extension fingerprinting.
Sure, this can be solved at the legal layer, but in this case, there seems to be a much simpler and more effective technical solution, so why not pursue that instead?
Well, the developers of Chrome aren't exactly incentivized to prevent tracking (though perhaps tracking done by their competitors). But anyway, you can try to prevent it with a technical solution while also being outraged that they did it. If someone has their home broken into, perhaps they should have better locks, but the burglar is still responsible for their actions.
Just because a farmer eats beef doesn’t mean he won’t fend off wolves.
I agree on the practical aspect though.
Sister comment indicates it isn't as simple as you might think:
https://news.ycombinator.com/item?id=47617972
Is it that easy?
This looks intentional enough that I wonder if there's a legit reason for it.>the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch)
Why should a website be able to scan for extensions at all?
Or if there's a legitimate need (like linkedin.com wants to see if you installed the linkedin extension), leave it up to the extension to decide if it wants to reveal itself. The extension can register a list of URL patterns it will reveal itself to. So the linkedin extension might reveal itself only to *.linkedin.com, a language translation extension might reveal itself to everyone, and an adblocker extension might not choose to reveal itself to anyone.
that's basically how it already works...
extensions choose on which site they're active and if they provide any available assets (e.g. some extensions modify CSS of the website by injecting their CSS, so that asset is public and then any website where the extension is active can call fetch("chrome-extension://<extension_id>/whatever/file/needed.css" if it knows the extension ID (fixed for each extension) and the file path to such asset... if the fetch result is 404, it can assume the extension is not installed, if the result is 200 it can assume the extension is installed.
This is what LinkedIn is doing... they have their own database of extension IDs and a known working file path, and they are just calling these fetches... they have been doing it for years, I've noticed it a few years back when I was developing a chrome extension which also worked with LinkedIn, but back then it was less than 100 extensions scanned, so I just assumed they want to detect specific extensions which break their site or their terms of use... now it's apparently 6000+ extensions...
Fwiw... I now run personal and professional browser profiles from two different jails / cgroups. It's a pain in the arse to set up, and I have to verify my config still works after every update, but I get a good feeling knowing my personal chocolate is not mixing in with my professional peanut butter.
I set up the cgroups hack so I could route traffic from a dev profile into a VPS vpn, and may not be that useful for everyone.
But I think this is a reminder that you may want to have at least two profiles: one public and the other private. Do you really want Microsoft to know you installed the "Otaku Neko StarBlazers Tru-Fen Extendomatic" package to change every picture of a current political figure to an image from the cast of Space Battleship Yamato?
> I now run personal and professional browser profiles from two different jails / cgroups. It's a pain in the arse to set up, and I have to verify my config still works after every update
You may be interested in Qubes OS. My daily driver. Can't recommend it enough.
I... I searched for this extension.
Not just you if that helps.
I also have porn specific firefox profile in addition to these two
There is no reason to trust any big tech company. Folks should be using containers in their browser if they care about privacy. I previously published a LinkedIn container extension for FireFox: https://addons.mozilla.org/en-US/firefox/addon/linkedin-cont... although as many know you can achieve the same results with Firefox containers without a specific extension like mine if you configure it manually.
I will work on an improvement to that extension so that it can block these scans if they attempt them in firefox.
Ever since the scraping lawsuits [0] I realized linked-in has adopted the "I take all your data, you take none of mine" idea to another level.
Also the site doesn't even work well and is one of the main examples of "dark patterns" on the web [1].
Literally one of the worst companies and websites out there. Stallman has a summary of the additional reasons [2].
[0] https://www.eff.org/deeplinks/2017/12/eff-court-accessing-pu...
[1] https://medium.com/@danrschlosser/linkedin-dark-patterns-3ae...
[2] https://www.stallman.org/linkedin.html
Separate question, why isn't this kind of stuff something the browser restricts access to or puts behind an approval gate to the end user?
https://support.mozilla.org/en-US/kb/resist-fingerprinting works.
Chrome is adware.
I understand my parents using chrome. But users of hackernews using chrome makes me sad.
why would the browser ever expose extensions api to a web page. does firefox does this as well?
The "The Attack: How it works" section explains how it works. It's not an API.
I am a little surprised something like CORS doesn't apply to it, though.
So these extensions allow linkedin to do this though, it's literally them saying "yes, this site can ping this resource" - called "web_accessible_resources".
This is fair from Linkedin IMO as I've seen loads of different extensions actually scraping the linkedin session tokens or content on linkedin.
It's not the extension developer who should decide this, but the browser user.
On what would the browser user base their decision?
If an extension injects an icon into the DOM of the page, then the resulting `img` tag needs to put something in its `src`.
The extension author may choose to use the `data:` scheme, but that's a development-time decision.
> Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions.
It's not clear though, either they only tested against chrome-based browsers or Firefox isn't enabling them to do so.
edit: I answered before I go fully through the article but it does say it's only Chrome based.
> The extension scan runs only in Chrome-based browsers. The isUserAgentChrome() function checks for “Chrome” in the user agent string. The isBrowser() function excludes server-side rendering environments. If either check fails, the scan does not execute.
> This means every user visiting LinkedIn with Chrome, Edge, Brave, Opera, Arc, or any other Chromium-based browser is subject to the scan.
Firefox uses UUID for the local extension url per extension so you can't search for hardcoded local urls.
What is a Chrome-based browser? Isn't Chrome Google's Chromium based browser? How many are based on Chrome?
> This means every user visiting LinkedIn with Chrome, Edge, Brave, Opera, Arc, or any other Chromium-based browser is subject to the scan.
[flagged]
A lot of people mistakenly refer to Chromium-based browsers as being Chrome-based.
I feel like this is obvious and you know that this is the exact mistake being made, but rather than drop an actual correction, you take the insufferable approach of pretending you don't know what's happening and forming the correction as a question.
> A lot of people mistakenly refer to Chromium-based browsers as being Chrome-based
This seems to be a case where the poison seeps through the cracks. From Google and Chrome to other Chromium-based browsers. In very correct ways, in this case, they are Chrome based.
From "The Attack: How it works", its just checking the user agent string:
function a() { return "undefined" != typeof window && window && "node" !== window.appEnvironment; }
function s() { return window?.navigator?.userAgent?.indexOf("Chrome") > -1; }
if (!a() || !s()) return;
I was under the impression Firefox randomises extension IDs on install, so hopefully not?
they seem to be calling `chrome-extension://.....` so i don't think it applies to firefox
The answer to "why would Chrome ever undermine privacy and security?" is always "Google's revenue stream".
I'm happy to see that this doesn't hit firefox. I wonder if safari is impacted.
https://browsergate.eu/extensions/
It seems to not scan for Privacy Badger and uBlock Origin, two extensions I rely on. That's...surprising.
Because what they're scanning for is scrapers. So much linkedin scraping. And I'd bet that the majority of the innocuous-looking extensions are scrapers hidden as other extensions to get users to unknowingly use them.
The “how it works” page suggests it only works on chrome based browsers. Anyone able to determine if firefox or safari are affected too?
Firefox-based browsers not affected.
Hmm I opened linkedin in Firefox and ublock origin showed it blocked 4 items... then switched away and back and the counter was up to 12.
Is that enough blocking, I wonder?
Firefox uses randomised IDs for installed extensions, so the method highlighted won't work on Firefox. That's not to say they aren't trying other methods on Firefox.
Attack surface is narrower on Firefox. WebExtensions without DOM-visible traces cannot be detected.
> The “how it works” page suggests it only works on chrome based browsers. Anyone able to determine if firefox or safari are affected too?
The code filters out non-chrome browsers: >The extension scan runs only in Chrome-based browsers. The isUserAgentChrome() function checks for “Chrome” in the user agent string. The isBrowser() function excludes server-side rendering environments. If either check fails, the scan does not execute.
It will sound like finessing on details, but details are important in these kind of claims, and this seems incorrect
> Microsoft has 33,000 employees and a $15 billion legal budget
Microsoft has more than 220k employees (it's hard to follow with all the layoffs), and the G&A in which bankrolls legal expenses (but not only - it also contains basically every employee who's not engineering or sales) was only 7B in 2025 - so legal budget is much lower than that.
LinkedIn has been a weirdest social network for a long time.
https://hn.algolia.com/?q=linkedin+weird
What scanning for browser extensions taught me about B2B sales
I remember the LinkedIn app that got all your contacts from your phone and tried to add them to your network. I had random people from internet-deals (local craigslist) that where popping up. So strange that this was allowed.
Read this:
> Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers
And thought, "no way in hell this gets by Safari."
And then, under "The Attack: How it Works":
> Every time you open LinkedIn in a Chrome-based browser
Shocker. If you use a Chromium-based browser, you should expect to be trading away your privacy, IME.
I know, I know, pretty terrible and all, but can we take a moment to appreciate we’re able to ship to every browser a script that does 6000+ fetches in parallel. Sure, doesn’t go through network stack, but still impressive how far JS has come in terms of efficiency .
Can't be said enough: Stop using Chrome.
Also: stop installing random extensions
A lot of extensions on LinkedIn are necessary because of their total lack of innovation. You really cannot do anything in B2B sales or recruiting with only LinkedIn tools. These are not random extensions, but crucial extensions literally saving billions of dollars in wasted time or creating massive opportunities in the global economy.
I wonder how much of this is also used for audience segmentation for their advertisements? Linkedin ads are some of the most expensive out of any social media platform, but they also tend to have the highest conversion since you can get pretty niche with your targeting.
If I understand this correctly, LinkedIn fingerprints your browser. And browsergate, now, shows how harmful this can be, combined with private data (like your job, full-name and ID) been sold to 3rd-party. Companies are in it to make money, and if something is free, you're the product.
If you think about, to protect yourself: The EFF privacy badger browser add-on [1] try to block fingerprinting.
Also, browser fingerprints are a common tracking pattern nowadays. You can test [2] your browser and please start protect your self: E.g. use add-ons like U-Block and Privacy Badger to block tracking and/or use different browser and devices for different use cases. DNS-blocking with block-list like hegazi [3] is IMO the best option, but also a bit more involved, when you host you own DNS forwarder(s). For example AdGuard Home [4] helps you with hosting your own DNS infrastructure. It's also possible to add block-lists to dnsmasq or unbound and run them on you notebook as forwarders.
[1] https://privacybadger.org/
[2] https://coveryourtracks.eff.org/
[3] https://github.com/hagezi/dns-blocklists
[4] https://adguard.com/en/adguard-home/overview.html
Wish they'd add a little more to what end-users can do about it like switch to a non chrome-based browser.
It's a call for funding. I suspect the answer they want, is click on a donation link; regardless of which browser you're using.
So this website is asking for 25€ to "[pursue] DMA enforcement against LinkedIn". No timeline, no measurable goals, jump an ask for money.
Despite the misleading headline, I really don't understand why anyone uses linkedin, there will inevitably be a trailing rely of comments claiming it has some irreplaceable value in professional networking, but I don't buy it. Nobody I've ever talked to has been able to articulate any actual value provided by "connecting" to another person on a social networking site. If you want to build professional connections go to lunch, join community calls, attend professional events, and go to conferences.
How a web site can search one's computer?
TFA explains it is looking for installed browser extensions (which sites are allowed to do)
"allowed" by the web browser, but almost certainly not by the end user. The law is pretty clear on this in the US:
> 'the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;'
The problem, of course, is that by clicking on a LinkedIn link, you agree to a non-negotiated contract that can change at any time, and that you have never seen. If that weren't allowed, then this sort of crap would correctly be considered "unauthorized access":
https://www.law.cornell.edu/uscode/text/18/1030
Allowed to do? Not prevented from by technical measures, but certainly not allowed to do.
Considering the goal is to identify people, this is undeniably PII. As the article demonstrates, it also pertains sensitive information.
https://browsergate.eu/how-it-works/: “Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions”
⇒ which Chrome allows sites to do.
TFA goes into a lot of detail explaining why they "allegedly" aren't actually allowed to do so in the EU.
Can you build a version of chromium where this will just return false always?
Well, they're able to do it; “allowed” to do it is an ambiguous enough phrasing that it's practically begging to have an argument whose crux is fundamentally about a differing interpretation.
The author suggests a legal remedy instead of a technical one.
Which is weird, because that is undeniably the hard way. Lobby Google to add protections to Chromium.
Putting bars on the windows is fine, but the bad actors still need to be punished.
While you're at it, you should also find out why a website can scan your internal network...
The title is clickbaity. The website scans the browser for installed extensions.
it can in the fantasy world of incorrect headlines
6 months ago I already posted about this
https://news.ycombinator.com/item?id=45349476
If you hadn’t written that post using AI, it might’ve received more attention. Also, (1) if you’d put LinkedIn in the title, rather than the very bottom of the post, and (2) if you’d provided any insight, rather than just speculation, as to what the data might be being used for.
I have written something about Linkedin although not, about browser fingerprinting but certainly somewhat of an extremely bad experience with Linkedin.
Not sure if this counts but my post was actually sandwiched between two large Linkedin posts (the 2 tabs = 8 gb and now this) within the timing [0]
I always write things myself, even if they might take hours.
But I also believe that my post had overlapped with larger things of AI (OpenAI getting funded, Claude being leaked), I have seen some cool projects lately on Hackernews which aren't getting attention as all of that attention gets redirected to AI related news.
[0]: to be honest, I write things for myself firstly and I just upload them here for discussion related purposes, I am perfectly fine with my posts not reaching traction, because, I try to/wish to write for myself first and foremost :), Also within that Linkedin incident, In that case I just wrote things to get it off my chest really.
Thank you for that post, it describes the invasion of privacy at a deeper level. I must have missed it but YCombinator is filled with people with a vested interest in keeping the clown show going.
The most obvious reason for this is browser fingerprinting, right? So your visits to other websites can be linked to your Linkedin identity? Or no?
They also try to profile for things like political beliefs.
I don’t see this article showing that. They query for extensions that could be used to do that, and that likely already is illegal, but those queries could solely be used to uniquely identify users (grabbing more bits makes it less likely to get collisions)
The list of queried extensions includes things that would be used by particular religious groups, and people with certain medical conditions.
Those being in the list doesn't mean that's what they're looking for. Take a look at the database of extensions, there's far more extensions that don't seem limited to any particular group. The author just called those out specifically because they're perfect for implying nefarious intent.
> doesn't mean that's what they're looking for
It does suggest that’s what they’re collecting. That is per se a violation in many jurisdictions. It should trigger investigations in most others to ensure it wasn’t mis-used.
The claim I replied to is “They try to profile for things like political beliefs”.
I wasn’t contesting that they query extensions that can be used for that purpose, or that they use query results for that purpose, but indicated that the fact that they make such queries doesn’t necessarily imply that they try to do such profiling.
From the "Why It's Illegal" section:
>Political opinions
>LinkedIn scans for Anti-woke (“The anti-wokeness extension. Shows warnings about woke companies”), Anti-Zionist Tag (“Adds a tag to the LinkedIn profiles of Anti-Zionists”), Vote With Your Money (“showing political contributions from executives and employees”), No more Musk (“Hides digital noise related to Elon Musk,” 19 users), Political Circus (“Politician to Clown AI Filter,” 7 users), LinkedIn Political Content Blocker, and NoPolitiLinked.
>Each of these extensions reveals a political position. If LinkedIn detects any of them, it has collected data revealing that person’s political opinions. Article 9 prohibits this.
no, it's about scraping.
This website was difficult to follow but I found that this page https://browsergate.eu/extensions/ was the most helpful to understand what they were talking about
Essentially, they are labelling you, like most do, but against some interesting profiles given the kinds of extensions they are scanning for
They really don't want people scraping their data with extensions. The LI API response is the worst tangled mess I've ever seen... It's so bad, I have to assume it's intentional. Took me 3 days to parse their responses. I had to build a special rules-based scraping engine which allows me to filter and map items layer by layer based the relative positions of those items with flexible rules. A bit like CSS selectors but more complicated.
The hard part is that some APIs return items in a different order or with different indentation so my engine normalizes all the variants into consistent objects.
It's quite impressive that LI works at all given the complexity.
This is result of browser fingerprinting.
My guess, Linkedin is used for years as source of valuable information for phishing/spear-phishing.
Maybe their motive is really spying. But more important for them is to fight against people botting Linkedin.
Imho, browser fingerprinting should be banned and EU should require browser companies to actively fight against it, not to help them (Fu Google)
> Every time you open LinkedIn in a Chrome[actually Chromium]-based browser
There's a reason I continue to use Firefox (with uBlock Origin) and will never switch.
Also, when I got laid off from a previous job, I made a LinkedIn profile to help find a new job. Once I found a new job, I haven't logged into LinkedIn since - that was almost 2 years ago.
I don't like any of this, but I'm not totally clear how this is substantially different from other fingerprinting technologies which I assume are used by every large tech company. Could anyone elaborate? The post isn't very clear why this is different from other data surveillance.
If other people collect data like that it's probably also illegal.
[flagged]
It seems it scans your extensions not your system - reading the details. The intro made it a bit unclear.
LinkedIn is far from the only actor doing this. Browser extension fingerprinting is not new. LinkedIn‘s size, scope, network effects make this especially concerning.
Still pretty annoying browsers haven't patched that yet.
They have! It's these developers either not knowing or not caring about it which is the issue! I did a blog post about this a while back showing how they do it, and how you can get around it, it's not very complex for the devs.
https://www.linkedin.com/pulse/how-linkedin-knows-which-chro...
> Chrome have fortunately recently released a "extension side panel" mode, and since only DOM changes can be easily identified, using the chrome extension side panel would be virtually un-detectable however this is far less intuitive to use and requires the user to perform some action to open the sidepanel every time they want to use the extension.
As an end user I could not find an option to open the side panel
Yeah I mean it's not very commonly used by extensions. I quite like it as it's completely isolated and not detectable. I built my first extension which uses it as the primary interface yesterday: https://github.com/Am-I-Being-Pwned/PGP-Tools
`use_dynamic_url` seems like it should be enabled by default, maybe with a phase-out period for backwards compatibility with older extensions.
Yeah I agree. All new extensions should have this for their web_accessible_resources.
With that said, the chrome web store ecosystem has bigger problems infront of them. For example, loads of extensions outright just send every URL you visit (inc query params) over to their servers. Things like this just shouldn't happen, imagine you installed an extension from a few years back and you forgot about it, that's what happened to me with WhatRuns, which also scraped my AI chats.
I'm working on a tool to let people scan their extensions (https://amibeingpwned.com/) and I've found some utterly outrageous vulnerabilities, widespread affiliate fraud and widespread tracking.
There's nothing to patch, scanning is not possible.
It's either the extension's choice to become detectable ("externally_connectable" is off by default) or it makes unique changes to websites that allow for its detection.
If it were just a matter of detecting changes to the DOM then this could only detect extensions that alter the LinkedIn website itself. I agree that would be much harder to make undetectable, but this seems like it goes beyond that.
As mentioned, there's a way to expose your extension to the web even without making changes. The other way is a key called "web_accessible_resources".
All of these are opt-in by the extensions and MV3 actually force you to specify which domains can access your extension. So, again, each extension must explicitly allow the web to find it.
This has been going on for at least 5 years. It pops up on HN every so often.
Seems like it. Which is serious but far from what I thought when I read the title. I suspect 90% of LinkedIn users don't even have a single browser extension installed.
I would debate that. Most work computers have some extensions installed by default. That's millions of laptops. Ex. Snow Inventory Agent, ad blockers etc.
Pretty sure that if they could they would, but browsers sandboxing security prevent this to go unnoticed.
This is a good reminder of how much trust we implicitly place in every website we visit. Most people have no idea that a site can silently probe their browser environment while they're just trying to scroll their feed. Even if LinkedIn's intent is benign (fraud detection, fingerprinting), the lack of transparency is what makes it feel wrong. You shouldn't have to inspect network traffic to know what a website is doing with your data.
”American-Israeli cybersecurity firm.” Feels like a dogwhistle to people who don’t like Israelis. Hardly relevant if the cybersecurity firm is Israeli, Canadian or Australian.
It's extremely relevant given Israel's long history of extra-territorial assassinations and kidnappings.
The moment in history where we all pretend that Israel is a normal country has been and gone.
Interesting. I didn't know a extension’s web-accessible resource (e.g. chrome-extension://<id>/...) could be abused to learn about the user's installed extensions by checking whether it resolves or not.
You would need to use use_dynamic_url: true in the manifest to create a unique one.
Or just not allow them to load the URIs at all
Yeah, this is the easiest way to get around it
Is there a way to disable the ability for websites to scan for extensions in Chrome?
https://www.firefox.com/
Nope, which is why Chrome exists, to allow Google to do this. Which is why you should avoid chromium.
I want to know what power I have as just some guy to do anything about this? (even if just for myself)
I ask because it seems like every job I apply to asks for a linkedin profile, and I've heard floating around that if it's not filled in enough most employers assume you're a bot. Heck, one of the forms from the "who's hiring" thread yesterday straight up said if you have < 100 connections they'd throw out your application. So, in order to get my foot in the door, I need to hand over vast and intricate data about my personal life to a third party?
For you personally, to solve this issue in particular? Use Firefox. Google is evil, and there's a good chunk of the Chrome team who are actively enemy combatants.
For the broader issue of not wanting to give even the information you'd need to choose to share to LinkedIn? Network the good ol' fashioned way: talking to random strangers in San Francisco bars.
Mozilla is controlled opposition (largely funded by Google) and the browser can't really compete on security and performance.
> there's a good chunk of the Chrome team who are actively enemy combatants
Uh what.
Everyone involved in Chrome's most questionable decisions such as Manifest V3's anti-adblocking, the Topics API, etc, are not just working orthogonal to the people's interest, they are directly working against it. I couched my statement down from the entirety of the Chrome team because I hesitate to label "making constant, marginal feature additions that ultimately result in anti competitive behavior" openly malicious.
Everyone from the suit that made the ultimate calls down to the lowest code monkey who bugfixed such features are responsible for their choice to target the good, common user of the internet. I'm not asking for altruism, I just think people shouldn't choose to do evil, and that those who do anyway should be recognized as such.
None of this makes them “enemy combatants.”
I’d suggest having an adblocker first.
Second not having a ton of extensions. Extensions can do fishy things.
This is Chrome’s broken model. Before installing an extension, one should be able to see all the domains an extension talks to.
The domains should be listed in manifest. But that’s not how it works.
In Android, every app you open needs a gazillion default permissions.
This is why the EU regulates them (or pretends to) as a public utility. The individual action I took was to donate to Fairlinks‘ legal fund.
What's really weird about this list is what's not there.
I'm not seeing my spicy extensions (e.g. BPC), or the ones I use to block content on LinkedIn (ViolentMonkey, Ublock). So this isn't about detecting what they might deem as bad behaviour.
Nor could it be a fingerprinting thing, right? You'd want a full list for a full ID.
But they are checking out your religion. Deeply creepy.
"searching your computer" -> using standard web fingerprinting techniques. They don't actually get to read your home directory, and the authors should be honest about this!
Amazing work, but it’s not surprising, I think anyone in cybersec space knows that LinkedIn is the number one source of information when it comes to track or ID someone, and I don’t mean just OSINT given the real data you have, but also three letters agencies love it, it’s a gold mine, wasn’t the silkroad owner was busted because of the same personal email used on LinkedIn? So yeah, delete it, never use it, it’s full of corporate cringy nonsense anyway
I'm certain that if LinkedIn were confronted, that they could produce a response that says they are covered by the TOS you had to agree to in order to use the site. I don't have time to spend scanning legalease. Or make use of LinkedIn. If my system is being scanned, they'll see that I'm using a legitimate licensed copy of Windows 7 on a MODERN computer. If anything is at fault, it includes web browsers that Identify themselves to web sites.
This title should be changed as no court found this is illegal, and this is pretty standard, if extensive, browser fingerprinting, however disagreeable it is
I agree.
I'm not convinced by their page explaining "Why it's illegal and potentially criminal" [0]. It's written by security researchers and non-attorneys.
For example, this characterization seems overly broad:
> The Court of Justice of the European Union has ruled, in three separate cases, that data which allows someone to infer or deduce protected characteristics is covered by this prohibition, regardless of whether the company intended to collect sensitive data.
[0] https://browsergate.eu/why-its-illegal/
Go check out QueryAllPackages permission on Android and see which of your apps can scan and know about all the other apps on your Phone. Thanks Google!
All apps can do that right
This is https://news.ycombinator.com/item?id=46904361, right?
Enumerated a full list.
https://git.gay/SiteRelEnby/browsergate-list
https://git.gay/SiteRelEnby/browsergate-list/src/branch/main...
Some of the spiciest:
* Anti-Zionist Tag (directly inferring political opinion)
* PordaAI (Islamic content filter)
* simplify (browsergate.eu specifically called out as a neurodivergent accessibility tool. Job search autofill that markets itself as particularly useful for people who struggle with forms)
* No more Musk ("Hides digital noise related to Elon Musk")
* Political Circus ("Politician -> Clown AI Filter")
* Job application trackers and utils ("Job Follow-Up Tracker" etc)
* Various "Distraction Blocker" type addons
LinkedIn scanning for tools that scrape LinkedIn:
* LinkedIn Cookie Sync for Headhunting Agent
* LinkedIn Cookie importer for Derrick (lol "for Derrick")
* MailMatics Cookie Grabber
* LinkedIn Fake Job Post Detector. Yes, they're detecting an addon that exposes fake job postings on their own platform.
*NOT* in the list, if you were wondering:
* Shinigami Eyes
* Dark Reader
* Adblockers
* Password managers
* FoxyProxy
* User-Agent spoofers, request modification tools, etc
* Most privacy/security tools (no uBO, no Privacy Badger, no FoxyProxy, no NoScript, etc.
For the latter category, the most interesting things there we found *were* searched-for are BuiltWith Technology Profiler, and some browser addons bundled from scanners (e.g. "Malwarebytes Browser Guard Beta").
The Anti-Zionist tag is interesting. It seems that it's actually an extension that would be used by Zionists, as it identifies anti-zionists, and the wording incorrectly claims that anti-Zionism is hate speech (whereas it is in fact Zionism that is hate-based ideology).
A lot of Zionists claim -- incorrectly -- that all Jews as Zionists. But certainly the major groups of Zionists are Christian zionists and Jewish Zionists. I would say there is a very very high chance that if you use the Anti-zionist Tag Chrome extension, that you are Jewish.
So it seems quite likely that Linkedin is actually tracking Jews with this.
So it seems quite likely that Linkedin is actually tracking Jews with this.
Really? Which LinkedIn executive do you think might be behind this?
Jeff Weiner? (Executive Chairman)
Ryan Roslansky? (CEO)
Tomer Cohen? (Chief Product Officer who served in an IDF intelligence unit)
Dan Shapero? (Chief Operating Officer)
That's on brand. I remember their phone app asking for contacts permission and just taking them all and uploading them to their server.
I alway use LinkedIn and Meta websites in a different browser altogether.
I hope browsers in the future will need to ask for permission before doing any of that.
If you use both from the same IP without using a VPN… the profiles are most certainly grouped. There are commercial datasets on IP addresses with almost 100% accuracy with tags like “school”, “house”, “apartment block” etc. Furthermore, if you ever logged into both sites from within the same browser by accident, the link by fingerprinting was made right there and then. The final profile on you may not be 100% accurate, but certainly is in the 98% range.
It's one thing if they have a shadow profile on you (and dozens of companies almost certainly do), but it's another thing if you give them meaningful info about you to enrich that profile with. They can figure out roughly what block you live on, OK fine, but unless you're in a rural area with no neighbors they might not be able to do much better than that.
> They can figure out roughly what block you live on
Its nothing to do with the specific house you live in, and everything to do with the activity being grouped together with all other activity you have done, which they know from fingerprinting and IP addresses.
They dont need to know where you live to have a very accurate personal and psychological profile opn you, and switching browsers is not going to help that in the slightest Im afraid.
Yes and no. If you block Linkedin SDK scripts on 3rd party sites, it's likely that Linkedin specifically doesn't actually have a good profile on you.
Realistically you're probably exposed and identified. But if you're meticulous and careful, you might not be, or at least not as completely as someone who is unaware or not careful. But it's not at all the same as if, say, a state actor was motivated to spy on you specifically.
What's an optimistic future for Web fingerprinting? Currently, a website's ability to fingerprint the browser, the device, and the user is absolutely ridiculous.
Here's a quick look at only the static things a website can fingerprint https://www.browserscan.net/.
Deleted my account. Fixed!
this morn while trying to decipher why computer was at 98% memory and 65% cpu
one of the culprits is https://li.protechts.net taking 2GB ram and 8% cpu.
DDG searches say this is something for linkedin. - I had two tabs for linkedin open but left behind as I opened other tabs to research.
So I had not reopened these tabs in over 9 hours and they are still just humming along sucking down almost 10% of cpu and a couple gigs of ram for what?
This is firefox with ublock origin - quick searches saw malwarebytes browser guard considered it (protechts.net) malware for a bit and then took it off the list of things it blocked / warned about.
Not sure this is related to the scan mentioned, but it may be related to the overall concerns about data and unknown usage of resources.
I'm considering blocking this at the dns hosts level at this point.
They only mention this being a potential violation of the DMA. How about north american countries? US and Canada?
Since the list of extensions they query targets certain religious groups and medical conditions, it's almost certainly in violation of US federal employment and hiring law.
LinkedIn also violates SPAM regulations on a regular basis. Despite of me having disabled all emails from this service I consistently receive promotional emails. LinkedIn defines a new "type of promotional email" for which it assumes it has implicit consent to send unsolicited emails and proceeds to do so. It then has a fake compliance apparatus by allowing the victim to once again "unsubscribe" from the newly created email subscription which they never consented to on the first place. I really hope there is a class action and these scumbags get fined.
There are a lot of browser extensions designed to create LinkedIn msgs using ai. You create a search list and it creates outbound and then you can deploy auto or review before sending. You can also then auto respond
Chrome: lets website scan what extensions you have installed for some reason.
Browsers almost need a firewall against websites for the functions and scans being run on it by websites.
Different browsers have various settings available, but do we have a little snitch for a web browser?
How is it even possible that we've reached a point where "yes, this is obvious and pretty unsurprising" is the default response to spying on an industrial scale.
Not mine. And why do we say LinkedIn, it is just Microsoft, just like Github is Microsoft and a whole raft of other companies are just Microsoft in a trenchcoat.
You can guaranteed that this is a data protection and anti-scraping measure. I used to work with some recruiters and there are several third party recruiter tools that scrape linked in data to the third party sites database under the guise of supporting recruiters. I would rather this than having my LinkedIn data siphoned off other parts of the internet for god know what purpose.
So if the same exact action is done paying a fee to linkedin it is then ok?
LinkedIn is in a different category than your standard website or social site due to the amount of PII. I'm not saying it's right to scan your environment, but as someone with a LinkedIn account I would prefer they tried to protect my data than be lazy about it. You have more to worry about from Adobe's online tracking than LinkedIn checking your installed extension for scrapers.
I think the real crime here is that browsers are able to probe which extensions you have installed.
I have uBlock installed, and it blocks these kinds of requests. However every request returns an error and they enter a constant request loop, causing the LinkedIn tab to slow down as the errors pile up after few minutes. Attached a screenshot [0] from DevTools.
[0] https://ibb.co/h1sbFXB4
LinkedIn has been overtly evil for decades, and their power users are the most insufferable sort of middle management yuppy scum. I know job searching can be hard, but I don't go near LinkedIn with a ten foot pole.
I really like going to linkedin daily to play minisudoku and a couple of other puzzles, then never engage the feed or other features
Why would you go to LinkedIn to play puzzle games? There's thousands of other places to do so.
This is really delightfully quirky
Sounds like containers and potentially adblocking and js blocking prevent this. For my part, I use linked in on my "god dammnit I hate corporate websites so much" browser which is used only for medical bill pay and amazon / wal mart purchases and then monthly bills. Could LinkedIn get something from me there? Potentially, but they're also not really following me around the web. I think given this I'll go install a 3rd browser for linkedin only, or maybe finally just delete my account. It never got me a job and it's a cesspool.
You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles.
Firefox with a non-default profile can be created like that:
And you can launch it like that: So, given that /usr/bin/firefox is just a shell script, you can If you use an icon to run firefox (say, /usr/share/applications/firefox.desktop), you'll need to do copy/adjust line for the icon.Of course, "./firefox" from examples above should be replaced with the actual path to executable. For default installation of Firefox the path would be in /usr/bin/firefox script.
So, you can have a separate profiles for something sensitive/invasive (linkedin, shops, etc.) and then you can have a separate profile for everything else.
And each profile can have its own set of extensions.
> The headline seems pretty misleading.
No it isn't. Performing fingerprinting on user's devices, to ultimately profit of financially or worse is misleading. Especially doing this while knowing the user isn't aware what this really means and just deciding it for them.
The headline is just an exaggerated way of saying what is really happening.
I run MalwareBytes on all my browsers and as my computer protection system.
LinkedIn is getting nothing.
Lol, you forgot the /s
This gave someone the opportunity to add in "Jeffery_Epstein_did_not_kill_himself" to linkedin's client facing code base through this. If you open dev tools -> network tab -> network search icon (magnifying glass) -> search for "epstein" and load up linkedin, you should see it for yourself too!
I really don't think they're "illegally" searching your computer, they're checking for sloppy extensions that let linkedin know they're there because of bad design.
I don’t understand how browser security would allow linkedin to search my computer?
This is only a thing for Chrome. You trust Google to protect user privacy towards websites in 2026..?
It's also pretty useless at career development.
AFAIK it can be fined with up to 4% of revenue in the EU.
How much is that currently? $600M?
Directly on the landing page:
> Microsoft has 33,000 employees
this should probably be LinkedIn, not Microsoft.
I am the one who published the findings at browsergate.eu and I think most of the debate here misses the point.
This is not about sandboxed or not. That's not the point.
The point is this is being done on a platform with 1 billion users with REAL NAMES, with REAL JOBS, working for REAL EMPLOYERS.
This is a privacy violation by every meaning of the term. But it is a lot more: It is the largest INDUSTRIAL ESPIONAGE operation I have ever heard of.
Literally every company on the planet (and every institution) have their employees browsers scanned for installed extensions. Some 200 are DIRECT COMPETITORS to Microsoft.
This is not about the behavior or a rando website trying to stop malicious actors.That's simply misses the point. By far.
i dont like that i pay them $79 a month for them to scrape my extensions
There seem to be a lot of misleading sentences on this page.
linkedin is full of dark patterns, it's really unfortunate it became the business default, all other social platforms get more criticism while being only a fraction as bad
I hate the way they just started saying you have a new message when you really don't. Now I'm going to miss when I really have new messages for a while because I'm not going to go to that site anymore when they say that.
And not letting you read your messages when on your mobile phone unless you use their app is particularly mean. Considering again where they are sending all the information they scrape.
Just use Safari, it won't even load the page half the time.
LinkedIn is full of lunatics, does not surprise me at all.
The real story is what's going on behind the scenes. The charges are relatively flimsy (for the reason I mentioned in my other comment). But here's the cool thing: the site is basically taken from Microsoft's playbook. For years, they pretty transparently bankrolled shadowy, single-issue "grassroots advocacy" groups that went after their competitors under flimsy pretenses. These organizations attacked others but somehow never had an opinion about stuff like Windows Copilot.
This feels very similar, except now it's taking a swing at Microsoft. It's apparently paid for by some mysterious "trade association and advocacy group for commercial LinkedIn users" that runs out of a private PO box in a small German town - uh huh. I'm not going to feel bad for Microsoft, but I would love to read some investigative reporting down the line.
Yep, LinkedIn is cancer.
2020 - LinkedIn Sued For Spying on Clipboard Data After iOS 14 Exposes Its App:
https://wccftech.com/linkedin-sued-for-spying-on-clipboard-d...
2013 - LinkedIn MITM attacks your iPhone to read your mail:
https://www.troyhunt.com/disassembling-privacy-implications-...
2012/2016 - Data breach of 164.6 million accounts:
https://haveibeenpwned.com/breach/LinkedIn
According to haveibeenpwned.com, my email & password were leaked in both the 'May 2012' and 'April 2021' LinkedIn incidents.
I'm shocked, shocked to find that a Microsoft product will actively do a bunch of horrible invasive stuff while simultaneously not caring about security of this private data.
wondering if all the new browsers in the market have the ability to block such scanning APIs explicitly.
I run ad blockers and pihole, does that help?
Should be fine. To check, open up devtools and see if the requests to /li/track fail.
some of these things are just an effect of using chromium browsers.
use safari or Firefox. and chrome only for incognito web app testing.
use_dynamic_url:true in the manifest is your friend against this.
Deleted my LinkedIn account. Fixed.
When Aaron Swartz does it, it is the threat of life in prison leading to suicide. When a multibillion dollar company does it, it is just capitalism.
HOLD EXECS LEGALLY ACCOUNTABLE, CRIMINALLY AND CIVILLY, FOR THE CRIMES OF THER CORPORATIONS.
This is ridiculous click-bait, and it wouldn't surprise me if the main point was to just come up with a headline that would go viral and drive people to their website which conveniently has an option to donate to their "legal fund".
I mean, come on. Do I like that they are making use of browser fingerprinting? Not really. But to make it sound like they are "illegally" scanning my computer is ridiculous.
seems like clickbaiting, browser can't 'scan' your computer...
The fact that every job application wants a link to my profile on a platform that tries to push "brain training puzzle and games" on me just makes me angry every single time. I really hate LinkedIn and my active rebellion against it is hurting my ability to find a new job.
I know there has been other LinkedIn hate on HN this week. I know they have some good tools for job searching and hiring. I still wish we as a society could move on and leave this one with MySpace.
use firefox turn on the setting resistFingerprinting in about:config
I removed my LinkedIn premium subscription because of this. It was always very suspicious and expensive so they were already on thin ice. This is unacceptable and LinkedIn crossed the line with yet another fascist social media platform.
I can’t take an article seriously that starts:
> Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software
and then proceeds not to explain how it’s doing that to me, a Safari user.
Because, spoiler: it isn’t. Or, it might try to search, and fail, and nothing will be collected.
Yeah, that won’t work for Firefox users as well (extension IDs are randomized on install).
But people do use Chrome, and this trick works there.
I can't say I needed yet another reason to hate the current state of LinkedIn, but I am not surprised in the slightest.
Bait, just look at browser addons, millons of site do it as well
Therefore it’s okay, is that your point? Because I don’t think it is.
This is true/valid in many ways, but the signs of significant AI gen are pretty obvious. And now I wonder how much of the overblown narrative is here.
This reminds me of the slop bug reports plaguing the curl project.
Reminder for windows control alt shift windows L
If they are genuinely only using the information to detect bad actors and maintain site stability as the affidavit states, and if they can prove it, this seems like potentially a non-issue?
I am not a lawyer, but site stability seems like a GDPR "Legitimate Interest" in my book anyway.
Another good reason not to use extensions, and leave whatever they do for utility apps.
The only explanation of linkedin being worth 44B is the prominent appearance of both bill gates (who started spending a day a week at MS after nadella became ceo), and reid hoffman appear prominently in epstein files. The deal itself was finalized during Trump's first term. So everything checks out
Typical microsoft
Why can't we have nice things?
because corporate greed corrupts every nice thing: it pushes the other (maybe more moral) 'nice thing' alternatives out of the ecosystem by subsiding using VC funding to provide 'NiceThing!' for free until 'NiceThing!' is the monopoly or bought by another entity to become part of the monopoly (due to weak/not enforced antitrust laws).
Because we let them get away with it. Take something they're going to miss and can't replace (e.g. their freedom or their head) and it will stop as long as enforcement is reliable enough that they expect to get caught.
These aren't good people, but if you make the fine to the organisation much more expensive than the expected return, lock up the whole board and leave their families without a pot to piss in we will see this become the exception instead of the norm.
Unbounded capitalism.
>The user is never asked. Never told. LinkedIn’s privacy policy does not mention it.
OMG is literally every article written with LLMs these days I just can't anymore. It's all so tiring.
I get it — it can be frustrating to encounter so much low effort AI content these days. But I think it’s worth looking at the bright side here: the increase in our production of entropy from GPU consumption will hasten the heat death of the universe.
Would you like me to suggest some AI summarizer tools you could use to more efficiently read AI generated content in the meantime?
Why don't we train LLMs on the entire internet every day? Then we don't even need to read anything. Reading is something people did in 2025
Nice try, but you em-dashed like a filthy human. The drone has been dispatched.
You're absolutely right!
the drone that gives hugs, right??? right????
Let me think about that...
Yes. Resistance puts the possibility of hugs on the stool, so to speak.
> I get it —
well done
This is incredibly normal language and quite close to how I would write this quote, so what makes you think this is LLM text?
I've had the same thought pretty often, lately.
I get it... I'm not a good writer. It just sucks that now people are going to assume the stuff I said isn't even me.
I guess I always scored pretty low on the Turing test and never even knew it.
It might be normal language but lets say maybe 5% of real human blog writers use short punchy phrases like that. The noticeable problem is now its 50% of blog posts because almost every single AI authored post uses the same phrasing, it's tiring knowing you are just reading ChatGPT output. Its usually part of a low-effort funnel to guide you to some product/service.
The other replies have explained what's jumping out but I'd agree that without the other surrounding sentences of the article's introduction I'd be inclined to think that quoted sentence by itself might be human. The full text, however, doubles down on the AI-smelling constructions and IMHO almost certainly indicates some AI provenance.
Is it actually stylistically close to how you'd write it? If I reformulate your comment in slop style I'd do something like:
The language is natural. Normal. Human. Who could question its authenticity?
The original example isn't the worst offender, but even small offenders stick out when you can't escape seeing this kind of thing everywhere.
It’s the fake drama. Punchy sentences. Contrast. And then? A banal payoff.
Human journalists and marketing copy writers have been writing like this for at least 50 years, if not considerably longer.
I am exhausted by so many people calling writing out as AI without sufficient proof other than writing style. Some things are more obvious, sure... maybe I'm just too stupid to see a lot of the rest of it? But so much of what gets called out seems incredibly familiar to me compared with traditional print media I've been reading my entire life.
I'm starting to wonder if a lot of people just have poor literacy skills and are knee-jerk labeling anything that looks well written as AI.
I think one factor is the lack of variation. Sure, a copywriter might use those techniques as a hook, but there’s far more content using them paragraph after paragraph after paragraph than I’ve ever seen before.
You might also reframe how you read those comments. Perhaps when people are labeling a piece as “written by AI,” they’re just conveying that they perceive it to use the same “voice” that LLMs use, and judge that voice negatively. Sometimes people say things non-literally and don’t need proof.
You're right that (some) marketing copy writers have been writing in this style for decades, but suddenly every second tech blogger has assumed the same voice in the past 2 years. Not everyone is as sensitive to it. I read this crap daily so I've developed an awareness and I'm confident in calling it out.
I don't think I've personally seen a single false positive on HN. If anything, too much slop goes through uncontested.
> If anything, too much slop goes through uncontested.
It's actually insane opening up /r/webdev and similar subreddits and seeing dozens of AI authored posts with 50+ comments and maybe a single person calling it out. Makes me feel crazy. It's not as much of a problem here, but there is absolutely a writing style that suddenly 50% of submissions are using. It's always to promote something and watching people fall for it over and over again is upsetting.
You're absolutely right.
[dead]
It’s 100% LLM text. HN really needs a button “flag as slop”.
Reading (and even more so, using the tools to produce) a bunch of LLM-output writing also affects one’s writing style. Ever sat down and blown through 3-4 books by a favorite author, then written something and found yourself using similar structure, word choice, style…? This could very well be a human author that’s been exposed to a lot of LLM output (ie 95% of this site’s audience).
I find myself doing this a lot, and I’m sure even more slips without my notice.
I agree that that line reads GPT-like, but it's far from a conclusive tell. One option that I wonder about is if frequent interaction with AI will begin to influence people's organic writing style.
> It's all so tiring.
What's tiring is a comment like this. If you don't like the article don't read it -- and don't comment.
One cannot make an accurate assessment of liking or disliking an article without having read the article.
The OP's complaint is literally about a one-sentence paragraph, the second in the article. Plenty of warning to avoid the rest and move on, but LLM shaming is it's own reward perhaps?
[dead]
Who cares if it’s LLM written or assisted writing?
What matters is the content!
LLMs didn't invent the "Rule of Three".
Nothing in this sentence is evidence of AI.
What's next? "There's punctuation in the sentence, must be AI" ?
How is that quote in any way demonstrative of this being written by LLM? You do know that LLMs were trained on the internet and every digitized text they could get their hands on? You are jumping at shadows, calm down already.
what makes you think that? and what sets your comment appart from beeing created by an llm?
How can you tell?
I don’t like AI slop as much as the next guy, but that part doesn’t seem so bad? Sounds like something anyone could write.
Ehh… this quote alone is pretty benign. If you didn’t mention it, I wouldn’t have even considered the possibility of AI.
That's the intention. Make the internet so unbelievably shit that you just accept and move on.
LinkedIn is definitely one of the most by far worse companies I have had to ever interact with.
Literally 2 days ago, I submitted a post: LinkedIn "final decision", restricting my account and making me feel unheard[0] explaining all of some of the worst customer support I have seen
I wish to give a TLDR, but essentially Linkedin will simply reject your account or give you immense headache if your id's aren't being detected by persona (persona is a really shady-company in it of itself with really not the best security practices) I actually lost count of how many times their customer support just responded with a bland message and just didn't even read my message
This is why, being frustrated out of all of this, I actually sent a linkedin customer support message that I don't feel heard, I want to be heard by human, so if you are a human especially when they were asking ME to go to a public notary to sign an affadavite to get a 1 day old restricted Linkedin account (oh btw, its also illegal for a minor to sign an public notary in my country the way they mentioned and I mentioned it about as many times as I could and that I am willing to share my ID like Aadhaar to them but they genuinely don't hear your messages)
Honestly, my experience just says that there is no human customer support in Linkedin, its really a customer support nightmare worse than even some of the telecom horror stories. Perhaps I should contact browsergate.eu if my incident within my country can also be a case of legality or not, essentially I was cooperating with them to give any document that I can reasonably provide but linkedin forms and everything redirect to 404 as well.You can read my experience in depths but my experience really shows me as to Linkedin customer support being so unhelpful that you question how a company can be so bad. I wish for more ethical alternatives to Linkedin and its nightmare to appear within this space.
(I also had a minor idea of asking Linkedin support to see if they read my messages and literally as I told them that I feel unheard, I would like it if they can make me feel heard and that they are reading my messages so If they are actually reading my message, then respond to me with value of 351/13 and I asked the person who joined Linkedin as to why they joined Linkedin, essentially just one line would suffice to know if I am talking to human or not, they did not respond to any of this and essentially, as far as I can tell, pasted another pre-generated response not hearing me)
[0]: https://news.ycombinator.com/item?id=47586760 (https://smileplease.mataroa.blog/blog/linkedin/)
[flagged]
Several years ago I heard the company I worked for say they had a way to get notified if it seemed like an employee might be thinking of leaving, so they could take some kind of action. I now wonder if LinkedIn, or various job sites, were selling them data.
LinkedIn might not need to sell the data. You can set your profile to “open for work” privately, and only recruiters can see it. So if your company has people with LinkedIn recruiter accounts, they could see your profile set to looking for work
PS: I guess given that recruiter accounts are paid, LinkedIn is technically selling access to the data in a way
It is pretty easy to signal stuff on linkedin without intending to do so. For example whenever I get an old coworker adding me on linkedin, they are 100% of the time job seeking. Inevitably they start a new role some weeks later.
All one has to do is just measure employees linkedin activity. I mean truthfully people don’t use the site at all if they aren’t actively looking for work. It is corporate dystopia otherwise. It is trivial to find these signals.
LinkedIn is a job board so that seems unlikely.
LinkedIn is a job board as much as Facebook is picture-sharing website
Not in Lithuania. While it's not the No1 or 2,3 platform for job advertisements, it's still very popular, especially for IT and management jobs.
So this probably depends on the country.
Sorry, I meant more like vast majority of people daily on LinkedIn are not there cause they are unemployed and looking for work
Are you kidding? They've probably been selling a datastream of who in the company has been job searching to company HR departments the whole time. Search for a job on LinkedIn and I bet anybody with a paid corporate account can find that out if they care to.
If they have been doing that, they haven't offered it to me, which seems weird since I'm their ICP.
The simpler explanation is that they aren't doing that.
LinkedIn actually sued HiQ Labs, which scraped LinkedIn to do exactly this (and this extensions scanning is likely a defense mechanism against similar attacks):
https://epic.org/documents/linkedin-corp-v-hiq-labs-inc/
> HiQ has created two specific data products targeted at employers: (1) “Keeper,” which informs employers which of their employees are at “risk” of being recruited by competitors; and...
My hunch is that HiQ simply looked for spikes in activity on LinkedIn as a signal for a job hunt: https://news.ycombinator.com/item?id=47566893
In any case, this lawsuit was discussed a few times on HN at the time, and IIRC there were a fair bit of support for allowing free scraping of "public information." Interesting how the sentiment here has turned these days...
why is everyone online so incorrectly conspiratorial-minded nowadays? and no, there are not just way more conspiracies nowadays
Why give corps like Microsoft the benefit of the doubt, when you'll be right more often than not by accusing them of anything underhanded?
[dead]
[dead]
[dead]
[dead]
[dead]
[flagged]
[flagged]
[dead]
[dead]
[dead]
[dead]
[dead]
[flagged]
[dead]
[dead]
[dead]
[dead]
[dead]
[dead]
[flagged]
[flagged]
Maybe it's not and it's just badly written, but we've come to associate the two so strongly that we can't separate them.
[flagged]
[flagged]
The title is a complete nonsense.
So is this comment.
Yeah I agree
Nothing but click-bait.
Doesn't it depend how they're storing the data? If it's sufficiently transformed, it could be considered fair use.
Copyright isn't relevant here.
For my curiosity what would the fair use be?
Research.
No?
Exactly how is it "illegal" to run code that exercises some aspect of the legitimate browser API surface? Are there functions marked as legal, and others marked as illegal?
Is there evidence that they use that information for anything other than browser fingerprinting or fraud detection?
That seems like the most obvious use case? Or maybe I missed something in the write up.
We can hypothesize that there may exist some for-profit companies that deserve the benefit of the doubt. Microsoft is not one of them.
[flagged]
Please don't sneer on HN. The guidelines make it clear we're trying for something better here. https://news.ycombinator.com/newsguidelines.html