Microsoft is running one of the largest corporate espionage operations in modern history.
Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm.
The user is never asked. Never told. LinkedIn’s privacy policy does not mention it.
Because LinkedIn knows each user’s real name, employer, and job title, it is not searching anonymous visitors. It is searching identified people at identified companies. Millions of companies. Every day. All over the world.
You must log in or # to comment.
JFC, this is actually true. It’s literally scanning for 6000+ hardcoded extensions, sequentially:
LinkedIn should just be considered malware at this point. If you really need to use it, use Firefox
It scans your JavaScript context for known browser plugins. That’s it. It’s not scanning your whole computer for installed software.
What about the app?
I was gonna say… If LinkedIn managed to figure out how to break out of the browser sandbox, this would be a much bigger headline. Like “scanning your PC for installed software without the user’s knowledge, simply by visiting the site” is full blown “pull the plug on your entire internet connection until this zero day exploit can be figured out” levels of bad.
I think the “American-Israeli cybersecurity firm” bit really sells the plausibility of this while also being dangerously close to “my uncle works at Nintendo.”
This is straight up misinformation. First off, it’s perfectly legal.
LinkedIn does browser fingerprinting. It’s the same thing Google and Meta do. It’s how Google Ads is shifting to a post-adblocker revenue stream.
Browser fingerprints show fonts used, audio codecs, WebGL render data, processor, operating system - enough that if you add up several factors together, it makes a statistically unique fingerprint. it does NOT scan applications on your computer. It can’t. It DOES scan which browser extensions you have running (if they affect page loading).
If you check your email and then close that and go to Google in an incognito window and search for porn - Google will fucking know what you’re looking at. Gmail and all Google apps all fingerprint, and then you’ll notice how Google ads trackers are on most sites online? Yep. That’s how they track you.
Use a VPN? Use an ad blocker? Great - Google doesn’t care. Google can track your fingerprint.
See your own fingerprint - check how it know it’s you visit after visit.
There is literally a section called Why it’s illegal.
LinkedIn’s scan reveals the religious beliefs, political opinions, disabilities, and job search activity of identified individuals. LinkedIn scans for extensions that identify practicing Muslims, extensions that reveal political orientation, extensions built for neurodivergent users, and 509 job search tools that expose who is secretly looking for work on the very platform where their current employer can see their profile.
Under EU law, this category of data is not regulated. It is prohibited. LinkedIn has no consent, no disclosure, and no legal basis. Its privacy policy does not mention any of this.
Well that was very interesting. I wasn’t planning to cover my tracks, but apparently I am.
They also scan for thousands of extensions. The only reason it doesn’t do this on Firefox is that Firefox randomises the uuid of extensions every time. Chrome doesn’t.
it does NOT scan applications on your computer
technically browser extensions are considered applications under EU’s GDPR
It DOES scan which browser extensions you have running (if they affect page loading).
as per their report:
Why two detection methods
Method Technique What it catches AED fetch() against known resource paths Extensions that are merely installed, even if they inject nothing into the current page Spectroscopy Full DOM tree walk Extensions that actively modify the page, even if they are not in LinkedIn’s hardcoded list While browser extensions are considered apps under the GDPR, the headline is intentionally misleading. LinkedIn isn’t “Illegally Searching your Computer.” It’s asking the browser for all the info it’s maximally able to give up. We do need to define browser extensions in a way that doesn’t use fear as clickbait to make it sound like LinkedIn has greater access to a device than it really has.
And thanks for the correction on AED, I had seen another analysis a couple weeks back and I didn’t recall correctly what was being collected.
it’s misleading to say its searching your computer tho…? this invokes the thought of LinkedIn getting to rifle through your files like it has access to ~/Documents/ or smth.
but yeah tracking you over the internet is similarly bad
it’s misleading to say its searching your computer tho…?
Wait, your browser extensions aren’t on your computer?
It’s misleading because saying “search the computer” implies a breadth of scan that isn’t present. That’s like saying a website “searches the computer” to grab cookies generated by that site; technically true but worded to be misleading.
To be clear this is bad, but it’s important to be clear when explaining why it is bad to avoid creating resentment when the person you are explaining it to looks deeper into it themself and finds that it’s not as bad as your explanation was implying.
I believe the point they’re trying to make is that they have access to APIs which describe particular software on your PC. You can argue based on the fact that, yes, the software is persisted on your filesystem. However, the API they access brokers [meta]data about the software. It’s not a filesystem API. If I add arbitrary files to an extension directory under my browsers path for extension persistence, they probably cannot see those arbitrary files unless the extension is built to allow it.
There is a big difference between having direct and broad read access to the filesystem, versus the much smaller volume of data they can infer about your filesystem using APIs for browser extension data.
There isn’t an API for browser extension data. They are searching for the existence of thousands of specific addresses to perform the search.
Fonts, codecs, hardware, OS, extensions are all parts of a computer that never ever need to be transmitted to a website for it to function. Any information about them should be sandboxed, and if the website wants to display differently based on them, it can send static data or code in and get nothing back out.
It depends on the website, but LinkedIn certainty doesn’t need full fingerprint data to operate correctly. Most privacy-respecting browsers either mask or spoof the data already.
I’m pretty sure for fonts they can tell because they have different widths, which affects page layout, which can be measured.
There’s a lot of stuff like that.
Best would be make it illegal and give the law teeth. Solving it technically will always be an arms race.
Yeah, they can very easily get all of that right now. But functionally there’s no good reason for any browser to let them. Page layout should be a one-way operation that doesn’t allow information back through.
You’d have to kill a lot of JavaScript and CSS for that to work, and then a lot of legitimate function goes away.
Done much web development work?
You don’t have to kill much functionality at all. Scripts that need to access that data should simply live in a sandbox with no network access. They can still do full computational layout.
I have done exclusively web development work.
So you’re going to make it illegal to call
getBoundingClientRectand then pass that information tofetchthrough any mechanism?Essentially yes. Basically, think of two JS sandboxes that can manipulate the same DOM. One can make requests, but cannot retrieve local layout data. The other can get layout data, but not make requests. Both can set layout data.
Web developers can use the former 99% of the time, and the latter for more precise work.
Surely functionality affecting display can be standardized to the point of making them useless for fingerprints? I don’t really care what font my browser uses, as long as I don’t notice it. Similarly, other details should either be randomized, mocked, jittered, or outright blocked. Fingerprinting only works because they’re operating in a rather non-adversarial space. The weakness with their current approach is the huge set of variables, which I’m sure we can leverage to reduce the algorithms determinism.
We can either all appear the same, or appear completely unique every time. Either approach should work.
I don’t know a lot about how fingerprinting works, but some of what i’ve read is pretty insidious. Some things could probably be obfuscated, but some of what the trackers use has legitimate purposes as well. Your application may serve different content based on the screen size, or fall back to an older library if such-and-such API isn’t supported.
Personally I’d rather make targeting advertising and tracking illegal, and gut the whole thing to avoid the arms race.
I think the argument is that since some of the extensions that are probed can be political in nature, which can reveal political identity, which is potentially unlawful in the EU. However, it really needs to be up to a judge to make a decision on that.
In general what they’re doing is legal, and the BrowserGate people are using niggling little details, a handful of extensions out of the 6000 probed, to justify this argument. I couldn’t say, especially as someone from outside the EU, whether this is actually illegal or not, but it’s definitely in a nebulous area at the moment.
Though I agree it’s sensationalized in terms of claiming it’s “searching your computer” and doing “corporate espionage.”
Yeah but still sick of this shit
Looks good!
I have NoScript for JS tracking, but what do you use for fingerprint randomisation?
I use CanvasBlocker.
I’m using canvas blocker and I’m still getting “Your browser has a unique fingerprint”
What am I missing?
I’m not sure, but I believe PumaStoleMyBluff’s reply may describe the issue.
Your link just opens this whole thread for me.
Is there something wrong on my end (using Summit app) or is your link broken?Sorry, I’m pretty new to the Fediverse, so I probably did it wrong. Hoping someone will correct me, but in the mean time I’ll quote the person whose comment I meant to link to:
Some of the test sites don’t differentiate between random and unique. They may see a randomized fingerprint as a plausible unique user, but it may be different the next time you visit. Other sites may detect that your browser has taken steps to randomize your fingerprint, and use that as an identifying piece of information on its own (power user vs average joe)
deleted by creator
I made no effort to do that, im using the duckduckgo browser on my phone.
Interesting, I also have the DDG browser but the test shows a unique fingerprint result. I don’t think that I have tinkered with any settings and I haven’t installed addons.
Some of the test sites don’t differentiate between random and unique. They may see a randomized fingerprint as a plausible unique user, but it may be different the next time you visit. Other sites may detect that your browser has taken steps to randomize your fingerprint, and use that as an identifying piece of information on its own (power user vs average joe)
Correction- the first test was the browser inside the lemmy voyager app, not sure what its based on. This one is out of the DDG app;
the browser in voyager is probably your default browser over customtabs
The Attack: How it works
Every time you open LinkedIn in a Chrome-based browser,Stopped reading there
evidence?
I don’t doubt they’re scummy but some kind of evidence is necessary here.
https://browsergate.eu/the-evidence-pack/
Was right there on the page.
ah thanks missed that
They cannot do that. They do scan the browser’s extensions, but the title is very misleading.
Extensions are installed on your computer, therefore the title is true, although a bit sensationalist
for that matter they can to an extent. they could be probing ports on localhost and your network. only HTTP protocol though, but through timings they could probably differentiate between open, closed and filtered ports
LinkedIn loads an invisible tracking element … zero pixels wide, hidden off-screen, that sets cookies on your browser without your knowledge
Uh, what? Hidden “off-screen”? In a browser? I’ve been doing web dev for decades and have no idea what that means. Can someone explain how this is supposed to make any kind of sense?
I presume they’re talking about an element with something like this: position: absolute; left: -50px; width: 0px; height 0px;
Very commonly used for elements like skip to content links that are hidden off screen and shown on screen once they receive focus.
Details are here: https://browsergate.eu/how-it-works/
Thanks! I read the main page but missed this
“Yes, LinkedIn was probing for a lot of extensions, but there was no scanning of your computer and no malicious code, just a simple JavaScript technique to determine if the extension was there.”
Reguly decided to test the resource probing and results obtained on a sample 10% of the 6,000+ extensions. “One extension refused to have its tab closed and reopened itself every time I closed it. Others changed my home screen, the about:blank page, and added bookmarks.” Another Rickrolled him, playing the ‘Never Gonna Give You Up’ video every time he opened his browser. “To say that a lot of these are the worst of the worst extensions out there is not an understatement.”
What’s more, statistically from his sample testing, he believes only around 2,000 could be detected by LinkedIn, when even 6,000 is just a small sub-set of the total number of extensions that exist. If LinkedIn was intent on fingerprinting or profiling its users, there are better methods than this.
“I don’t see anything that indicates malicious intent here,” he told SecurityWeek “It is discovering some information, yes, but I don’t think it crosses the threshold to malicious – I think that’s a very sensationalized view of what’s going on.”
Asked why LinkedIn is doing this, he replies, “I don’t know. But for me, a common trend across these extensions is that they have data scraping functionality and are not well known. And they were problematic at times. Many of them gave me that used-car-salesman vibe that you see in the movies,” he continued.
“I can’t help but wonder if LinkedIn wanted to know if these extensions were there to try and defend against them. I certainly wouldn’t want one of my LinkedIn contacts to be running these extensions and visit my page with these scrapers installed. I feel that a user with these extensions installed visiting my LinkedIn page is more of an affront to my privacy than LinkedIn checking to see if I have these extensions.”
Of course, depending on interpretation, this still may not be appropriate or legal in the EU. However, it does seem that BrowserGate’s claims are a bit on the exaggerated side.
OP’s link with Google’s AMP nonsense removed: https://www.securityweek.com/browsergate-claims-of-linkedin-spying-clash-with-security-research-findings/
we have updated our terms and conditions
pray that we do not alter them any further…
Literally? They’re searching installed browser extensions, that’s not “my computer.” Sure, it’s identification data, and it may brush up against EU laws, but “illegally searching your computer” is definitely a bit of hyperbole.
They are not “literally” searching my computer, as much as I am not literally fucking your mom.
I’ll never join LinkedIn. Pointless middlemen in job searches. A social network people are forced to use.
before they started requirng logins to see other peopels profile, that you followed, it was a nice to see where certain people in colleged ended up. then they required it during the pandemic. thats when most of the “job sites” started eliminating any criticism of companies.
hidden code searches their computer for installed software
Not gonna read an article that is this poorly researched. It’s clickbait.
Last time I visited linkedin it shot my dog. Be careful everyone!
Who is upvoting this blatant fallacy. Browser fingerprinting is not scanning your entire PC. Fuck off op
What?
