How LinkedIn exfiltrates extension data from the browser

https://prophitt.me/articles/nefarious-linkedin

by asaasinator • 7 years ago

510 149 7 years ago

westoque• 7 years ago

Not only that. I believe LinkedIn also harvests data from your calendar. I remember seeing LinkedIn notifications about the person I’m meeting without even asking for it. Kind of creepy and unwarranted unless they asked me to.

obenn• 7 years ago

To be fair I'm aware that they keep asking me to sync my calendar but deny it every time, I'm quite sure that function would have to be explicitly allowed.

ce4• 7 years ago

what if the other person has allowed LinkedIn access to their calendar?

plotteddancer16• 7 years ago

Wow, this is disturbing. Lest we forget that LinkedIn has been a Microsoft subsidiary for three years now. I wonder if Microsoft is doing this elsewhere too?

filoleg• 7 years ago

LinkedIn has been doing this (and a few other shady dark patterns) since way before being acquired by MSFT. And MSFT seems to be letting the recently acquired companies do their own thing and not interfere, which is what employees of those startups would most likely prefer. Not saying that this kind of hands-off approach is the best idea here (because i dont have a strong opinion on that), but i dont think it is fair to extrapolate the shady behavior of LinkedIn (that has been documented since a very long time ago) to the rest of MSFT

data_spy• 7 years ago

For what it's worth, I read an academic paper that said browser extensions are a strong signal in identifying a person when combined with geo data.

nwsm3• 7 years ago

I’d be interested in reading it if you know the name or author.

Maybe this: https://www.securitee.org/files/xhound-oakland17.pdf

zrobotics2• 7 years ago

The real question here is why LinkedIn should even need this information. This represents significant engineering work to develop, so obviously at some point they decided that knowing which extensions are present had value. However, I cannot think of a single non-malicious reason to want this information; the malicious reasons that spring to mind are browser fingerprinting and ad targeting.

nicolaslem• 7 years ago

The answer is mentioned hidden in the article: to detect accounts that scrape/resell the data found in LinkedIn profiles.

jacquesm2• 7 years ago

Unfortunately for linkedin spying on all your users in order to catch a few miscreants is not how you implement stuff like this.

codezero7• 7 years ago

I can think of tons of non-malicious reasons.

1. Support requests because site is broken, but it turns out you are using an extension that breaks the site.

2. Extensions are exfiltrating data to the extension owners, against LinkedIn's TOS, and they are trying to protect their users, or rather, they don't want competition :)

OK, that was two.

They aren't blinding probing for any and all extensions, only a specific set, which shows restraint and implies to me they are having a sort of arms race with extensions that scrape contact info.

jguffey• 7 years ago

There are a lot of extensions built for networking professionals (recruiters, marketers, sales people) that automate browser behavior on LinkedIn in an attempt to drum up attention. For example: automatically viewing profiles of candidates, so that the candidate sees the recruiter/sales person on their "who's viewed my profile" page.

A cursory google-search for something like "linkedin browser plugin" yields tons of these types of products.

kibwen• 7 years ago

They aren't blinding probing for any and all extensions, only a specific set, which shows restraint and implies to me they are having a sort of arms race with extensions that scrape contact info.

I agree that the goal here is likely to combat scraping, but I don't think we can use this behavior to draw that conclusion. From the article:

"I recommend not using web accessible resources. Out of all extensions LinkedIn finds, a majority of them are due to web accessible resources."

There's no trivial way to get a list of all the user's extensions, so they needed a side channel that they could use to detect them on a case-by-case basis. The only extensions that they can detect are ones that feature this side-channel. Even if Linkedin did want to know all your extensions (which, again, I think is less plausible than an arms race) we would see this same sort of behavior due to the limitations imposed by the browser.

imglorp• 7 years ago

Wait, so they try like crazy to scrape YOUR contact list but fight like crazy to keep THEIRs from getting scraped.

jressey• 7 years ago

I am in the "Sales Engagement" space, and most of the extensions I'm seeing are sales-based. Sales Navigator is LinkedIn's (less sophisticated) sales engagement tool. I understand they use a heuristic to determine which extensions to look for, so my set may be based on my industry.

My take is that some motivation comes from LinkedIn seeing which Sales Engagement company they want to buy in order to replace Sales Navigator. Therefore by extension they are probably seeing what extensions people are using most commonly with LinkedIn in order to either beat or buy them.

NewsAware• 7 years ago

I would guess this is not just to protect user data from being scraped. LinkedIn earns a lot of money from users paying for recruitment services (as in get advanced filters to search for candidates and to send them job proposals). This costs 4 figures per month. So the LinkedIn product management has a high value from learning which extensions people are using to substitute or enhance their paid services even if the extensions don't violate the ToS.

zrobotics2• 7 years ago

This seems like the most likely reasoning; some of these extensions probably do allow certain uses that LinkedIn charges for. Still shady behavior, but this is at least more reasonable than user fingerprinting.

bduerst• 7 years ago

Linkedin is used for lead generation, for more than just recruitment. OP touches on it when he hints at the email-hunter extension.

Linkedin can skew results and obfuscate data to users who are heavily digging for lead data. Remember, Linkedin's main value proposition is that it has a wealth of user-submitted data, and if it loses that it loses some of it's value.

mehrdadn2• 7 years ago

How would you feel if you opened a program and the program started to check your file system to see what other programs you had installed?

Slightly tangential but does anyone know if this is what Chrome does? It has a software reporter tool. Also Windows seems to do this too :/ though I'm not 100% sure.

Piskvorrr2• 7 years ago

Not happy about other programs deciding to become spyware, either. "But they also!" is not a valid defense.

mehrdadn2• 7 years ago

Yeah I didn't mean it as a defense either. More like we should've been freaking out quite a while ago.

Jonnax• 7 years ago

Intel's customer improvement program thing does that when you accept.

codezero7• 7 years ago

Let's put this into context. It looks like LinkedIn is trying to detect specific plugins which affect the page/UX. The plugins the author links to are for scraping personal emails for email marketing "leads." This is totally common, so I'm not making any kind of judgement here, but I think LinkedIn has a right to protect its service and users. I can imagine the support requests that happen where the LinkedIn the person is seeing isn't the same as LinkedIn would be pretty confusing. Not all people are smart enough to know what all their extensions do, especially if they use them for their job and were told to install and use them.

With all that said, I also think people have a right to use the extensions they want to scrape or block content on sites they visit, so catch 22 I guess.

It's worth thinking of this from both angles before getting angry at LinkedIn, or the author of this post :)

luckylion2• 7 years ago

That's easy: LinkedIn should simply ask for permission. "Hey, you're about to submit a support request. Can we quickly check your browser for a few plugins that are known to cause trouble?"

"Is that plugin installed" is also a terrible "protection" against scraping.

codezero7• 7 years ago

Yeah, that's reasonable, I think it's much more likely to be an arms race w/ contact scraping extensions than a support issue.

tw044• 7 years ago

I also think people have a right to use the extensions they want to scrape or block content on sites they visit

Do you also think people have a right to record movies they watch in the theater?

I think people are free to run whatever extensions they want in their browser. I think companies are also free to tell people they aren't welcome if they're going to use that extension.

Why should a company like linkedin be FORCED to serve anyone? It's not a public service, they aren't a government entity, you have no right to their service.

codezero7• 7 years ago

I’m pretty much in agreement with you I think.

sb82444• 7 years ago

Why should LI be able to sell you the data (Recruiter service) that they don't own?

The difference in this analogy is that films are fully the IP of the production company but LI sells data that they don't explicitly own.

pavel_lishin• 7 years ago

Do you also think people have a right to record movies they watch in the theater?

Nope, but I'd sure be upset if I caught movie theater employees surreptitiously reaching into my pockets to check for cameras.

danShumway• 7 years ago

For better or worse:

https://www.theverge.com/2017/8/15/16148250/microsoft-linked...

AFAIK the current state of things is that LinkedIn is welcome to try and stop people from scraping the site, but it can't criminally charge them or try to legally block them from the service. Roughly the same situation as adblockers -- you can detect them and stick banners all over the place, but you can't outright bar someone from running uBlock Origin on your domain.

Please note that I am not a lawyer.

CodeMage• 7 years ago

I think companies are also free to tell people they aren't welcome if they're going to use that extension.

Or a particular browser. Or a specific operating system. Or the wrong brand of device.

You can probably see where I'm going with that, but in case it's not perfectly clear, I'm trying to say that a company might want to dictate a lot more than just what extension you're using in a browser. Not everyone is going to agree that they are right to do that.

Bear in mind that there's more to consider here than the legality of what they're doing. The openness of the Internet, the interoperability of different operating systems and devices over a particular somewhat-standardized protocol -- these aspects aren't regulated by a law, but they're still important. I'm one of those people who remember the Browser Wars and I don't remember them fondly.

Of course, it's not just about technical aspects, either. There's the whole grey area of whether it's okay for LinkedIn to metaphorically rifle through our proverbial pockets, looking for stuff they don't like and don't want to admit on their virtual premises.

So no, I wouldn't agree that things are as clear cut as you present them.

ben509• 7 years ago

I also think people have a right to use the extensions they want to scrape or block content on sites they visit
Why should a company like linkedin be FORCED to serve anyone?

Companies are routinely forced to serve people per the ADA and CRA. There are various rationales for them; I favor them because they cause a degree of integration that helps to disrupt identity politics.

I think, beyond that, if a company has clearly advertised terms of service and sticks to them (it should be possible to sue a company for violating its stated policies) then they should be able to reject customers if they want. Especially, it's often a reasonable engineering/business tradeoff to not support a customer over delivering a buggy product.

evanlivingston• 7 years ago

Do you think people have a right to photocopy an entire book from the library? What about part of a book? What if I copy a paragraph by hand into my notebook.

Where is the line?

Also, companies are forced to serve people all the time. That was a large part of the fight for civil rights. At some level we do have a right to the service of a private company.

eridius2• 7 years ago

I think detecting extensions would be reasonable if they're doing this in order to figure out what features their users want that LinkedIn isn't providing, so they can start offering those features as first-party features instead.

But I doubt that's why they're doing this.

codezero7• 7 years ago

That's actually a pretty darn good idea, the invasiveness aside, in fact, if they were doing this for that reason, it may be easy enough to let folks know that's why so it doesn't feel so invasive.

buttsu_• 7 years ago

This is worth getting angry at Linked in, sorry

AlexandrB2• 7 years ago

LinkedIn quietly continues to be one of the creepiest products around. I still remember their dark patterns around obtaining your contact list[1]. It's not surprising that little has changed under the new Microsoft which has equally little respect for user privacy and choice.

[1] https://www.quora.com/Does-LinkedIn-access-your-email-or-con...

Quequau• 7 years ago

Creepy is exactly the right word.

snarfy• 7 years ago

I have suggested connection on linkedin that is my wife's maiden name. It's super creepy. We have zero shared connections.

murkle2• 7 years ago

Jane Smith?

amelius• 7 years ago

Perhaps your wife's family frequently checks your profile?

gooftop• 7 years ago

In the relationship graph that Linkedin builds, suggested connections could be based on a lot of things other than shared connections. Just speculating here, but it could be based on shared email address, shared IP address, shared physical address, membership in same groups, linkedin messages by you and wife to other people within 1-2 degree of either of you .. or some combination thereof for higher confidence.

neilv• 7 years ago

LinkedIn started out seeming OK, IMHO, then got conspicuously creepy, and that was before the sale to MS.

I deleted LinkedIn as soon as it started seeming creepy, since I didn't need to hear from recruiters, at the time.

I'm currently resisting LinkedIn, and trying to skim angel.co, which doesn't seem too creepy. (Though many of the hiring startup blurbs on there are creepy, like "What Up is disrupting at the intersection of blockchain and marketing insights from intimate medical devices!".)

darkcha0s• 7 years ago

Isn't this just another way to fingerprint the user?

legitster• 7 years ago

LinkedIn offers a marketing feature where users can opt to prefill forms and etc using their LinkedIn data. But not OAuth based (a quick and dirty workaround, perhaps).

Our privacy team took one look at the code and said to stay 100 feet from it.

nwsm3• 7 years ago

Are you implying websites that include the “Apply With LinkedIn” widget could gain access to a user’s LinkedIn info before they click the button?

chvid• 7 years ago

Linkedin is at war with spammers and scrapers. The mentioned plugin is a tool for quickly finding email-addresses on a webpage. Who uses that?

icebraining2• 7 years ago

Customers of LinkedIn. LI is just mad that they aren't paying.

caiocaiocaio• 7 years ago

You've got to admit, though, being the most scummy social networking site is a pretty big achievement.

Phenomenit• 7 years ago

In this day and age for sure!

dimaryz• 7 years ago

Have you ever heard of FB? :)

et1337• 7 years ago

Previous discussion: https://news.ycombinator.com/item?id=18853607

LinkedIn doesn't have a great track record, but in this case they might just be trying to prevent abuse.

AlexandrB2• 7 years ago

I hope that's true. Social networking companies have a history of (ab)using security features to enhance tracking. E.g. Facebook using 2-factor phone number.

atemerev• 7 years ago

Apparently, attempting to export one’s own contact emails now counts as abuse.

(LinkedIn disabled this option about a year ago; now it’s only accessible via extensions.)

peteretep• 7 years ago

No, they sell the same service to people. LinkedIn are trying to protect their profits, not their users.

grezql• 7 years ago

LinkedIn epitomizes everything wrong with todays front-end. Npm,grunt,gulp,es6,ts,babel, webpack, yeoman, browserify, reactjs, reacts mother and its dog, yarn, bower, jsx.. and so on.

13 MB of JS/css/html: https://imgur.com/a/oehQQzJ

theshadowmonkey• 7 years ago

Thats ember over there. Almost Everyone who works on or maintains EmberJS works for LinkedIn.

stocktech2• 7 years ago

Ember's beefy, but you can't blaim 13MB on it.

rnotaro• 7 years ago

Same things occurring with Facebook.

244 Requests of the 552 requests (12.2MB of 26.3MB) required to show my feed are in JS and CSS.

https://i.imgur.com/pwKuC6h.png

x0n• 7 years ago

Dude builds possibly nefarious extensions for a living. Dude writes article about LinkedIn nefarious anti-nefarious extension code. Conspiracy voting commences. Article at #1

dang• 7 years ago

I took a look and saw no evidence of conspiracy voting. I also don't know what basis you have for the first sentence there.

WellDressed• 7 years ago

Sites we interact with may become adversarial towards us at any time they see fit. I wish my browser and the extensions I use were sacrosanct and outside the purview of other companies/sites.

ballenf• 7 years ago

This addresses the two greatest threats to their business model:

- users associating spam received to their use of LinkedIn

- undermining the value of LinkedIn paid services

I'm more upset at browser vendors for creating such an obvious security/privacy hole than at LinkedIn for using it. And now Chrome will use this as subterfuge for nerfing adblock. This is why we can't have nice things.

icebraining2• 7 years ago

How are browsers supposed to prevent the page from detecting that an extension changed the page's DOM, or that the extension explicitly made URLs accessible to it?

As the author points out, there are mechanisms for showing extension UIs that don't rely on DOM manipulation.

hhs• 7 years ago

What are the alternatives? LinkedIn is pretty powerful with network effects. At one point, I thought angel.co would gain traction.

I wonder if there will be a successor to LinkedIn in the near future?

RobertDeNiro• 7 years ago

But why would people move from linkedin to another platform? Most people that use it are not really concerned with privacy, so they'll need a better reason to switch.

robin_reala2• 7 years ago

Can’t you just not use it at all? I’ve never had an account (indeed I got them to blacklist me) and I can’t say that I’ve suffered. Though I guess I’ve had the benefit of being white / male / etc etc.

ohaideredevs2• 7 years ago

LinkedIn constantly gets me interviews for jobs paying 40% more than what I see listed on Stackoverflow /job sites / through recruiters, etc. I didn't realize what I was missing out on before I made a profile.

smallbigfish• 7 years ago

How does one get to be blacklisted by Linkedin?

LargeWu• 7 years ago

I just don't use it, and somehow I'm doing just fine.

stevekemp• 7 years ago

I actually have an annual calendar reminder setup for myself; once a year I login and read/delete messages.

To be honest I should probably delete my account, but I actively enjoy ignoring it..

eridius2• 7 years ago

Same. Many many years ago I straight-up deleted my LinkedIn account (in an attempt to cut down on recruiter cold-calls, which didn't work) and I've never suffered as a result.

abathur• 7 years ago

Thanks for posting this. I've held out as well, but I question myself each time I get a slack-jawed stare (or the text equivalent) for saying it.

bichiliad• 7 years ago

I wouldn't be surprised if LinkedIn sent this data back, but browser plugin detection sounds like a common ingredient in browser fingerprinting, which can be pretty useful for things like A/B testing signed-out users or detecting ad fraud. I don't place LinkedIn in very high regards, and I'd be surprised if they ever asked a user if they could fingerprint their browser in an unambiguous way, but I don't know if I find this particular thing to be exceptionally evil.

baxtr• 7 years ago

In addition to that I can’t help but to feel completely energy depleted after 5min of LinkedIn usage. The feed is just horrible. Everybody is doing great, no real discussions going on, trashy superficial insight videos. I only log in to read messages, but I am not able to ignore the feed.

pmiller2• 7 years ago

...I can’t help but to feel completely energy depleted after 5min of LinkedIn usage. The feed is just horrible. Everybody is doing great, no real discussions going on....

Sounds like American workplace culture in a nutshell to me. If so, LinkedIn is actually doing it right.

opportune2• 7 years ago

Yeah, I don't really understand the social network features of linkedin. I guess I add people as connections sometimes but even that doesn't really seem important.

The only utility I get out of it is that I can put up my resume and get recruiters to contact me. Which more than makes up for everything else since it has led to job offers

davedx• 7 years ago

How many of those offers have actually resulted in you taking a position though? I know my LinkedIn signal:noise ratio (where signal is an actual commercial deal of some kind) is extremely terrible

bootlooped• 7 years ago

The only reason I have one is that I think potential employers would find it weird if I didn't. Many online application forms have fields for linkedin profile url. I may be mistaken, but I think sometimes it was even required.

tzakrajs• 7 years ago

It’s for practicing being a plastic, corporate drone.

“Congratulations on hiding your misery for 10 years!!!”

duxup• 7 years ago

The only fun on there is when a random person decides to get all trollish and political.

The number of people willing to do that on LinkedIn is a bit shocking....

emrekzd• 7 years ago

How would you feel if you opened a program and the program started to check your file system to see what other programs you had installed?

Not true. You definitely figured out how to market your scraper by lying. Nice job!

rangersanger5• 7 years ago

I used to work on one of those extensions. The lengths linkedin goes to "protect" public data is kind of absurd. If they poured those resources into building tools for salespeople the site would be far more valuable. Or, they could reopen their now closed developer program. It has also been established by lawsuit that those extensions have a right to do what they do.

Those extensions would break the site far less frequently if linkedin would stop trying to break them. And, our users definitely knew when it was us breaking linkedin.

I'm not sure it's as much a catch 22 as it is a self inflicted wound.

murkle2• 7 years ago

"public data"? I think you mean "my data"

chatmasta• 7 years ago

It's data you made public by publishing it to LinkedIn, where default privacy settings is "anyone who can log into linkedin can view this content."

It gets complicated when you start thinking of things like blocking other accounts from viewing your profile, or adjusting visibility settings. Arguably LinkedIn has a duty to protect the integrity of their privacy controls, which would entail implementing anti-scraping measures.

behringer3• 7 years ago

We end users don't need this. I hope you got a more honest job.

rangersanger5• 7 years ago

There are millions of dollars of software sales that say otherwise.

jvagner• 7 years ago

I haven't had LinkedIn for almost 10 years now, and I haven't had Facebook for at least 6 months now.

Explaining why I don't have either is a burden I live with in my professional life, but the degree to which even other technical professionals don't sympathize with not having accounts on LinkedIn is pretty amazing.

I guess I'm relegated to a bit of sub-culture-ness. I'm self-employed, so I'm okay with that, but I guess others might find it challenging.

reaperducer• 7 years ago

Lately I've been telling people who question me about this, "I know some people who work there. They won't say why because of NDA, but they tell me it's better that I don't have an account. They say they wouldn't have one if they didn't work there. I trust their judgement."

That's worked so far.

asdf21• 7 years ago

Is any of that true?

lewiscollard• 7 years ago

but I guess others might find it challenging.

Nah. Perhaps I have a more strict work/not-work separation than many, but I am 9-5:30 plain-ol'-employed here, and from what I have seen of LinkedIn I am absolutely not challenged by this. I care about doing a job well, but watching a bunch of people advertising themselves to future employers by pretending to give far more a shit about The Haps in their industry than they actually do is, while almost charming, not something I would care to spend more than about two minutes every two years doing.

nwsm3• 7 years ago

Not only that, but the article itself is a retelling of a story that would have happened two years ago [0], and the GitHub repo he links at the end is a clone of the repo in [0] (which the author himself is the sole contributor to).

The whole thing is weirdly deceptive.

[0] https://news.ycombinator.com/item?id=18853607

swrobel• 7 years ago

Not only what? Was this supposed to be a reply to something?

_bxg1• 7 years ago

"Exfiltrates files from your system" is a very alarmist way to say "checks the list of installed browser extensions". Not that it isn't creepy, but let's calibrate, shall we?

dylz• 7 years ago

I find it interesting that the author of this blog post does not openly disclose that they write/own a service that effectively does mass mailing, scraping, bruteforcing of email.

swebs• 7 years ago

Second to last paragraph.

codedokode• 7 years ago

Some websites (for example Aliexpress) scan local ports to check whether you are running something like RDP, SSH or VNC server. They try to open websocket connection to those ports and measure how much time it takes to establish (or to be rejected).

runeks• 7 years ago

Why is it even possible for a website to fetch chrome-extension:// resources?

Seems like something that shouldn’t be accessible by a website.

codezero7• 7 years ago

I believe it is because those extensions have intentionally exposed themselves so they can do bidirectional communication with the page.

Fogest• 7 years ago

The author makes an email scraping extension... his intentions against LinkedIn are not pure. His extension scrapes LinkedIn for user info.

taf2• 7 years ago

Might this be a fingerprinting technique they use to ensure you're not abusing their system?

Tepix• 7 years ago

I'm glad I don't use LinkedIn.

But one day I may have to.

Can the URL be blocked in uBlock Origin so that the uploading of the collected data will not take place?

chefandy• 7 years ago

Here's a permanent public archive of this article in case it goes down for some reason.

https://perma.cc/23ZX-JZZB

(FYI: Perma.cc, an anti-link-rot service run by Harvard Law School, is free for up to 10 links per month. The project is run by my department, but I'm not on the Perma team.)

imiric• 7 years ago

This is worrying, yet unsurprising. LinkedIn has become a necessary evil for most professionals, unfortunately. The quality of IT opportunities isn't as high as on other smaller job boards in my experience, but I still keep my LinkedIn profile up to date, to get a feel of the market mostly. I look forward to the day I can disable that social network as well.

In the meantime, we should build and use simpler web browsers, without extension support for one. I've found surf[0] to be the most usable of all WebKit wrappers. Without much C experience, I've managed to use my own fork[1] for a few months now, which wasn't much work thanks to the lean sub-3KLOC codebase of very readable C code and helpful comments.

I imagine that an experienced group of C programmers could take surf as base and easily build a secure and user-friendly web browser with most of the features of the big boys. WebKit is still a concern, but with some work it too could be abstracted away and made easily replaceable.

For LinkedIn specifically, I use a separate cookie file, and with the surf process isolation it gives me a degree of sandboxing similar to Chrome. A modern browser should be built on sandboxing principles for web content, and expose this functionality for each site by default.

[0] https://surf.suckless.org/

[1] https://github.com/imiric/surf

How LinkedIn exfiltrates extension data from the browser

Related Stories