LinkedIn scans for 6,278 extensions and encrypts the results into every request

https://404privacy.com/blog/linkedin-is-scanning-your-browser-extensions-this-is-how-they-use-the-data/

194•un-nf•2h ago

Comments

un-nf•2h ago

LinkedIn runs an extension scan against a hardcoded list of 6,278 Chrome extensions on every visit. Detected results are packaged into encrypted telemetry and injected as an HTTP header into every subsequent API request during your session. This data can be used to identify your religious affiliations, tax-bracket, job search intent, and more.

I verified this myself and traced the implementation. Details and the technical breakdown in the article.

kyleee•51m ago

And certainly fingerprint you right?

WJW•22m ago

I guess that's what they're hoping for. With my admittedly biased opinion of the average linkedin user, about 99% will have the default set of extensions installed and so will not be very useful. Those users might have other identifiers of course, so who knows.

jwpapi•10m ago

I’m pretty sure it’s not 99% you would wonder how many differences there are along with user-agent resolution and ip range...

I think 99% are identifiable

echelon•40m ago

Can someone here please create a LinkedIn replacement for developers that

1. Doesn't have the spam

2. That doesn't look like it's from 2008

3. That only developers / engineers / tech folks can join

4. Doesn't try to log into your email to steal your contact list

5. That doesn't track you or your extensions / browser fingerprint

6. That doesn't have a bunch of fake "linkedinmaxxing" garbage content

7. that doesn't have marketers and recruiters, etc.

8. ...

recursivegirth•36m ago

IRC has existed for decades.

echelon•24m ago

And it's a ghost town.

jachee•35m ago

You’re already looking at it, buddy.

StilesCrisis•33m ago

This looks like it's from 2008

1over137•19m ago

and thank god too. Modern design is bloated crap.

Klayy•35m ago

Maybe that's what the new Friendster should be

ImJasonH•33m ago

Can you create it?

WD-42•30m ago

I feel like Github became this in the last 10-15 years.

zeafoamrun•29m ago

Seriously. We need some kind of federated replacement. Who is building this?

WJW•22m ago

Be the change you want to see mate.

reg_dunlop•14m ago

It's odd, yeah?

We have the ability to vibe these things over a weekend, yet getting to the critical mass/tipping point of adoption is something else.

Whatever happened to: if you build it, they will come?

jll29•5m ago

If you want it to happen, we should talk requirements - what would you want from a LinkedIn NextGen?

- A professional profile page

- Contacts

- Introductions/referrals

- Ask my (sub-)network?

Anything else?

jszymborski•20m ago

Just type about:blank in your browser, and you'll get what you're asking for ;)

gedy•27m ago

LinkedIn without the news/post feed would be fine

ricardonunez•19m ago

There’s an extension called News Feed Eradicator that does that for you.

mcintyre1994•16m ago

Wonder if it’s on their list of extensions to spy on!

mkw5053•1h ago

Interesting, so would Safari prevent this? I tried moving to Safari and honestly loved everything except I use my google accounts now for authenticating with to many services and that was a pain compared to chrome.

testfrequency•1h ago

Well if you’re a logged in to Google don’t you just SSO everywhere?

mkw5053•1h ago

I honestly kind of forget the exact annoyances because it has been some time. I want to say I had to reauth every time I wanted to SSO with my google account because it doesn't allow/deletes third party cookies.

NoahZuniga•1h ago

Even better! Moving to firefox fixes this.

Chrome for some reason (still!) gives extensions static ids. Firefox has the id change per firefox instance.

skeaker•1h ago

I would imagine using any non-Chromium browser would cause it to fail to find any Chrome extensions, yes.

mkw5053•1h ago

Sure, but Safari may or may not leak Safari extension signals in a similar fashion. I haven't actually investigated.

bigethan•1h ago

Seems to only happen Chrome per the dev of Wipr (a great safari privacy extension) https://mas.to/@mipstian/116341745221356805

guluarte•1h ago

I did that and got logged out of LinkedIn.

nokya•1h ago

"What is not a question is that a criminal investigation is now open." Good. These companies deserve each and every stone thrown at them, and much more.

ChrisArchitect•1h ago

[dupe]

Discussion: https://news.ycombinator.com/item?id=47613981

Cider9986•57m ago

28 days ago, 1897 points, 812 comments

rapnie•1h ago

See also "LinkedIn is searching your browser extensions" (812 comments) https://news.ycombinator.com/item?id=47613981

3dsnano•1h ago

friends, WHEN you are asked to implement something like this at your job, which will you choose: object (& hold ground, loose job) OR comply (& keep job)

as practitioners, where do we hold the line between telemetry and surveillance?

frogperson•1h ago

I choose not to work at places like linked in, meta, or any place that accepts Saudi or Israeli funding. It makes it a little harder to find a job, but i sleep better at night.

HerbManic•42m ago

In years to come you will be so thankful that you took that path.

As they say, better to be a poor master than a rich slave.

vehemenz•12m ago

I wouldn’t lump in Israel in, but good for you.

bravetraveler•3m ago

I got you covered, boo

lucb1e•33m ago

I wonder the same. Maybe it's made by people who feel like they wouldn't easily find another job and need the job for healthcare or financial reasons (living paycheck to paycheck)? And it's ordered by managers in similar situations, whose managers want to see increased revenue and don't care how? Somewhere in the chain it feels like there should be someone who says 'wtf are we doing'. It's strange

To answer your question though: I'd object of course, I'm very lucky to be well enough off that I can currently make that choice without serious repercussions. Do you think someone would come out on HN and say "oh sure yeah I have no morals!", at least without it being a throwaway where you'd have no idea if it's real?

zulban•21m ago

There's a third choice. Say you'll do it but do it poorly, or drag your feet forever. Hard to prove you intentionally did a bad job.

If that's the game you're playing tho, maybe time to find another job too ;)

maelito•1h ago

Well, I deleted my Linkedin account and life is better now.

booi•32m ago

That's big talk coming from someone who currently has a job. getting a job without a linkedin account isn't that straightforward.

kmeisthax•1h ago

Wasn't this specifically some lame-ass attempt to combat some click fraud or something these extensions were doing? And aren't these articles specifically coming from the person doing the fraud (which is why they know about the extension scanning)?

To be clear, LinkedIn shouldn't be scanning your browser extensions, but still. The ultimate problem is that browser extensions are a powerful malware vector and there's a huge market of people buying little utilities off of solo developers to enshittify them.

dnnddidiej•44m ago

> LinkedIn shouldn't be scanning your browser extensions.

Correct

Yes there are other problems in the world and we can JAQ the messanger too.

cxr•28m ago

> Wasn't this specifically some lame-ass attempt to combat some click fraud or something these extensions were doing?

No. That you believed that was just an unfortunate consequence of HN's kneejerk tendency to upvote middlebrow dismissals to the top comment, which resulted in people rushing to craft apologetics for what is in reality bonafide scumminess on LinkedIn's part, which itself resulted in confabulations like the claim that, "It was all extensions related to spamming and scraping LinkedIn last time this was posted"—which is simply untrue.

ro_bit•56m ago

Why is my Chrome telling random websites which extensions I have installed?

gib444•54m ago

Chrome is a browser produced by an advertising company. Its reason for existence is to track you.

lucb1e•43m ago

Not that I disagree but Google's tracking motivation in making the browser seems irrelevant to why it lets competitors do this fingerprinting

gdulli•23m ago

They want fingerprinting to work for everyone because the more effective it is, the higher the value of the ad inventory they sell.

sethops1•54m ago

Can ask the same question about so many horrible security blunders web browsers have made over the decades.

2ndorderthought•52m ago

They are only blunders if they aren't being used as features by someone

hbn•39m ago

Is that information available to websites? I figured they were doing some kind of novel hackery to self-detect extensions based on behaviour that would only happen if X extension was installed.

But that would be a lot of work for 6,300 extensions. Unless someone offers that as a service?

kimos•31m ago

It isn’t exactly. They created a list of known extensions by their id and a file which is known to exist in that extension. The site iterates over each pair and tries to load that file, if it doesn’t error it knows the extension is installed. It’s a clever and difficult manual process, but it does bypass the security trying to prevent this kind of thing.

I read that their reasoning is it exists to block users that use known scraper extensions which bypass their terms of use. But don’t entirely buy that.

AndroTux•13m ago

Brave explicitly blocks this

GodelNumbering•44m ago

I saw the following from linkedIn this morning

> Update to our terms and data use As of November 3, 2025, we are using some of your Linkedin data to improve the content-generating Al that enhances your experience, unless you opt out in your settings. We also updated our terms. See what's new and how to manage your data.

Frankly, it is unacceptable to tell a user "oh we have been using your personal data for 5 months already and will continue to do so unless you explicitly opt out". Are there any transparent alternatives to LinkedIn (not the trust me bro variant)?

StilesCrisis•37m ago

Is this a hallucination? I can't find this quote anywhere else.

> According to browsergate, Milinda Lakkam confirmed this under oath, saying, "LinkedIn took action against users who had specific extensions installed."

stevenicr•31m ago

and,

recently while trying to decipher why computer was at 98% memory and 65% cpu

one of the culprits is https://li.protechts.net taking 2GB ram and 8% cpu.

DDG searches say this is something for linkedin. - I had two tabs for linkedin open but left behind as I opened other tabs to research.

So I had not reopened these tabs in over 9 hours and they are still just humming along sucking down almost 10% of cpu and a couple gigs of ram for what?

This is firefox with ublock origin - quick searches saw malwarebytes browser guard considered it (protechts.net) malware for a bit and then took it off the list of things it blocked / warned about.

Not sure this is related to the scan mentioned, but it may be related to the overall concerns about data and unknown usage of resources.

I'm considering blocking this at the dns hosts level at this point.

repost of my comment 28 days ago

charcircuit•26m ago

This is pure speculation. It is a million times more likely that this data is strictly used to combat scraping and fraud.

flenserboy•13m ago

Fun to have to spin up a whole VM just to use a particular website!

dctoedt•10m ago

Seems to do this in Microsoft Edge, too.*

* I use Edge bcs of the vertical tabs — Safari's equivalent is a poor substitute. Firefox didn't seem to have vertical tabs last time I checked.

0xAstro•4m ago

now it makes sense with the 1000s of spammy not found requests to chrome extensions i was seeing on linkedin and had claude code debug.

0xAstro•4m ago

Now the 1000s of spammy chrome web extension requests when I opened LinkedIn makes sense

Rivian allows you to disable all internet connectivity

LinkedIn scans for 6,278 extensions and encrypts the results into every request

How Mark Klein told the EFF about Room 641A [book excerpt]

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

Apple reports second quarter results

I built a Game Boy emulator in F#

Claude Code refuses requests or charges extra if your commits mention "OpenClaw"

Opus 4.7 knows the real Kelsey

Belgium stops decommissioning nuclear power plants

How an oil refinery works

CopyFail was not disclosed to Gentoo developer

The Church Rock Uranium Mill Spill

You can beat the binary search

Durable queues, streams, pub/sub, and a cron scheduler – inside your SQLite file

Reverse Engineering SimTower

Show HN: Pu.sh – a full coding-agent harness in 400 lines of shell

Full-Text Search with DuckDB

The upsell game – Vercel upselling tactics revealed

Does Postgres Scale?

Mozilla's opposition to Chrome's Prompt API

Follow-up to Carrot disclosure: Forgejo

New mechanical panoramic film camera from Jeff Bridges

SimpleX Channels, SimpleX Network Consortium and Community Crowdfunding

I aggregated 28 US Government auction sites into one search

American Dads Became the Parents Their Fathers Never Were

Spain's parliament will act against massive IP blockages by LaLiga

10Gb/s Ethernet: what I did to get it working in my home

Recovering files from beyond the grave using PhotoRec

A 1960s art school experiment that redefined creativity

Granite 4.1: IBM's 8B Model Matching 32B MoE

LinkedIn scans for 6,278 extensions and encrypts the results into every request

Comments

Rivian allows you to disable all internet connectivity

LinkedIn scans for 6,278 extensions and encrypts the results into every request

How Mark Klein told the EFF about Room 641A [book excerpt]

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

Apple reports second quarter results

I built a Game Boy emulator in F#

Claude Code refuses requests or charges extra if your commits mention "OpenClaw"

Opus 4.7 knows the real Kelsey

Belgium stops decommissioning nuclear power plants

How an oil refinery works

CopyFail was not disclosed to Gentoo developer

The Church Rock Uranium Mill Spill

You can beat the binary search

Durable queues, streams, pub/sub, and a cron scheduler – inside your SQLite file

Reverse Engineering SimTower

Show HN: Pu.sh – a full coding-agent harness in 400 lines of shell

Full-Text Search with DuckDB

The upsell game – Vercel upselling tactics revealed

Does Postgres Scale?

Mozilla's opposition to Chrome's Prompt API

Follow-up to Carrot disclosure: Forgejo

New mechanical panoramic film camera from Jeff Bridges

SimpleX Channels, SimpleX Network Consortium and Community Crowdfunding

I aggregated 28 US Government auction sites into one search

American Dads Became the Parents Their Fathers Never Were

Spain's parliament will act against massive IP blockages by LaLiga

10Gb/s Ethernet: what I did to get it working in my home

Recovering files from beyond the grave using PhotoRec

A 1960s art school experiment that redefined creativity

Granite 4.1: IBM's 8B Model Matching 32B MoE