GitHub - mdp/linkedin-extension-fingerprinting
github.com
Contribute to mdp/linkedin-extension-fingerprinting development by creating an account on GitHub.
  • onlinepersona
    101·
    6 hours ago

    Why the hell is this even possible? Why should a web page have access to the extensions you run?

  • RonSijm
    44·
    11 hours ago

    Uhm, doesn’t really sound like this could be true. Maybe I’m missing something?

    You’d see 2953 get requests in your network tab, right?

    And the article says:

    LinkedIn silently probes for 2,953 Chrome extensions on every page load.

    Surely it would be drastically noticeable if for every page load they do 3k get requests to the chrome store

      • RonSijm
        1·
        2 hours ago

        Yea, well that was my first though, but then I though - why would chrome even allow any website to just arbitrary check which extensions you have installed.

        So I checked the scripts and at this line the script is showing

        async function fetchExtensionInfo(extensionId) {
  return new Promise((resolve) => {
    const url = `https://chromewebstore.google.com/detail/$%7BextensionId%7D`;

        So I thought maybe they were calling the chromewebstore foreach plugin, and if you have an extension already installed, you get a different response than when you don’t - or something.

        But I suppose I’m wrong and for some reason a site can just ask the browser internally which plugins are installed