> Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers.

This does seem invasive. It also seems like what I’d expect to find in modern browser fingerprinting code. I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).

I’m certainly not endorsing it, do think it’s pretty problematic, and I’m glad it’s getting some visibility. But I do take some issue with the alarmist framing of what’s going on.

I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.

So this is just a heads up that even if you don't have a linkedin account, they will create one on your behalf so might better check (assuming you neither have nor want one).

Anyway, what they're calling "spectroscopy", is a combination of extension probing and doing residue detection (looking for what extensions might leave behind in the DOM).

An ad blocker is not necessarily equipped to help since the script is embedded with the application code. Since they're targetting Chrome, switching browsers will help with the probing but not the detection part and you'll still be fingerprinted.

The only way forward is for browser vendors to offer a real privacy or incognito mode where sites are sandboxed by default. When the default profile is identical across millions of users there won't be anything unique to fingerprint.

> The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify).

To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members’ consent or otherwise violate LinkedIn’s Terms of Service.

Here’s why: some extensions have static resources (images, javascript) available to inject into our webpages. We can detect the presence of these extensions by checking if that static resource URL exists. This detection is visible inside the Chrome developer console. We use this data to determine which extensions violate our terms, to inform and improve our technical defenses, and to understand why a member account might be fetching an inordinate amount of other members' data, which at scale, impacts site stability. We do not use this data to infer sensitive information about members.

For additional context, in retaliation for this website owner’s account restriction, they attempted to obtain an injunction in Germany, alleging LinkedIn had violated various laws. The court ruled against them and found their claims against LinkedIn had no merit, and in fact, this individual’s own data practices ran afoul of the law.

Unfortunately, this is a case of an individual who lost in the court of law, but is seeking to re-litigate in the court of public opinion without regard for accuracy.

I set up the cgroups hack so I could route traffic from a dev profile into a VPS vpn, and may not be that useful for everyone.

But I think this is a reminder that you may want to have at least two profiles: one public and the other private. Do you really want Microsoft to know you installed the "Otaku Neko StarBlazers Tru-Fen Extendomatic" package to change every picture of a current political figure to an image from the cast of Space Battleship Yamato?

Why should a website be able to scan for extensions at all?

Or if there's a legitimate need (like linkedin.com wants to see if you installed the linkedin extension), leave it up to the extension to decide if it wants to reveal itself. The extension can register a list of URL patterns it will reveal itself to. So the linkedin extension might reveal itself only to *.linkedin.com, a language translation extension might reveal itself to everyone, and an adblocker extension might not choose to reveal itself to anyone.

Sure, this can be solved at the legal layer, but in this case, there seems to be a much simpler and more effective technical solution, so why not pursue that instead?

I will work on an improvement to that extension so that it can block these scans if they attempt them in firefox.

It seems to not scan for Privacy Badger and uBlock Origin, two extensions I rely on. That's...surprising.

> Microsoft has 33,000 employees and a $15 billion legal budget

Microsoft has more than 220k employees (it's hard to follow with all the layoffs), and the G&A in which bankrolls legal expenses (but not only - it also contains basically every employee who's not engineering or sales) was only 7B in 2025 - so legal budget is much lower than that.

If you think about, to protect yourself: The EFF privacy badger browser add-on [1] try to block fingerprinting.

Also, browser fingerprints are a common tracking pattern nowadays. You can test [2] your browser and please start protect your self: E.g. use add-ons like U-Block and Privacy Badger to block tracking and/or use different browser and devices for different use cases. DNS-blocking with block-list like hegazi [3] is IMO the best option, but also a bit more involved, when you host you own DNS forwarder(s). For example AdGuard Home [4] helps you with hosting your own DNS infrastructure. It's also possible to add block-lists to dnsmasq or unbound and run them on you notebook as forwarders.

[1] https://privacybadger.org/

[2] https://coveryourtracks.eff.org/

[3] https://github.com/hagezi/dns-blocklists

[4] https://adguard.com/en/adguard-home/overview.html

https://hn.algolia.com/?q=linkedin+weird

> Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers

And thought, "no way in hell this gets by Safari."

And then, under "The Attack: How it Works":

> Every time you open LinkedIn in a Chrome-based browser

Shocker. If you use a Chromium-based browser, you should expect to be trading away your privacy, IME.

https://news.ycombinator.com/item?id=45349476

Essentially, they are labelling you, like most do, but against some interesting profiles given the kinds of extensions they are scanning for

There's a reason I continue to use Firefox (with uBlock Origin) and will never switch.

Also, when I got laid off from a previous job, I made a LinkedIn profile to help find a new job. Once I found a new job, I haven't logged into LinkedIn since - that was almost 2 years ago.

I ask because it seems like every job I apply to asks for a linkedin profile, and I've heard floating around that if it's not filled in enough most employers assume you're a bot. Heck, one of the forms from the "who's hiring" thread yesterday straight up said if you have < 100 connections they'd throw out your application. So, in order to get my foot in the door, I need to hand over vast and intricate data about my personal life to a third party?

one of the culprits is https://li.protechts.net taking 2GB ram and 8% cpu.

DDG searches say this is something for linkedin. - I had two tabs for linkedin open but left behind as I opened other tabs to research.

So I had not reopened these tabs in over 9 hours and they are still just humming along sucking down almost 10% of cpu and a couple gigs of ram for what?

This is firefox with ublock origin - quick searches saw malwarebytes browser guard considered it (protechts.net) malware for a bit and then took it off the list of things it blocked / warned about.

Not sure this is related to the scan mentioned, but it may be related to the overall concerns about data and unknown usage of resources.

I'm considering blocking this at the dns hosts level at this point.

Here's a quick look at only the static things a website can fingerprint https://www.browserscan.net/.

https://git.gay/SiteRelEnby/browsergate-list

https://git.gay/SiteRelEnby/browsergate-list/src/branch/main...

I hope browsers in the future will need to ask for permission before doing any of that.

How much is that currently? $600M?

LinkedIn is getting nothing.

No it isn't. Performing fingerprinting on user's devices, to ultimately profit of financially or worse is misleading. Especially doing this while knowing the user isn't aware what this really means and just deciding it for them.

The headline is just an exaggerated way of saying what is really happening.

I really don't think they're "illegally" searching your computer, they're checking for sloppy extensions that let linkedin know they're there because of bad design.

> Microsoft has 33,000 employees

this should probably be LinkedIn, not Microsoft.

I mean, come on. Do I like that they are making use of browser fingerprinting? Not really. But to make it sound like they are "illegally" scanning my computer is ridiculous.

2020 - LinkedIn Sued For Spying on Clipboard Data After iOS 14 Exposes Its App:

https://wccftech.com/linkedin-sued-for-spying-on-clipboard-d...

2013 - LinkedIn MITM attacks your iPhone to read your mail:

https://www.troyhunt.com/disassembling-privacy-implications-...

2012/2016 - Data breach of 164.6 million accounts:

https://haveibeenpwned.com/breach/LinkedIn

According to haveibeenpwned.com, my email & password were leaked in both the 'May 2012' and 'April 2021' LinkedIn incidents.

And not letting you read your messages when on your mobile phone unless you use their app is particularly mean. Considering again where they are sending all the information they scrape.

This feels very similar, except now it's taking a swing at Microsoft. It's apparently paid for by some mysterious "trade association and advocacy group for commercial LinkedIn users" that runs out of a private PO box in a small German town - uh huh. I'm not going to feel bad for Microsoft, but I would love to read some investigative reporting down the line.

use safari or Firefox. and chrome only for incognito web app testing.

I know there has been other LinkedIn hate on HN this week. I know they have some good tools for job searching and hiring. I still wish we as a society could move on and leave this one with MySpace.

My guess, Linkedin is used for years as source of valuable information for phishing/spear-phishing.

Maybe their motive is really spying. But more important for them is to fight against people botting Linkedin.

Imho, browser fingerprinting should be banned and EU should require browser companies to actively fight against it, not to help them (Fu Google)

> Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software

and then proceeds not to explain how it’s doing that to me, a Safari user.

Because, spoiler: it isn’t. Or, it might try to search, and fail, and nothing will be collected.

This reminds me of the slop bug reports plaguing the curl project.

Different browsers have various settings available, but do we have a little snitch for a web browser?

I am not a lawyer, but site stability seems like a GDPR "Legitimate Interest" in my book anyway.

HOLD EXECS LEGALLY ACCOUNTABLE, CRIMINALLY AND CIVILLY, FOR THE CRIMES OF THER CORPORATIONS.

OMG is literally every article written with LLMs these days I just can't anymore. It's all so tiring.

Literally 2 days ago, I submitted a post: LinkedIn "final decision", restricting my account and making me feel unheard[0] explaining all of some of the worst customer support I have seen

I wish to give a TLDR, but essentially Linkedin will simply reject your account or give you immense headache if your id's aren't being detected by persona (persona is a really shady-company in it of itself with really not the best security practices) I actually lost count of how many times their customer support just responded with a bland message and just didn't even read my message

This is why, being frustrated out of all of this, I actually sent a linkedin customer support message that I don't feel heard, I want to be heard by human, so if you are a human especially when they were asking ME to go to a public notary to sign an affadavite to get a 1 day old restricted Linkedin account (oh btw, its also illegal for a minor to sign an public notary in my country the way they mentioned and I mentioned it about as many times as I could and that I am willing to share my ID like Aadhaar to them but they genuinely don't hear your messages)

Honestly, my experience just says that there is no human customer support in Linkedin, its really a customer support nightmare worse than even some of the telecom horror stories. Perhaps I should contact browsergate.eu if my incident within my country can also be a case of legality or not, essentially I was cooperating with them to give any document that I can reasonably provide but linkedin forms and everything redirect to 404 as well.You can read my experience in depths but my experience really shows me as to Linkedin customer support being so unhelpful that you question how a company can be so bad. I wish for more ethical alternatives to Linkedin and its nightmare to appear within this space.

(I also had a minor idea of asking Linkedin support to see if they read my messages and literally as I told them that I feel unheard, I would like it if they can make me feel heard and that they are reading my messages so If they are actually reading my message, then respond to me with value of 351/13 and I asked the person who joined Linkedin as to why they joined Linkedin, essentially just one line would suffice to know if I am talking to human or not, they did not respond to any of this and essentially, as far as I can tell, pasted another pre-generated response not hearing me)

[0]: https://news.ycombinator.com/item?id=47586760 (https://smileplease.mataroa.blog/blog/linkedin/)

That seems like the most obvious use case? Or maybe I missed something in the write up.