Hacker News Reader

Comment by zrobotics | Hacker News Reader

The real question here is why LinkedIn should even need this information. This represents significant engineering work to develop, so obviously at some point they decided that knowing which extensions are present had value. However, I cannot think of a single non-malicious reason to want this information; the malicious reasons that spring to mind are browser fingerprinting and ad targeting.

View on HN

I can think of tons of non-malicious reasons.

1. Support requests because site is broken, but it turns out you are using an extension that breaks the site.

2. Extensions are exfiltrating data to the extension owners, against LinkedIn's TOS, and they are trying to protect their users, or rather, they don't want competition :)

OK, that was two.

They aren't blinding probing for any and all extensions, only a specific set, which shows restraint and implies to me they are having a sort of arms race with extensions that scrape contact info.

There are a lot of extensions built for networking professionals (recruiters, marketers, sales people) that automate browser behavior on LinkedIn in an attempt to drum up attention. For example: automatically viewing profiles of candidates, so that the candidate sees the recruiter/sales person on their "who's viewed my profile" page.

A cursory google-search for something like "linkedin browser plugin" yields tons of these types of products.

> They aren't blinding probing for any and all extensions, only a specific set, which shows restraint and implies to me they are having a sort of arms race with extensions that scrape contact info.

I agree that the goal here is likely to combat scraping, but I don't think we can use this behavior to draw that conclusion. From the article:

"I recommend not using web accessible resources. Out of all extensions LinkedIn finds, a majority of them are due to web accessible resources."

There's no trivial way to get a list of all the user's extensions, so they needed a side channel that they could use to detect them on a case-by-case basis. The only extensions that they can detect are ones that feature this side-channel. Even if Linkedin did want to know all your extensions (which, again, I think is less plausible than an arms race) we would see this same sort of behavior due to the limitations imposed by the browser.

Wait, so they try like crazy to scrape YOUR contact list but fight like crazy to keep THEIRs from getting scraped.

Yes. They have gone to court for this, and I believe lost.

https://arstechnica.com/tech-policy/2017/08/court-rejects-li...

Yeah, just like Google bot crawls the web putting enormous load on people's servers (G-Bot can pull hundreds of thousands of pages per day from a single server), while being very sensitive to automated searches and banning your ass (IP) in a heart beat. They sure don't want to be crawled by anyone.

If your site cannot handle the moderate 3-5 requests per second it would take for google to make hundreds of thousands (500k) of requests a day, then I hate to break it to you but you have bigger problems at hand.

The answer is mentioned hidden in the article: to detect accounts that scrape/resell the data found in LinkedIn profiles.

Unfortunately for linkedin spying on all your users in order to catch a few miscreants is not how you implement stuff like this.

Of course it is, it's SOP. CAPTCHAs, for example, are much more intrusive but are used everywhere to catch a minority of bad actors.

But CAPTCHAs do not fingerprint all your users, contrary to legislation in quite a few countries. Fingerprinting is illegal in the EU.

ReCAPTCHA fingerprints users to determine a risk level.

I am in the "Sales Engagement" space, and most of the extensions I'm seeing are sales-based. Sales Navigator is LinkedIn's (less sophisticated) sales engagement tool. I understand they use a heuristic to determine which extensions to look for, so my set may be based on my industry.

My take is that some motivation comes from LinkedIn seeing which Sales Engagement company they want to buy in order to replace Sales Navigator. Therefore by extension they are probably seeing what extensions people are using most commonly with LinkedIn in order to either beat or buy them.

I would guess this is not just to protect user data from being scraped. LinkedIn earns a lot of money from users paying for recruitment services (as in get advanced filters to search for candidates and to send them job proposals). This costs 4 figures per month. So the LinkedIn product management has a high value from learning which extensions people are using to substitute or enhance their paid services even if the extensions don't violate the ToS.

This seems like the most likely reasoning; some of these extensions probably do allow certain uses that LinkedIn charges for. Still shady behavior, but this is at least more reasonable than user fingerprinting.

Linkedin is used for lead generation, for more than just recruitment. OP touches on it when he hints at the email-hunter extension.

Linkedin can skew results and obfuscate data to users who are heavily digging for lead data. Remember, Linkedin's main value proposition is that it has a wealth of user-submitted data, and if it loses that it loses some of it's value.

Reply on news.ycombinator.com