Linus Tech Tips Discussion

 LinkedIn is spying on you, according to a new 'BrowserGate' security report Summary LinkedIn is understood to be injecting a JavaScript fingerprinting script into every page load that probes visitors' browsers for 6,236 installed Chrome extensions and collects detailed device telemetry, according to a report by Fairlinked e.V. and independently confirmed by BleepingComputer.    Quotes Quote  The script, which BleepingComputer verified through its own testing, also harvests the CPU core count, available memory, screen resolution, time zone, language settings, and battery status. The findings were first published in Fairlinked’s “BrowserGate” report, which claims the script works by attempting to access file resources tied to specific extension IDs, a well-documented technique for detecting whether extensions are installed in Chromium-based browsers. Many of the targeted extensions are LinkedIn-related tools, including sales intelligence products from Apollo, Lusha, and ZoomInfo that directly compete with LinkedIn's offerings. The Fairlinked report claims that LinkedIn scans more than 200 competing products in total and that the script also checks for language and grammar extensions, tools for tax professionals, and other categories with no obvious connection to LinkedIn's platform. LinkedIn told BleepingComputer the scanning is used to detect extensions that scrape data or otherwise violate its terms of service. "To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members' consent," a LinkedIn spokesperson told BleepingComputer. The company added that it does not use the data to "infer sensitive information about members."   My thoughts Though I don't think this will make Main stream, but does this make some people lose trust in LinkedIn moving forward, or is trust in Chromium-based browser if a scripts like this that can be ran without knowing make these browsers less safe and need more security protocols in place to prevent these sort of scripts from running at all? Because if LinkedIn can do this, what's stopping other sites that could inject malicious code? Chromium should be adding security protocols to stop these scripts without user consent.   Sources https://www.tomshardware.com/software/browsers/linkedin-scans-visitors-browsers-for-over-6000-chrome-extensions-and-collects-device-data