LinkedIn loads a lot of JS. In that JS there is a list of over 6.000 extensions, identified by their ids and with a single file path provided.

The JS then checks if it is running in Chrome or a Chromium-based browser, and cycles through that list, checking if these extensions are installed by doing a fetch() to "chrome-extension://<extension_id>/<file_path>".

If the fetch() succeeds, the extension is installed. If not, it isn't.

🧵

Is this bad? Yes. It could allow fingerprinting users, and a specific set of installed extensions (say, a lot related to particular religion) could be revealing, and arguably is illegal based on GDPR.

Is this "Searching Your Computer"? No, this is not what we generally think of when "searching your computer" is mentioned. This framing is way overblown and unnecessary.

BrowserGate site also implies LI's purpose might be to gather this kind of protected data. I don't think this is warranted.

🧵

BrowserGate site quotes a "sworn affidavit from LinkedIn’s Senior Engineering Manager":

> “LinkedIn has invested in extension detection mechanisms without which LinkedIn would not have been able to trace the cause of service impacts and outages.”

I don't trust Big Tech, but this is not an unreasonable explanation – although importantly, it is not a *justification* for this scanning.

In other words: LI should not be doing that. But they might not be after your religion or orientation here.

🧵

The explanation might be reasonable, because extensions do affect how websites work, sometimes negatively, and the list of extensions here seems to contain mostly extensions specifically interfacing with LinkedIn.

But here's my point: this kind of scanning is an overkill. And that alone is already bad enough and infuriating.

There is no need to make overblown, click-baity claims like BrowserGate site does. That just muddies the waters ("wait, how are they scanning my computer?!").

🧵

@rysiek
> The explanation might be reasonable, because extensions do affect how websites work, sometimes negatively, and the list of extensions here seems to contain mostly extensions specifically interfacing with LinkedIn.

I'm on the fence between calling BS because HTTP 4xx codes exist, and just shrugging saying “JavaScript”.