Researcher Challenges Claims That LinkedIn’s Extension Checks Scan Users’ Computers
Summary
A security researcher says LinkedIn checks for browser extensions using JavaScript resource probing, not computer scanning or malicious code. His sample testing found potentially problematic extensions, while privacy and transparency concerns remain.
Key points
- BrowserGate alleges LinkedIn checks for thousands of browser extensions to profile users; LinkedIn says the data helps identify extensions that violate its terms and improve defenses.
- Researcher Tyler Reguly describes the method as JavaScript resource probing and says it does not scan the computer or indicate malicious code.
- Reguly tested a sample of about 10% of the listed extensions and found some behaved disruptively, including changing browser settings or reopening tabs.
- Based on his sample, Reguly estimated that LinkedIn could detect around 2,000 extensions, and said the method did not suggest malicious intent.
- The article notes that LinkedIn has not clearly disclosed the checks to users and that legality may depend on notice, consent, purpose, and jurisdiction.
Article Details
- Event Type
- Dispute over LinkedIn’s browser-extension detection and alleged user fingerprinting
- Impact
- BrowserGate alleges that LinkedIn JavaScript detects thousands of browser extensions and sends the results to LinkedIn, potentially revealing sensitive information. LinkedIn says it uses the data to enforce its terms, improve defenses, and address account activity that affects site stability, and denies using it to infer sensitive information. Security researcher Tyler Reguly found resource probing rather than computer scanning or malicious code, but noted that the process was not clearly disclosed to users. A lawyer quoted in the article said legality depends on the facts and jurisdiction and that collecting personal data without informed consent may violate privacy laws.
People
Ilia KolochenkoLawyer focused on cybersecurity, data protection, and privacy law who explained that the legality of fingerprinting depends on the facts and jurisdiction, and discussed consent and privacy-law concerns.Tyler RegulyAssociate director of security R&D at Fortra who tested LinkedIn’s extension resource probing and reported that he found no indication of malicious intent or computer scanning.