263
LinkedIn Is Illegally Searching Your Computer (browsergate.eu)
submitted 6 months ago by to c/technology@lemmy.world
45 comments fedilink hide all child comments
 

Microsoft is running one of the largest corporate espionage operations in modern history. Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm.

https://news.ycombinator.com/item?id=47613981

you are viewing a single comment's thread
view the rest of the comments
[–] 39 points 6 months ago (15 children)

On the contrary, websites are incredibly sandboxed. It’s damn near impossible to find out anything about the computer. Off the top of my head: Want to know where the file lives that the user just picked? Sure, it’s C:\fakepath\filename. Wanna check the color of a link to see if the user has visited the site before? No need to check. The answer will be ‘false’. Always.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 39 points 6 months ago (14 children)

    Here's the information a web server needs to deliver content to a browser:

    • The requested resource
    • An IP address
    • User credentials (sometimes)

    Everything else is a fucking security hole. There's no good reason for servers to know what extensions you have installed, what OS you're running, the dimensions of your browser window, where your mouse cursor is positioned, or any one of a thousand other data points that browsers freely hand over.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 14 points 6 months ago (1 child)

    There are absolutely reasons. Firefox is done by a reasonable job of anti-fingerprinting, and it's a fine line to walk to disable as many of those indicators as possible without breaking sites.

    Browsers do give away too much, but at least Firefox is working on it. And it's not extremely straightforward.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 6 months ago

    I use waterfox with all of the privacy and security settings enabled to the max, plus a few extensions like ublock origin, decentraleyes, consent-o-matic, and clearurls.

    Not that many sites break. And the ones that do, I don't visit. If you don't need to offer an https option, or you don't work without trackers, I don't need to go to your site. Simple as that.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 6 months ago (1 child)

    The browser can never know what information is needed for a certain use case. So it needs to be permissive in order to not break valid uses.

    For instance, your list does not include the things a user clicks on the website. But that’s exactly the info I needed to log recently. A user was complaining that dropdowns would close automatically. We quickly reached the assumption that something was sending two click events. In order to prove that, I started logging the users’ clicks. If there were two in the same millisecond, then it’s definitely not a bug but a hardware (or driver or OS or whatever) issue.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 6 months ago (9 children)

    If the site doesn't know the window width of can't react to mobile or desktop users automatically or scale elements/ change to best for your display.

    You need mouse input for hovering effects as well

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 13 points 6 months ago (7 children)

    That can all be done 100% client side. The server does not need this information.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 6 points 6 months ago (5 children)

    If you can do it client side, you can send it to a server...

    The difference is intent.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 6 months ago (4 children)

    you can send it to a server

    Yes, because web browsers, under current web architecture, allow this.

    This is entirely my point.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 6 months ago

    How would they prevent it? If they allow your app to read a value client side, it can do whatever it wants with it, including sending it.

    If your app needs to present different behavior based on user settings, it needs to read it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 6 months ago

    They allow this because they are being developed to allow this.

    Browsers that don't allow this in a Web-like system without such functionality (like Gemini) can be written in two days or a week if you don't hurry.

    Or at least take as long as Mosaic or Arena took to become usable.

    Enormous resources are being invested into continued development of a platform where users provide valuable feedback.

    By the way, ML is long past the point where that data could even be interpreted ambiguously. Those who have the data know exactly who you are and probably some useful traits of what you are thinking the moment you are typing a comment at any big website.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 6 months ago*

    Ah I read as the Brower doesn't need that data. I'd say it needs width (maybe height) but that's it

    But this info talked about in OP is done via client sending the data to a server not the server getting it all the time

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 6 months ago

    False. Browsers can announce themselves as desktop or mobile, or even advertise pre-determined fake window and screen sizes for this purpose (in Firefox it's called "letterboxed" in the hidden settings). There is no need for a server to have any of this information anyway - either the design of the webpage should be responsive by default, or the server can send specifically whichever files for styles the browser specifically asks for, perhaps falling back to a "all.css" or something.

  • permalink
  • fedilink
  • source
  • parent