Microsoft is running one of the largest corporate espionage operations in modern history. Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm. The user is never asked. Never told. LinkedIn’s privacy policy does not mention it. Because LinkedIn knows each user’s real name, employer, and job title, it is not searching anonymous visitors. It is searching identified people at identified companies. Millions of companies. Every day. All over the world.

Cross posted from https://lemmy.ml/post/51627192

Microsoft is running one of the largest corporate espionage operations in modern history.

Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm.

The user is never asked. Never told. LinkedIn’s privacy policy does not mention it.

Because LinkedIn knows each user’s real name, employer, and job title, it is not searching anonymous visitors. It is searching identified people at identified companies. Millions of companies. Every day. All over the world. This is illegal and potentially a criminal offense in every jurisdiction we have examined.

  • oce 🐆@jlai.luEnglish
    20·
    29 days ago

    The Attack: How it works

    Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers. The entire process happens in the background. There is no consent dialog, no notification, no mention of it in LinkedIn’s privacy policy. … https://browsergate.eu/how-it-works/

    So Chrome based only and mostly browser extensions plus some standard device resources information.
    It shouldn’t be allowed without explicit and informed consent, but otherwise, it does not look that shocking?

    • activistPnk@slrpnk.netEnglish
      2·
      3 days ago

      it does not look that shocking?

      For me it is shocking because JavaScript running in a browser environment does not have access to the local filesystem. It can create cookies, but then it can only access its own cookies, not even other cookies of other sites. In principle.

      This is why there is a resistance to the push of every business peddling a smartphone app – because normal non-js apps (typically Java not JavaScript) can access the local file system and snoop on other processes. If JavaScript-based web apps had the same access, there would be a lot more havoc. I think it boils down to an alarming misleading statement:

      “hidden code searches their computer for installed software”

      That should be impossible. According to your browsergate link, it says Linkedin is doing recon on other extensions. But the above statement reads as if they are accessing the local hard drive. They took some liberties in trying to sensationalize the story, it seems, as extensions are technically “installed software”.

      It’s still shitty that Microsoft is abusing every possible mechanism and interesting to know how much they can grab by pushing the limits of the sandbox. Kind of like how eBay’s JS sniffs for open ports on your LAN and feeds that back to eBay. I’m not sure why Chromium differs from FF in this regard though. Are FF users really spared from the snooping?

      I cannot help but blame victims to some extent. The pushover masses are foolish and unethical enough to engage with Microsoft and it’s hard to muster up some sympathy for them. No one who gives a shit about privacy uses Linkedin anyway.

      Still, it’s good to raise awareness about Linkedin. For me it serves as more ammunition when fighting an administration who uses Microsoft services and subjects me to MS snooping involuntarily.

      • oce 🐆@jlai.luEnglish
        4·
        29 days ago

        You can see it on the link, but yeah, mainly the list of browser extensions and device resources like CPU, memory, display etc.

        • khannie@lemmy.worldEnglish
          8·
          29 days ago

          “installed software” is doing a LOT of lifting in that paragraph at the top if it’s just extensions.