LinkedIn is secretly scanning your browser for 6,000 extensions, and you weren't told
Summary
LinkedIn's practice of scanning over 6,000 extensions in the Chrome browser and collecting device fingerprints without user consent has been exposed as 'BrowserGate'.
Key Points
- LinkedIn quietly scans for the presence of 6,222 Chrome extensions upon visit via the 'Spectroscopy' system
- Generates a device fingerprint by collecting 48 hardware and software characteristics such as CPU core count, memory, and screen resolution
- The collected fingerprint is encrypted with an RSA public key ('apfcDfPK') and attached to all API request headers in the session
- This practice is not listed in LinkedIn's privacy policy and was revealed through an investigation by the European group Fairlinked e.V.
- The scan list includes over 200 of LinkedIn's competing sales tools like Apollo, Lusha, and ZoomInfo
Notable Quotes & Details
Notable Data / Quotes
- 2.7MB JavaScript bundle
- 6,222 concurrent requests
- Collection of 48 device characteristics
- Encryption key identifier: 'apfcDfPK'
- Independent verification completed by BleepingComputer
Intended Audience
General readers, security researchers, those interested in privacy policy