News for hackers. Stuff that matters.

A comment on LinkedIn Is Illegally Searching Your Computer. Parent comment

Re:LinkedIn Is Illegally Searching Your Computer by ceejayoz on Thursday April 02, 2026 @09:40AM (#47614356)
The "The Attack: How it works" section explains how it works. It's not an API.

I am a little surprised something like CORS doesn't apply to it, though.

[ Parent | on HN ]
Re:LinkedIn Is Illegally Searching Your Computer by acorn221 on Thursday April 02, 2026 @09:48AM (#47614457)
So these extensions allow linkedin to do this though, it's literally them saying "yes, this site can ping this resource" - called "web_accessible_resources".

This is fair from Linkedin IMO as I've seen loads of different extensions actually scraping the linkedin session tokens or content on linkedin.

[ Parent | on HN ]
Re:LinkedIn Is Illegally Searching Your Computer by entropyneur on Thursday April 02, 2026 @12:56PM (#47616980)
It's not the extension developer who should decide this, but the browser user.
[ Parent | on HN ]
Re:LinkedIn Is Illegally Searching Your Computer by Hackbraten on Friday April 03, 2026 @02:33AM (#47623814)
On what would the browser user base their decision?

If an extension injects an icon into the DOM of the page, then the resulting `img` tag needs to put something in its `src`.

The extension author may choose to use the `data:` scheme, but that's a development-time decision.

[ Parent | on HN ]