[345tw4erfd]

Calling this "nefarious-linkedin" when it's obvious that LinkedIn is trying to protect itself from unauthorized data collection shows that the developer is either seeking for attention or didn't really look into the purpose of those extensions (https://github.com/dandrews/nefarious-linkedin/pull/1)

[tnolet]

But how is this data accessible to the extension? I ‘m not an expert, but it seems that this data has to publicly available for an extension to find and parse it. Extensions don’t have magic Auth rights or credentials.

[tylerhou]

Extensions have the same auth rights as your logged-in account (the ability to see people who are out of network, for example). It’s against LinkedIn’s ToS to scrape data.

[feanaro]

This should go both ways. It is against my ToS for LinkedIn to scrape which extensions I have installed.

[newsbinator]

I'm on the anti-LinkedIn side of this scraping debate.

But that said, LinkedIn never agreed to your ToS.

[feanaro]

True, and I accept this is a potentially good legal refutation of this kind of argument. However, I do consider ToS-es untenable and unjust because of this power asymmetry.

If my computing node is interacting with your computing node, we should either both be able to put restrictions on the use of obtainable information or neither.

[i_cant_speel]

You an avoid them collecting your data by not visiting their site.

[tnolet]

Yes, I get that the extension operates within the user's auth realm. But still it should not be able to access data you as a user cannot access. Maybe this is already enough to do damage though.