← Back to Blog

How to Not Automate Your LinkedIn Profile

Scraping, hiQ Labs v. LinkedIn, TLS fingerprinting, and the AI-vs-bot-detection arms race.

A few weeks ago I had what felt like a genius idea: what if I just... didn't do LinkedIn anymore? Not "delete my account and become a mountain hermit" levels of not-doing-it, but the modern, lazy-genius version — get an LLM agent to do it for me. I imagined the workflow: I tell my agent "hey, I just got a cert in Kubernetes, also I did an afterwork with the team and Karen from Sales taught me something profound about resilience," and thirty seconds later a perfectly on-brand post appears on my profile, opening with the two most feared words in the English language: "Dear network," followed by three paragraphs about vulnerability, growth, and a stock photo of a sunrise over an office building. Truly, humanity's crowning achievement.

So naturally, being the kind of person who reaches for a browser automation script before reaching for "maybe I should just click the buttons myself," I asked: can I just script this? Login, click, upload, post, done. Turns out the answer is a very confident "lol no," and figuring out why took me down a much more interesting rabbit hole than the blog post I was originally going to write.

The scraping wars, or: hiQ Labs vs. the Empire

Before we get to the "how," it's worth understanding the "why LinkedIn cares so much." This isn't a new fight. The most famous chapter is the hiQ Labs v. LinkedIn saga, which ran from 2017 to 2022 and is basically the Bleak House of internet law — a case so long-running it outlived several people's optimism about the judicial system.

hiQ Labs was a company that scraped public LinkedIn profiles to sell workforce analytics to employers — things like "hey, this employee's profile activity suggests they're about to quit." LinkedIn sent a cease-and-desist and started blocking hiQ's bots. hiQ sued back, arguing that if the data is public, blocking access under the Computer Fraud and Abuse Act (CFAA) is basically weaponizing an anti-hacking law against, well, looking at a webpage. The Ninth Circuit initially agreed with hiQ (2019), the Supreme Court told everyone to try again after a different ruling (Van Buren, 2021), and by 2022 the courts sided with LinkedIn on remand. hiQ, having spent five years and presumably several million dollars proving a point, shut down shortly after.

The lesson nobody wanted but everybody got: "the data is public" and "you're allowed to scrape it at scale" are two very different legal claims, and platforms will spend years and lawyers making sure everyone remembers that.

Why the paranoia, though?

It's not just lawyer-brain. There are real stakes:

So yes: since Microsoft acquired LinkedIn in 2016 for a cool $26.2B, it inherited not just a social network but also Microsoft's institutional muscle memory for fraud and bot detection — the same lineage that protects Azure AD sign-ins and Xbox Live's anti-cheat. This is not a scrappy startup improvising defenses; it's enterprise-grade anti-automation, mutualized across one of the largest security orgs on Earth.

The toolbox, broadly

Modern bot defense is a layered cake, and no single slice is meant to stop you alone — it's the accumulation that gets you:

Zooming in: TLS fingerprinting (a.k.a. your handshake has a tell)

Let's go deeper on one, because it's the one most people don't expect: your TLS handshake gives you away before a single byte of HTTP is exchanged.

When any client — browser, script, bot — opens an HTTPS connection, it sends a ClientHello packet listing things like supported cipher suites, TLS extensions, elliptic curves, and their order. This isn't random; each TLS library constructs this list in a specific, deterministic way. Chrome's OpenSSL-based stack produces a different ClientHello shape than Python's requests (via OpenSSL too, but different version/config), which differs again from curl, which differs again from headless Chromium under Playwright.

This gets hashed into something called a JA3 fingerprint (and its newer, meaner cousin JA4): essentially a fingerprint of how your TLS client talks, computed before authentication, before cookies, before your carefully spoofed User-Agent header even gets read. You can set your User-Agent to "Mozilla/5.0 definitely a real human browser," and it won't matter one bit if your JA3 hash matches "known automation library" in someone's threat intel database.

The delightfully evil part: even real Chrome driven by Playwright/Puppeteer via the DevTools Protocol can produce a TLS fingerprint subtly different from a human clicking around in the same Chrome build, because of how the automation harness configures the underlying network stack. Beating this requires tools that specifically rewrite the TLS layer to mimic a genuine browser (curl-impersonate, utls in Go, etc.) — an entire sub-industry exists solely to make scripts sound more human at the packet level, which is either impressive or deeply unhinged depending on your mood that day.

The escalation nobody asked for: now with AI

Here's the part that should worry both sides of this fight. Every layer above assumes bots are worse than humans at being human — jerky mouse movement, too-perfect typing, predictable timing. That assumption is aging badly.

Generative models can now produce human-plausible mouse trajectories, humanlike typing jitter, and — the thing that started this whole article — humanlike text, meaning the final tell (a bot-sounding "Dear network" post) is disappearing too. The very tool I wanted to use to automate my profile is also, structurally, the thing making bot detection harder for everyone, including LinkedIn's own team down the hall from the "please don't scrape us" lawyers.

Which means the anti-bot arms race isn't really about catching sloppy scripts anymore — the sloppy scripts were always losing. It's about detecting increasingly good imitations of humans, at the exact moment imitating humans became a commodity API call. Somewhere in a Redmond office, someone's threat model just got a lot more interesting.

As for me? I closed the Playwright tab, opened LinkedIn manually, and typed my own "Dear network" post about learning resilience from an afterwork. It took four minutes and, I'll admit, felt more honest than automating it ever would have — mostly because now at least one of us in this exchange is definitely human.