Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grammarly shared its tokens with all websites

bugs.chromium.org

Post reply on HN
Print view View original

1–10 of 176 posts

Re: Grammarly shared its tokens with all websites

#3

Post by cirowrc »

mathgeek wrote: post #2

TL;DR: update your Grammarly plugins so that you get the fix to this issue.

Maybe I'll sound stupid, but is it possible to force an update of a chrome extension without removing it and then adding it again from the store? Is that application-specific?

thx!

Re: Grammarly shared its tokens with all websites

#5

Post by boffinism »

I nearly missed this bit at the bottom:

> Grammarly had fixed the issue and released an update to the Chrome Web Store within a few hours, a really impressive response time.

Nice to see a company take this kind of thing appropriately seriously (although of course it should never have happened in the first place).

Re: Grammarly shared its tokens with all websites

#6

Post by kuschku »

This, just like Mozilla’s screenshot addon, and all the other examples, shows why it’s an insane idea to mix addon content with the websites, and why it’s important to make sure that addon content can run on the UI layer of the browser, and not within of the content of the sites.

Relying on "best practices" is always a security disaster waiting to happen, if you don’t enforce security and separation in the design of the APIs and languages already, you won’t get security.

Re: Grammarly shared its tokens with all websites

#7

Post by ocdtrekkie »

I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security.

Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.

Re: Grammarly shared its tokens with all websites

#8

Post by AltCtrl »

boffinism wrote: post #5

I nearly missed this bit at the bottom: > Grammarly had fixed the issue and released an update to the Chrome Web Store within a few hours, a really impressive response time. Nice to see a company take this kind of thing appropriately seriously (although of course it should never have happened in the first place).

I was trying to reproduce the bug when I got to that line... nice to see it fixed quickly.

Re: Grammarly shared its tokens with all websites

#9

Post by fiatjaf »

cirowrc wrote: post #3
mathgeek wrote: post #2

TL;DR: update your Grammarly plugins so that you get the fix to this issue.

Maybe I'll sound stupid, but is it possible to force an update of a chrome extension without removing it and then adding it again from the store? Is that application-specific? thx!

If a new version is available on the store it will update automatically from time to time. You can trigger the auto-updates from your extensions settings page.

Re: Grammarly shared its tokens with all websites

#10

Post by fiatjaf »

ocdtrekkie wrote: post #7

I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.

Yes, it is crazy. For these cases we shouldn't be using SaaS at all. Installed applications can still be useful, I guess.
Post reply on HN