Although as a non-native speaker I find their service very attractive, I've so far refrained from installing their apps/extension. I was never confident enough about how Grammarly would keep safe every word I type (emails,...). This bug is a confirmation I should not trust them or any similar service.
Grammarly shared its tokens with all websites
11–20 of 176 posts
Re: Grammarly shared its tokens with all websites
#12TL;DR: update your Grammarly plugins so that you get the fix to this issue.
How can I do that since Chrome doesn't have an update button to extensions? Is 14.826.1446 the last one?
chrome://extensions/
Enable developer mode, and then Update Extensions Now. That forces a manual update (although the version you're referring to appears to be the latest).
Re: Grammarly shared its tokens with all websites
#13This, just like Mozilla’s screenshot addon, and all the other examples, shows why it’s an insane idea to mix addon content with the websites, and why it’s important to make sure that addon content can run on the UI layer of the browser, and not within of the content of the sites. Relying on "best practices" is always a security disaster waiting to happen, if you don’t enforce security and separation in the design of…
Wouldn’t such a restriction eliminate the main selling point of extensions, which is that they can modify content on the page?
The extension permissions API already offers enough restrictions. As a user, I simply do not install extensions that need access to all pages, or I only enable them on pages where I need them.
Re: Grammarly shared its tokens with all websites
#14I nearly missed this bit at the bottom: > Grammarly had fixed the issue and released an update to the Chrome Web Store within a few hours, a really impressive response time. Nice to see a company take this kind of thing appropriately seriously (although of course it should never have happened in the first place).
It seems like it would be more fair for the headline to use the past tense.
Re: Grammarly shared its tokens with all websites
#15I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.
Yes, it is crazy. For these cases we shouldn't be using SaaS at all. Installed applications can still be useful, I guess.
Anything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?
Re: Grammarly shared its tokens with all websites
#16Although as a non-native speaker I find their service very attractive, I've so far refrained from installing their apps/extension. I was never confident enough about how Grammarly would keep safe every word I type (emails,...). This bug is a confirmation I should not trust them or any similar service.
I had the same thought which is why I just navigate direct via the browser when I need it. Otherwise I just rely on standard spell-check.
Re: Grammarly shared its tokens with all websites
#17This, just like Mozilla’s screenshot addon, and all the other examples, shows why it’s an insane idea to mix addon content with the websites, and why it’s important to make sure that addon content can run on the UI layer of the browser, and not within of the content of the sites. Relying on "best practices" is always a security disaster waiting to happen, if you don’t enforce security and separation in the design of…
Wouldn’t such a restriction eliminate the main selling point of extensions, which is that they can modify content on the page? The extension permissions API already offers enough restrictions. As a user, I simply do not install extensions that need access to all pages, or I only enable them on pages where I need them.
Extensions modifying pages is fine, but often an extension wants to show custom UI on top of the page.
It’d be much more secure to allow the extension to do that without requiring it to put this into the page.
For example, currently you have the DOM of the page, and the extension’s UI is injected into it.
It would be preferable if you’d treat each tab as if it was like
Re: Grammarly shared its tokens with all websites
#18Earlier quoted context omitted.
Yes, it is crazy. For these cases we shouldn't be using SaaS at all. Installed applications can still be useful, I guess.
Anything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?
I've not found time to try any of them yet so I can't comment on how they compare to Grammarly, but there are F/OSS alternatives.
https://languagetool.org/ for one supports running your own instance of the server-side portion out-of-the-box. You could run it truly locally assuming your device is appropriate, or your own server which might be more flexible as you can support a greater range of devices and share custom dictionaries between them.
Re: Grammarly shared its tokens with all websites
#19Earlier quoted context omitted.
Yes, it is crazy. For these cases we shouldn't be using SaaS at all. Installed applications can still be useful, I guess.
Anything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?
Improving user input through learning and trying harder.
Re: Grammarly shared its tokens with all websites
#20Earlier quoted context omitted.
Yes, it is crazy. For these cases we shouldn't be using SaaS at all. Installed applications can still be useful, I guess.
Anything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?
A quick Google search and I found https://grammark.org/dist/#/ which could be incorporated into a Chrome extension.