Live data from Hacker News

Grammarly shared its tokens with all websites

bugs.chromium.org

21–30 of 176 posts

Re: Grammarly shared its tokens with all websites

#21
post #11

Although as a non-native speaker I find their service very attractive, I've so far refrained from installing their apps/extension. I was never confident enough about how Grammarly would keep safe every word I type (emails,...). This bug is a confirmation I should not trust them or any similar service.

I tried it and my browsing exeprience was just terrible. It made Chrome so slow that there was a delay in typing and the character appearing. Haven't tried it again.

Re: Grammarly shared its tokens with all websites

#24

Earlier quoted context omitted.

Anything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?

I've not found time to try any of them yet so I can't comment on how they compare to Grammarly, but there are F/OSS alternatives. https://languagetool.org/ for one supports running your own instance of the server-side portion out-of-the-box. You could run it truly locally assuming your device is appropriate, or your own server which might be more flexible as you can support a greater range of devices and share custom…

> This extension will check your text by sending it to https://languagetool.org over an encrypted connection. Your text will not be stored.

Gives me a "privacy policy", "continue and don't ask again" or "cancel" hyperlink, nothing else. If I want to use it the first time.

But if you open the extension options under the "more tools" > extensions tab you can set the LanguageTool API server URL[0].

Going to try to setup a server over the weekend, thanks.

[0]: http://wiki.languagetool.org/http-server

Re: Grammarly shared its tokens with all websites

#25
post #11

Although as a non-native speaker I find their service very attractive, I've so far refrained from installing their apps/extension. I was never confident enough about how Grammarly would keep safe every word I type (emails,...). This bug is a confirmation I should not trust them or any similar service.

I tried it and my browsing exeprience was just terrible. It made Chrome so slow that there was a delay in typing and the character appearing. Haven't tried it again.

This was my experience as well. I don't know how anyone is able to use it; it brought my 2017 MacBook pro to its knees every time I would start writing a HN comment. I uninstalled it after about 5 minutes.

Re: Grammarly shared its tokens with all websites

#26
post #25

Earlier quoted context omitted.

I tried it and my browsing exeprience was just terrible. It made Chrome so slow that there was a delay in typing and the character appearing. Haven't tried it again.

This was my experience as well. I don't know how anyone is able to use it; it brought my 2017 MacBook pro to its knees every time I would start writing a HN comment. I uninstalled it after about 5 minutes.

No issues with speed or anything, chromium, linux.

Re: Grammarly shared its tokens with all websites

#27
post #3
post #2

TL;DR: update your Grammarly plugins so that you get the fix to this issue.

Maybe I'll sound stupid, but is it possible to force an update of a chrome extension without removing it and then adding it again from the store? Is that application-specific? thx!

Yes, after you enable Developer mode: https://i.imgur.com/Uehu1As.gif

Re: Grammarly shared its tokens with all websites

#28

I blocked Grammarly at my last company, nothing like giving a company tracking access to everything you type or read, and their EULA gives them the rights to everything they track. Using Grammarly is stupid, paying them is downright insane.

We block extensions, period, on Google Chrome, as it prevents most malware outright. But then we've also discovered Grammarly's Microsoft Office plugin installs to the user folder (without requiring admin rights) as well. I've made a request to our antivirus vendor to add detection and blocking of Grammarly specifically, for the moment we're detecting it a different way.

Re: Grammarly shared its tokens with all websites

#29
post #17

Earlier quoted context omitted.

Wouldn’t such a restriction eliminate the main selling point of extensions, which is that they can modify content on the page? The extension permissions API already offers enough restrictions. As a user, I simply do not install extensions that need access to all pages, or I only enable them on pages where I need them.

Extensions modifying pages is fine, but often an extension wants to show custom UI on top of the page. It’d be much more secure to allow the extension to do that without requiring it to put this into the page. For example, currently you have the DOM of the page, and the extension’s UI is injected into it. It would be preferable if you’d treat each tab as if it was like This way an extension that wants to show secure…

Some extensions like Google Inbox for Chrome will inject a single `iframe` that points to a `chrome-extension://` page, so while the page might notice the element, it can't access its content.

I think you could use the Shadow DOM in closed mode to prevent any information from leaking. [1]

[1]: https://blog.revillweb.com/open-vs-closed-shadow-dom-9f3d742...

Re: Grammarly shared its tokens with all websites

#30

I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.

Realized this when it wanted to install the plug in. Pretty much installed it. Used it for what I needed then uninstalled. They have a word plugin which I believe needs to be explicitly turned on so that’s a better use.
Post reply on HN