Another nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".
Grammarly shared its tokens with all websites
31–40 of 176 posts
Re: Grammarly shared its tokens with all websites
#32I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.
Aren't all password managers keyloggers too?
Re: Grammarly shared its tokens with all websites
#33garmmarly perhaps ranks up there amongst the most annoying startup names.
Re: Grammarly shared its tokens with all websites
#34I blocked Grammarly at my last company, nothing like giving a company tracking access to everything you type or read, and their EULA gives them the rights to everything they track. Using Grammarly is stupid, paying them is downright insane.
One of the reasons I started writing my own editor.
Re: Grammarly shared its tokens with all websites
#35Another nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".
Spot on, had a similar problem on an web editor I work on.
Re: Grammarly shared its tokens with all websites
#36I blocked Grammarly at my last company, nothing like giving a company tracking access to everything you type or read, and their EULA gives them the rights to everything they track. Using Grammarly is stupid, paying them is downright insane.
We block extensions, period, on Google Chrome, as it prevents most malware outright. But then we've also discovered Grammarly's Microsoft Office plugin installs to the user folder (without requiring admin rights) as well. I've made a request to our antivirus vendor to add detection and blocking of Grammarly specifically, for the moment we're detecting it a different way.
May I ask how you're detecting it? If you can't say [or don't want to] for whatever reason that's fine, I'm merely curious is all.
Re: Grammarly shared its tokens with all websites
#37I nearly missed this bit at the bottom: > Grammarly had fixed the issue and released an update to the Chrome Web Store within a few hours, a really impressive response time. Nice to see a company take this kind of thing appropriately seriously (although of course it should never have happened in the first place).
It seems like it would be more fair for the headline to use the past tense.
Gotta get that HN karma tho
Re: Grammarly shared its tokens with all websites
#38I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.
Aren't all password managers keyloggers too?
I am too paranoid to use them, but, from what I read (regarding the biggest one):
"LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the Vault is already encrypted before it leaves your computer and reaches the LastPass server, not even LastPass employees can see your sensitive data"
If there is an attack still possible (even using LastPass employees) can you post it here?
Re: Grammarly shared its tokens with all websites
#39This, just like Mozilla’s screenshot addon, and all the other examples, shows why it’s an insane idea to mix addon content with the websites, and why it’s important to make sure that addon content can run on the UI layer of the browser, and not within of the content of the sites. Relying on "best practices" is always a security disaster waiting to happen, if you don’t enforce security and separation in the design of…
> it’s important to make sure that addon content can run on the UI layer of the browser, and not within of the content of the sites
I don't get this thinking at all. Browser addons are trusted. That's the point - they have special privileges to adjust browser behaviour.
If you go around installing malicious addons, you get no more sympathy from me than if you'd gone around installing malicious kernel modules.
Re: Grammarly shared its tokens with all websites
#40I blocked Grammarly at my last company, nothing like giving a company tracking access to everything you type or read, and their EULA gives them the rights to everything they track. Using Grammarly is stupid, paying them is downright insane.
One of the reasons I started writing my own editor.
Interesting, how is the progress going so far? I think there is a lot of demand out there for a certain type of editor.