91–100 of 176 posts
I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.
Keylogging is just the beginning. Any (and many) browser extensions have the ability to record everything you do on every page you visit. All it takes is specifying the permission in the extension’s manifest and adding some event listeners. It has to work this way or browsers wouldn’t be truly extensible. Be mindful of which extensions you install.
Another nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".
Earlier quoted context omitted.
Your brain. If you offload too many tasks to computers, those skills will weaken.
But our brain logs our keystrokes!
Earlier quoted context omitted.
Wouldn’t such a restriction eliminate the main selling point of extensions, which is that they can modify content on the page? The extension permissions API already offers enough restrictions. As a user, I simply do not install extensions that need access to all pages, or I only enable them on pages where I need them.
Extensions modifying pages is fine, but often an extension wants to show custom UI on top of the page. It’d be much more secure to allow the extension to do that without requiring it to put this into the page. For example, currently you have the DOM of the page, and the extension’s UI is injected into it. It would be preferable if you’d treat each tab as if it was like This way an extension that wants to show secure…
I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.
When you add an extension page script, you get access to a page's DOM, but you're completely isolated from the page's own JS: You get your own JS context and window object without any modifications the page may have done to it. That's usually reasonable as a page can mess with the built-in methods of its context, so if an extension were to rely on them, the risk of privilege escalation attacks would be really high.
Except sometimes an extension does want to interact with the page JS, (e.g. for accessing data the page only keeps in JS objects but not in the DOM.)
As far as I know, there is no safe way to do this in Chrome. The recommended (!) way is to inject a script element into the DOM and exchange data with the page script via some makeshift communication channel, e.g. postMessaging yourself. This will of course drop you right back into the hall-of-mirrors of potentially manipulated builtins that the page script isolation was trying to keep you out of. But apparently now it's ok if you have to deal with that by yourself.
From the looks of it, it seems Grammarly tried to open exactly that kind of communication channel and didn't correctly secure it.
Earlier quoted context omitted.
> I personally stay far away from password managers I am curious how you manage your passwords.
Use an out of band password manager, whose key is never transmitted over a network. Or a notebook that is physically secured. There are a number of solutions for password vaults, and you can use a variety of means to synchronize them if needed. The notion that it's a good idea to trust a browser extension for secrets management is pretty bizarre to me if you're protecting high value assets.
(Not directed at you personally, but I often hear such comments from people who are then perfectly fine to use a password manager in X11, where in a the default configuration every application can read your keystrokes, screen grabs, clipboard, etc.)
[1] Preferably one that communicates with an out-of-process password manager over an authenticated channel like 1Password.
Earlier quoted context omitted.
Anything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?
Your brain. If you offload too many tasks to computers, those skills will weaken.
Trying I promise, even different languages. But I'm not a native speaker and a bit dyslexic.
So someone or thing looking over my shoulder would be nice.
Another nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".
Turns out Grammarly was injecting HTML into the editor, which in turn was being included in the email body!