Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grammarly shared its tokens with all websites

bugs.chromium.org

Post reply on HN
Print view View original

111–120 of 176 posts

Re: Grammarly shared its tokens with all websites

#111

Post by def_true_false »

kuschku wrote: post #110
def_true_false wrote: post #95

Earlier quoted context omitted.

As long as the extension UI is rendered where the page can also render something, it will be vulnerable to phishing. E.g. https://www.seancassidy.me/lostpass.html

Correct, that’s why it’d be preferable to have it handled in the browser itself. If it’s a message in the browser chrome itself, and not as in the page, it is possible to add distinguishing UI. With the current system, it’s literally impossible to distinguish the UI

Chrome has extension popups that kind of do this - they are pointed to the icon in the extension bar. Does Firefox have anything like that?

Re: Grammarly shared its tokens with all websites

#113

Post by paulryanrogers »

ocdtrekkie wrote: post #71
paulgb wrote: post #67

Earlier quoted context omitted.

As an open-source extension developer, I wish there was a way to prove that the extension uploaded is generated from a specific git commit. It wouldn't solve everything, but it would make it easier for anyone to audit the code and know that it actually matches the code I've uploaded.

Indeed. I was thinking about this, and would argue this should really not only exist... but be the only way extensions with this level of wide-sweeping access should be permitted to be published. Chrome team, if they were security-focused, would not permit any closed source extensions which have access to all website data. People don't seem to understand sometimes that if an extension has this sort of access, you nee…

I'd add to that "not obfuscated" too since JS minimization and WASM can be as obscure as binary.

Re: Grammarly shared its tokens with all websites

#114

Post by btown »

marijn wrote: post #31

Another nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".

As a web developer, setAttribute('data-gramm', 'false') is your friend.

For better or for worse, between browser extensions loaded by the end user, and "tags" injected by your well-meaning business analytics team - see my comment here: https://news.ycombinator.com/item?id=16314501 ), the extension ecosystem has become the new Internet Explorer in terms of compatibility testing. Luckily most of the workarounds are trivial, but it's essential to have good QA on actual client machines if you're doing, well, anything at all.

Re: Grammarly shared its tokens with all websites

#115

Post by mxpxrocks10 »

nakedrobot2 wrote: post #101
ocdtrekkie wrote: post #7

I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.

Why is this story not bigger news? Grammarly is excreting ads into my eyes before nearly every YouTube video I watch, yet I don't see any mainstream sites covering this.

Totally. Here's some more info on the company. They are located in the Ukraine. http://escadra.com.ua/en/kak-dvoe-kievlyan-sozdali-servis-pr...

Re: Grammarly shared its tokens with all websites

#116

Post by paulryanrogers »

LocalPCGuy wrote: post #52
rileyteige wrote: post #42

Earlier quoted context omitted.

Not sure if you're using the credential "autofill" feature, but somewhat recently there was an attack in which their autofill extension could be tricked into "autofilling" specific sites' credentials on a malicious webpage. (Not sure if this has been fixed by LastPass) The fix for that was to not use autofill and revert to manually grabbing your username/password when filling out a login form. Aside from that, I am n…

LastPass has been very diligent in fixing issues like the one you list. Usually very quickly (sometimes in hours, not even days.) And most of the issues you've read about with LastPass have been fixed before being disclosed because of how responsive they are. Users still need to practice skepticism and ultimately it is their responsibility to protect their passwords. But LastPass has been a very good citizen when it…

I would not say "as secure as possible" since the risks introduced by a browser extension are very real. Though the alternatives lately are impractical for non-technical users

Re: Grammarly shared its tokens with all websites

#117

Post by DougBTX »

zitterbewegung wrote: post #96
ocdtrekkie wrote: post #7

I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.

Isn't this also true of nearly all installable keyboards on mobile devices?

Probably yes, through at least by default on iOS custom keyboards don't have network access.

Re: Grammarly shared its tokens with all websites

#119

Post by kuschku »

def_true_false wrote: post #111
kuschku wrote: post #110

Earlier quoted context omitted.

Correct, that’s why it’d be preferable to have it handled in the browser itself. If it’s a message in the browser chrome itself, and not as in the page, it is possible to add distinguishing UI. With the current system, it’s literally impossible to distinguish the UI

Chrome has extension popups that kind of do this - they are pointed to the icon in the extension bar. Does Firefox have anything like that?

Yes, Firefox has the same – but they’re obviously not optimal in the context of a page.

Re: Grammarly shared its tokens with all websites

#120

Post by [deleted] »

Spooky23 wrote: post #78
dokument wrote: post #74

Earlier quoted context omitted.

> I personally stay far away from password managers I am curious how you manage your passwords.

Use an out of band password manager, whose key is never transmitted over a network. Or a notebook that is physically secured. There are a number of solutions for password vaults, and you can use a variety of means to synchronize them if needed. The notion that it's a good idea to trust a browser extension for secrets management is pretty bizarre to me if you're protecting high value assets.

[deleted]
Post reply on HN