Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grammarly shared its tokens with all websites

bugs.chromium.org

Post reply on HN
Print view View original

141–150 of 176 posts

Re: Grammarly shared its tokens with all websites

#141

Post by untangle »

fareesh wrote: post #127
marijn wrote: post #31

Another nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".

LastPass does this as well to input fields. Made it unusable for me. Haven't used a password manager since (was a couple of years ago). Has this problem been solved well recently?

I do not have a problem with LastPass on input fields (including this one), nor do I recall one. Perhaps a setting was amiss or it was a platform-dependent issue. Grammarly, OTOH...

Re: Grammarly shared its tokens with all websites

#142

Post by lcampbell »

rhizome wrote: post #137
Feniks wrote: post #134

Earlier quoted context omitted.

If it acts like a keylogger its a keylogger. When people want privacy they will inevitably have to give up usability. I ditched Swiftkey for an open source Android keyboard that doesn't connect online or asks for any permissions. Its CRAP but it doesn't leak.

Ooh, what keyboard? Does it have gesture typing, and is it better than gboard (Google's own), which is the worst I've ever used?

I can't speak for GP, but I switched to Hacker's Keyboard[1] which doesn't support gesture typing. I'm pretty happy with it, though it's pretty barebones (it doesn't even turn on the phone's radio). Took a bit getting used to -- the recommendations are different and it felt like the key hitboxes weren't the same as gboard, but it felt pretty familiar after a couple of weeks.

[1] https://github.com/klausw/hackerskeyboard

Re: Grammarly shared its tokens with all websites

#143

Post by AgentME »

ocdtrekkie wrote: post #61
kinkrtyavimoodh wrote: post #32

Earlier quoted context omitted.

Aren't all password managers keyloggers too?

I personally stay far away from password managers, especially as browser extensions. I'd really recommend everyone look at how many of their Chrome extensions have the permission to "access your data on all websites", and consider whether or not they really trust the companies or individuals who made those extensions with that permission. It's eye-opening to people when I ask them about an extension they have, say "H…

A Chrome extension even with all available permissions doesn't have access to your password manager. (It could record the passwords as they're typed or autofilled into a webpage, but it doesn't make a difference whether you're using your browser's password manager or typing it yourself there.)

Re: Grammarly shared its tokens with all websites

#144

Post by rak »

adjwilli wrote: post #20
oneweekwonder wrote: post #15

Earlier quoted context omitted.

Anything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?

A quick Google search and I found https://grammark.org/dist/#/ which could be incorporated into a Chrome extension.

I put "teh game is a art" into this one and it told me there were no problems with the writing.

Re: Grammarly shared its tokens with all websites

#145

Post by alexanderdmitri »

lcampbell wrote: post #142
rhizome wrote: post #137

Earlier quoted context omitted.

Ooh, what keyboard? Does it have gesture typing, and is it better than gboard (Google's own), which is the worst I've ever used?

I can't speak for GP, but I switched to Hacker's Keyboard[1] which doesn't support gesture typing. I'm pretty happy with it, though it's pretty barebones (it doesn't even turn on the phone's radio). Took a bit getting used to -- the recommendations are different and it felt like the key hitboxes weren't the same as gboard, but it felt pretty familiar after a couple of weeks. [1] https://github.com/klausw/hackerskeybo…

Thanks for this, exactly what I've been looking for

Re: Grammarly shared its tokens with all websites

#146

Post by AgentME »

xg15 wrote: post #97

I think Chrome's (and now Firefox') awkward extension sandboxing is partially to blame, though. When you add an extension page script, you get access to a page's DOM, but you're completely isolated from the page's own JS: You get your own JS context and window object without any modifications the page may have done to it. That's usually reasonable as a page can mess with the built-in methods of its context, so if an…

There's no reason to send the grammarly auth token into the page's javascript context to begin with. The ajax connections can be done with the auth token in the extension's protected content script context.

Re: Grammarly shared its tokens with all websites

#147

Post by IncRnd »

tomc1985 wrote: post #81
oneweekwonder wrote: post #15

Earlier quoted context omitted.

Anything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?

Your browser can do spellcheck...

> Your browser can do spellcheck...

Yes... But your browser won't detect "spellcheck do can browser your"

Grammar is more than just spelling.

Re: Grammarly shared its tokens with all websites

#148

Post by AgentME »

kuschku wrote: post #17
chatmasta wrote: post #13

Earlier quoted context omitted.

Wouldn’t such a restriction eliminate the main selling point of extensions, which is that they can modify content on the page? The extension permissions API already offers enough restrictions. As a user, I simply do not install extensions that need access to all pages, or I only enable them on pages where I need them.

Extensions modifying pages is fine, but often an extension wants to show custom UI on top of the page. It’d be much more secure to allow the extension to do that without requiring it to put this into the page. For example, currently you have the DOM of the page, and the extension’s UI is injected into it. It would be preferable if you’d treat each tab as if it was like This way an extension that wants to show secure…

That only works for extensions that want to show their content in a separate overlay layer from the page. If the extension wants to show its content inline with the page's elements, pushing the page's elements out of the way and freely flowing with the page's elements, then that doesn't exactly work.

An extension can stuff its UI within an iframe that the host page can't manipulate, but that does come with some UI limitations.

Re: Grammarly shared its tokens with all websites

#150

Post by alanh »

So… I of course had no specific idea about this, but in 2014(?) I declined recruiting pursuits from Grammarly after realizing that their developers were almost entirely managed from another hemisphere. It sounded like a very top-down, low-collaboration, anti-engineer environment. I am not at all surprised that major issues like this can and would occur in such an environment.
Post reply on HN