Live data from Hacker News

Grammarly shared its tokens with all websites

bugs.chromium.org

161–170 of 176 posts

Re: Grammarly shared its tokens with all websites

#161

Kind of tangential, but does anyone else worry that systems like these will start to dictate what is "correct" language. Basically pushing narratives subtly through "correcting" totally acceptable speech.

Most people with any writing capability do not use these tools. They are for foreign speakers of English or extremely poorly educated native speakers, they only affect the bottom 50% of written content which is not what affects the development of language.

Um, I just wrote a lengthy comment about how this is not exactly the case: https://news.ycombinator.com/item?id=16322795

It's only mentioned in the comment, but the amount of mistakes in tech-related writing, by native English speakers and otherwise, is gargantuan and overwhelming, and I'd wish using something like Grammarly (if safe, open source and so on) was a requirement for putting your writing on the web.

As it is, the quality of writing is so bad, that I (as a foreign speaker) don't improve my English in any way by reading it, and I have to be very careful not to repeat these mistakes in my own writing later.

Re: Grammarly shared its tokens with all websites

#162

Earlier quoted context omitted.

Why is this story not bigger news? Grammarly is excreting ads into my eyes before nearly every YouTube video I watch, yet I don't see any mainstream sites covering this.

Mostly because cloud-connected keyloggers are mainstream. As I mentioned, Windows does it if you have their "inking and typing" setting enabled. A lot of mobile keyboard apps do it, especially if they say they use the cloud to help correct your typing. Of course, in the case of Microsoft or Google, you presumably either have disabled the setting or you place your trust in their security practices that it is okay, bec…

top tier doesn't necessary mean better security. Your data being accessible from the cloud is a security risk by itself and these companies are huge targets for hackers, and will share your data with state actors, or worse advertisers, for-profit data miners et.al.

Re: Grammarly shared its tokens with all websites

#163

Last year I signed up for a paid subscription to Grammarly...then I read terms of use[1]. I know...it should have been the other way around, but here it goes: > "By uploading or entering any User Content, you give Grammarly (and those it works with) a nonexclusive, worldwide, royalty-free and fully-paid, transferable and sublicensable, perpetual, and irrevocable license to copy, store and use your User Content in con…

Thanks! Uninstalled straight away. I think the TOS issue is more important than the security one.

Re: Grammarly shared its tokens with all websites

#164
post #17

Earlier quoted context omitted.

Extensions modifying pages is fine, but often an extension wants to show custom UI on top of the page. It’d be much more secure to allow the extension to do that without requiring it to put this into the page. For example, currently you have the DOM of the page, and the extension’s UI is injected into it. It would be preferable if you’d treat each tab as if it was like This way an extension that wants to show secure…

That only works for extensions that want to show their content in a separate overlay layer from the page. If the extension wants to show its content inline with the page's elements, pushing the page's elements out of the way and freely flowing with the page's elements, then that doesn't exactly work. An extension can stuff its UI within an iframe that the host page can't manipulate, but that does come with some UI li…

Still, it’d be a major improvement over what we have today.

Re: Grammarly shared its tokens with all websites

#165
post #134

Earlier quoted context omitted.

If it acts like a keylogger its a keylogger. When people want privacy they will inevitably have to give up usability. I ditched Swiftkey for an open source Android keyboard that doesn't connect online or asks for any permissions. Its CRAP but it doesn't leak.

Ooh, what keyboard? Does it have gesture typing, and is it better than gboard (Google's own), which is the worst I've ever used?

You should check out MessagEase keyboard. It is so accurate for me that I don't even need corrections. It takes a little bit of time to get used to, but once you get the hang of it, it's super fast.

Re: Grammarly shared its tokens with all websites

#167

I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.

Keylogging is just the beginning. Any (and many) browser extensions have the ability to record everything you do on every page you visit. All it takes is specifying the permission in the extension’s manifest and adding some event listeners. It has to work this way or browsers wouldn’t be truly extensible. Be mindful of which extensions you install.

>Be mindful of which extensions you install.

That sounds an awful lot like "Be careful what email attachments you open." Blaming the user never worked out then either.

Re: Grammarly shared its tokens with all websites

#168
post #121

Earlier quoted context omitted.

Your browser can do spellcheck...

It doesn’t detect the passive voice, punctuation errors, or tense mismatch. While spelling catches many, it doesn’t catch them all.

That sounds more like you need to work on your grammar. One should be able to do those things on their own

Re: Grammarly shared its tokens with all websites

#169
post #139

Earlier quoted context omitted.

Maybe they knew what they were doing and had a fix tee'd up for when they were found out?

Why would they wait to patch a massive vulnerability in their site that's just waiting to shower them in negative press?

not sure, but they just lost a customer.

My annual sub end March 1st which is about perfect timing since they were trying to double the annual rate without proper notice, in my opinion.

Re: Grammarly shared its tokens with all websites

#170

Earlier quoted context omitted.

And pay attention if the companies that make your extensions are sold.

It's ridiculous that we're at this point where using a handful of software applications means keeping up to date with the social life and financial situation of the developer, reading changelogs, etc. And you only can spare both the time and cognitive load to do this for at most a dozen or two applications, if you really care . The rest, you just have to trust that enough other people are watching carefully. But the…

I completely agree with you. Unfortunately, legislation has been stuck in the 80's for the most part, and while I understand why, it can be frustrating.
Post reply on HN