Another nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".
LastPass does this as well to input fields. Made it unusable for me. Haven't used a password manager since (was a couple of years ago). Has this problem been solved well recently?
Grammarly shared its tokens with all websites
151–160 of 176 posts
Re: Grammarly shared its tokens with all websites
#152> "By uploading or entering any User Content, you give Grammarly (and those it works with) a nonexclusive, worldwide, royalty-free and fully-paid, transferable and sublicensable, perpetual, and irrevocable license to copy, store and use your User Content in connection with the provision of the Software and the Services and to improve the algorithms underlying the Software and the Services."
First I thought that may be this is just me being paranoid. So I compared their terms of service with Evernote's[2] and summarize the differences for them in the support ticket asking termination of my account. I reproduce that here for reference:
> In Evernote's TOS
> – It's clearly noted that the user retains their Copyright to the content;
> – and the license to Evernote is a limited and they don't "obtain any right, title or > interest" other than they point out;
> – they don't require sublicensable and transferable rights to User Content which is different than having the rights to share the content with other contractual partners (which they require);
> – the agreement on content is irrevocable as long as the content is stored on the service.
[1]: https://www.grammarly.com/terms
[2]: https://evernote.com/legal/tos.php
Edit: Formatting.
Re: Grammarly shared its tokens with all websites
#153Earlier quoted context omitted.
Keylogging is just the beginning. Any (and many) browser extensions have the ability to record everything you do on every page you visit. All it takes is specifying the permission in the extension’s manifest and adding some event listeners. It has to work this way or browsers wouldn’t be truly extensible. Be mindful of which extensions you install.
And pay attention if the companies that make your extensions are sold.
And you only can spare both the time and cognitive load to do this for at most a dozen or two applications, if you really care. The rest, you just have to trust that enough other people are watching carefully.
But the average person isn't going to keep up with even one application. They only bought their computer so they could browse the web and check emails, not so they could learn the details of how it works.
Likewise, most of us don't buy a car in order to spend a lot of time learning about exactly how a combustion engine works. We don't have the time.
Granted, this board is laden with engineers who will make the time to understand how their tools work, but we simply cannot expect this kind of effort from most people.
So, like we have to trust lower-level components to be scrutinized elsewhere, and trust we will be alerted in case of critical issues, the general population must trust the "nerds" to get things right and keep them safe.
This means that typically, the best attack surfaces will be small, widely-distributed, low-level software stacks whose developers can easily be compromised. Not just software either, but hardware.
It does seem like this is ultimately a battle we are going to lose without regulatory legislation in domains that require mass-deployment of software that can potentially breach Constitutional rights. In order to be federally qualified as "privacy-friendly", you have to meet certain guidelines both on a hardware and software level. This would include automatic transmission or collection of certain kinds of data without very express permission.
Re: Grammarly shared its tokens with all websites
#154I am waiting for the typical "CEO of Grammarly here. I will answer any questions you may have" comment, but I guess not.
Re: Grammarly shared its tokens with all websites
#155Re: Grammarly shared its tokens with all websites
#1561) Grammarly is a fancy grammar/spelling correction tool.
2) You use it by opening an account, and installing their browder extension.
3) As you type text into a web page, the extension sends that input back to Grammarly, where their software analyzes it and provides correction recommendations.
4) The text that was sent back is persisted under your account, and is available for retrieval.
5) A software bug in their extension allowed a script on any site to see your Grammarly auth token.
6) As the result, any malicious site could log into your account, and see what you've been typing.
Is that the rough gist of it? If yes, then how in the world does #4 make any sense? Why store and expose that data, knowing that it's likely to contain troves and troves of sensitive and PII information...
Re: Grammarly shared its tokens with all websites
#157I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.
Keylogging is just the beginning. Any (and many) browser extensions have the ability to record everything you do on every page you visit. All it takes is specifying the permission in the extension’s manifest and adding some event listeners. It has to work this way or browsers wouldn’t be truly extensible. Be mindful of which extensions you install.
I guess android's "partial permission" is the right thing...
Re: Grammarly shared its tokens with all websites
#158Re: Grammarly shared its tokens with all websites
#159Kind of tangential, but does anyone else worry that systems like these will start to dictate what is "correct" language. Basically pushing narratives subtly through "correcting" totally acceptable speech.
Re: Grammarly shared its tokens with all websites
#160Although as a non-native speaker I find their service very attractive, I've so far refrained from installing their apps/extension. I was never confident enough about how Grammarly would keep safe every word I type (emails,...). This bug is a confirmation I should not trust them or any similar service.
To get to this point, I did primarily two things: I read a lot, and I wrote a lot. I then submitted my writing to my peers, similarly interested in creative writing, who would also - in addition to the story, characters and so on - criticise my word choices and my grammar. It took years, but it was enjoyable, and I acquired my second (and last, after programming) skill that could be of some value.
A couple of years later, when I started working, I had to switch to English. It wouldn't be that big of a deal were it not for my experiences: every time I had to write anything, I felt incredibly constrained, like I'm missing half of my brain. I was used to being able to express myself precisely, clearly and elegantly in writing - all of that stopped working after the switch. It's incredibly frustrating, to the point that for a few years I was in complete denial and refused to write in English wherever I could get away with it.
Well, I thought, I got proficient in Polish, so technically I should be able to get to the same point in English, right? It's easy - I just need to read a lot and have a group of people who'd like to read my writings and correct my mistakes. Easy!
...however, I'm not in high school anymore. Between work and the little social life I have, there's not that much time available for pursuing other matters. I do read a lot, exclusively in English, but these are mostly tech-related articles, blogs, and books, written by people who couldn't care less about beauty and elegance of their writing. It's actually counterproductive if my goal is to get better at writing - such posts are chock-full of both errors and merely weird wordings and constructs. And nobody seems to care.
There is a creative writing StackExchange (and many other places), where I could submit my texts to get the criticism and corrections I need. Unfortunately, I don't have the time - even if I had the skill - to do my part of the deal, that is, to read and comment on writings of others. I'd feel bad exploiting strangers like that.
As you probably already guessed, this is where Grammarly comes up. It gives me a bit of the feedback I need to improve my writing. It's not at the level of other humans, which is obvious, but it does catch some mistakes and some stylistic problems. It doesn't rely on unpaid work of others, so I have no qualms about using it. I'm not worried about following its advice because even if it's wrong, nobody would care. The amount of contempt for the language in the tech community is staggering; average tech-related writing is on such a level that I'd rather chop my hand off than write like that, but it shows just how unimportant correctness and elegance is for people (as long as it gets the point across... right?)
So, to summarize and get back to the topic at hand: Grammarly is non-ideal on so many fronts, that to simply enumerate them would take until Friday (it's Wed today). But it's also the only tool I can rely on, and it does an acceptable job at what it does. It breaks web pages, it's unusable from outside a browser, it's error indicator is frequently displayed 3+ lines from where it should be, it's stupidly dumb and cannot, by itself, tell where the additional "actually" is actually needed, but it's the only help I can get, so I use it.
Of course, if your goal is merely communication you do not need anything other than basic spell-checker and a book on basic grammar. On the other hand, if your goals are similar to mine, then Grammarly is one step above that combo. It isn't, and probably won't ever be, anywhere near the level of human reviewers, but it is something.
PS. For a long time, I wanted a feature in Grammarly that would automatically slurp content of blog posts and articles in, so that I can just click a couple of times and then read the post without all the mistakes and weirdness people so often put in there. Reading the top-voted comment here, about the license, I see why they won't implement it. Similarly, I guess Emacs plugin is not going to emerge anytime soon. Whatever you use Grammarly for, you should assume it's public. It doesn't make it any less usefull for writing comments on some sites or posts for my blog, though.