Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grammarly shared its tokens with all websites

bugs.chromium.org

Post reply on HN
Print view View original

71–80 of 176 posts

Re: Grammarly shared its tokens with all websites

#71

Post by ocdtrekkie »

paulgb wrote: post #67
ocdtrekkie wrote: post #61

Earlier quoted context omitted.

I personally stay far away from password managers, especially as browser extensions. I'd really recommend everyone look at how many of their Chrome extensions have the permission to "access your data on all websites", and consider whether or not they really trust the companies or individuals who made those extensions with that permission. It's eye-opening to people when I ask them about an extension they have, say "H…

As an open-source extension developer, I wish there was a way to prove that the extension uploaded is generated from a specific git commit. It wouldn't solve everything, but it would make it easier for anyone to audit the code and know that it actually matches the code I've uploaded.

Indeed. I was thinking about this, and would argue this should really not only exist... but be the only way extensions with this level of wide-sweeping access should be permitted to be published.

Chrome team, if they were security-focused, would not permit any closed source extensions which have access to all website data.

People don't seem to understand sometimes that if an extension has this sort of access, you need to be able to trust your browser extensions as much as you trust your browser itself.

Re: Grammarly shared its tokens with all websites

#72

Post by philippnagel »

ocdtrekkie wrote: post #57
3pt14159 wrote: post #54

Earlier quoted context omitted.

Is it possible to force uBlock and HTTPS Everywhere, but stop all other extensions?

Yes. Google offers ADMX templates for controlling Chrome which can be deployed through group policy. It includes an extension blacklist, which accepts wildcards. In my case, I put a * in there. It also has an extension whitelist, and a list of "force-installed apps and extensions". https://support.google.com/chrome/a/answer/187202?hl=en This is one place where Google actually did really do their homework, IMHO.

Is something comparable available for Firefox?

Re: Grammarly shared its tokens with all websites

#73

Post by iooi »

Moter8 wrote: post #70
ocdtrekkie wrote: post #60

Earlier quoted context omitted.

We have a couple different layers we can work with here, both on the computers and the network.

He asked for a specific thing, and you answered with nothing at all.

What if GP was working for Grammarly and wanted to avoid detection?

Re: Grammarly shared its tokens with all websites

#74

Post by dokument »

ocdtrekkie wrote: post #61
kinkrtyavimoodh wrote: post #32

Earlier quoted context omitted.

Aren't all password managers keyloggers too?

I personally stay far away from password managers, especially as browser extensions. I'd really recommend everyone look at how many of their Chrome extensions have the permission to "access your data on all websites", and consider whether or not they really trust the companies or individuals who made those extensions with that permission. It's eye-opening to people when I ask them about an extension they have, say "H…

> I personally stay far away from password managers

I am curious how you manage your passwords.

Re: Grammarly shared its tokens with all websites

#75

Post by ocdtrekkie »

Moter8 wrote: post #70
ocdtrekkie wrote: post #60

Earlier quoted context omitted.

We have a couple different layers we can work with here, both on the computers and the network.

He asked for a specific thing, and you answered with nothing at all.

He also indicated he understood that one might not want to detail their network security measures in detail. ;)

Re: Grammarly shared its tokens with all websites

#76

Post by eejdoowad »

ocdtrekkie wrote: post #7

I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.

Keylogging is just the beginning. Any (and many) browser extensions have the ability to record everything you do on every page you visit. All it takes is specifying the permission in the extension’s manifest and adding some event listeners.

It has to work this way or browsers wouldn’t be truly extensible. Be mindful of which extensions you install.

Re: Grammarly shared its tokens with all websites

#77

Post by Harvey-Specter »

dokument wrote: post #74
ocdtrekkie wrote: post #61

Earlier quoted context omitted.

I personally stay far away from password managers, especially as browser extensions. I'd really recommend everyone look at how many of their Chrome extensions have the permission to "access your data on all websites", and consider whether or not they really trust the companies or individuals who made those extensions with that permission. It's eye-opening to people when I ask them about an extension they have, say "H…

> I personally stay far away from password managers I am curious how you manage your passwords.

Memory

Re: Grammarly shared its tokens with all websites

#78

Post by Spooky23 »

dokument wrote: post #74
ocdtrekkie wrote: post #61

Earlier quoted context omitted.

I personally stay far away from password managers, especially as browser extensions. I'd really recommend everyone look at how many of their Chrome extensions have the permission to "access your data on all websites", and consider whether or not they really trust the companies or individuals who made those extensions with that permission. It's eye-opening to people when I ask them about an extension they have, say "H…

> I personally stay far away from password managers I am curious how you manage your passwords.

Use an out of band password manager, whose key is never transmitted over a network. Or a notebook that is physically secured. There are a number of solutions for password vaults, and you can use a variety of means to synchronize them if needed.

The notion that it's a good idea to trust a browser extension for secrets management is pretty bizarre to me if you're protecting high value assets.

Re: Grammarly shared its tokens with all websites

#79

Post by stryk »

Moter8 wrote: post #70
ocdtrekkie wrote: post #60

Earlier quoted context omitted.

We have a couple different layers we can work with here, both on the computers and the network.

He asked for a specific thing, and you answered with nothing at all.

That's OK, I figured he or she may not want to publicly reveal details, that is understandable in this case imho. As I said I was just curious if it was maybe a simple solution that could be implemented elsewhere.
Post reply on HN