Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 18 posts

Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

#1

Post by d3fault »

First, let me say that I am not a professional of any kind. I'm actually just entering my first year of undergrad.

Anyway, let's get to the point:

If someone were to use the auto translate feature to look at a foreign bank account (as an expat or something), couldn't the server request to translate your page be intercepted and read by a malicious party? It seems like a much easier point of entry than something like a key logger or something. However, like I said, I'm not a professional, or even a semi-professional. I thought of this, quite literally, in the shower.

Re: Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

#2

Post by rahimnathwani »

It might be fun for you try this yourself.

Connect two computers to the same network. On one, use some MITM proxy software. On the other, set all the traffic to go via this proxy, either transparently (via default gateway) or explicitly via proxy settings.

Then see if you can intercept the info being sent from your browser to Google translate.

I'm not at a computer right now, but I guess that:

1. The auto-translate feature uses https, so that the traffic between you and Google is not available via network-level MITM.

2. The page contents are not sent to Google at all, but only the URL

Re: Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

#3

Post by great_psy »

It depends how Chrome is programmed to detect languages. The language detection could be all done in the browser, and it would only send data to google if you want to translate. The translation could be intercepted, but it could also (hopefully) be encrypted.

To get a definite answer you would need to look at the source code and go from there.

Re: Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

#4

Post by beaconstudios »

rahimnathwani wrote: post #2

It might be fun for you try this yourself. Connect two computers to the same network. On one, use some MITM proxy software. On the other, set all the traffic to go via this proxy, either transparently (via default gateway) or explicitly via proxy settings. Then see if you can intercept the info being sent from your browser to Google translate. I'm not at a computer right now, but I guess that: 1. The auto-translate f…

how would 2. work for pages that are behind authentication?

Re: Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

#5

Post by DonHopkins »

There are a lot of strings of text that it would not make sense to translate and not be wise to send to a remote translation service, like strings of digits, blocks of base 64 encoded text like ssh keys, digits and letters separated by punctuation like phone numbers and bank account numbers, etc.

Perhaps Google Translate should filter out non-word private tokens from the original text (replacing them with opaque identifiers that aren't translated but are left alone, and substituting the originals back into the translated text).

(PS: Are you still in the shower, posting on one of those new-fangled waterproof phones? Hopefully not a Google Glass!)

Re: Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

#7

Post by bzbbzjux »

great_psy wrote: post #3

It depends how Chrome is programmed to detect languages. The language detection could be all done in the browser, and it would only send data to google if you want to translate. The translation could be intercepted, but it could also (hopefully) be encrypted. To get a definite answer you would need to look at the source code and go from there.

Or save yourself a ton of time and just capture the network traffic.

Re: Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

#9

Post by eat_veggies »

rahimnathwani wrote: post #2

It might be fun for you try this yourself. Connect two computers to the same network. On one, use some MITM proxy software. On the other, set all the traffic to go via this proxy, either transparently (via default gateway) or explicitly via proxy settings. Then see if you can intercept the info being sent from your browser to Google translate. I'm not at a computer right now, but I guess that: 1. The auto-translate f…

You don't even need a proxy--just open up your dev tools and watch the network.

1. It does use HTTPS. It'd be insane if it didn't.

2. Individual strings from the page get sent to the translate API:

https://i.imgur.com/2nAlbp4.png

Re: Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

#10

Post by z_open »

rahimnathwani wrote: post #2

It might be fun for you try this yourself. Connect two computers to the same network. On one, use some MITM proxy software. On the other, set all the traffic to go via this proxy, either transparently (via default gateway) or explicitly via proxy settings. Then see if you can intercept the info being sent from your browser to Google translate. I'm not at a computer right now, but I guess that: 1. The auto-translate f…

How could google not have the page contents? The content generated from the URL as requested by google may not have the same content that you currently have.
Post reply on HN