14 ms·
Grammarly shared its tokens with all websites
- mathgeek 9y agoTL;DR: update your Grammarly plugins so that you get the fix to this issue.
- cirowrc 9y agoMaybe I'll sound stupid, but is it possible to force an update of a chrome extension without removing it and then adding it again from the store? Is that application-specific? thx!
- andeb 9y agoHow can I do that since Chrome doesn't have an update button to extensions? Is 14.826.1446 the last one?
- mathgeek 9y agochrome://extensions/ Enable developer mode, and then Update Extensions Now. That forces a manual update (although the version you're referring to appears to be the latest).
- boffinism 9y agoI nearly missed this bit at the bottom: > Grammarly had fixed the issue and released an update to the Chrome Web Store within a few hours, a really impressive response time. Nice to see a company take this kind of thing appropriately seriously (although of course it should never have happened in the first place).
- AltCtrl 9y agoI was trying to reproduce the bug when I got to that line... nice to see it fixed quickly.
- knute 9y agoIt seems like it would be more fair for the headline to use the past tense.
- nascar_is_bad 9y agoGotta get that HN karma tho
- ghostbrainalpha 9y agoYou are getting down votes because HN has a policy that the HN Title should match the Title on the link to prevent editorializing in almost all cases. This prevents users from creating click bait headlines to get that karma tho, the majority of the time. Cases where the actual title is the click bait like this one, are the unintended consequence of that policy.
- dang 9y agoThat's true, except the guideline reads "Please use the original title, unless it is misleading or linkbait" and you can argue that once a vulnerability is fixed, implying it's still there is misleading. So we often edit those titles to past tense once that's more accurate. Same with "$site is down" -> "$site was down". https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- kuschku 9y agoThis, just like Mozilla’s screenshot addon, and all the other examples, shows why it’s an insane idea to mix addon content with the websites, and why it’s important to make sure that addon content can run on the UI layer of the browser, and not within of the content of the sites. Relying on "best practices" is always a security disaster waiting to happen, if you don’t enforce security and separation in the design of the APIs and languages already, you won’t get security.
- chatmasta 9y agoWouldn’t such a restriction eliminate the main selling point of extensions, which is that they can modify content on the page? The extension permissions API already offers enough restrictions. As a user, I simply do not install extensions that need access to all pages, or I only enable them on pages where I need them.
- kuschku 9y agoExtensions modifying pages is fine, but often an extension wants to show custom UI on top of the page. It’d be much more secure to allow the extension to do that without requiring it to put this into the page. For example, currently you have the DOM of the page, and the extension’s UI is injected into it. It would be preferable if you’d treat each tab as if it was like <tab> <browser src="actualpage"/> <overlay src="extension1"/> </tab> This way an extension that wants to show secure UI on top could do it, and style it, but without it being accessible to the page itself.
- bfred_it 9y agoSome extensions like Google Inbox for Chrome will inject a single `iframe` that points to a `chrome-extension://` page, so while the page might notice the element, it can't access its content. I think you could use the Shadow DOM in closed mode to prevent any information from leaking. [1] [1]: https://blog.revillweb.com/open-vs-closed-shadow-dom-9f3d7427d1af https://blog.revillweb.com/open-vs-closed-shadow-dom-9f3d742...
- ocdtrekkie 9y agoI feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security. Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.
- fiatjaf 9y agoYes, it is crazy. For these cases we shouldn't be using SaaS at all. Installed applications can still be useful, I guess.
- oneweekwonder 9y agoAnything you can recommend that integrates with a browser but runs locally and check grammar and spelling mistakes?
- adjwilli 9y agoA quick Google search and I found https://grammark.org/dist/#/ https://grammark.org/dist/#/ which could be incorporated into a Chrome extension.
- rak 9y agoI put "teh game is a art" into this one and it told me there were no problems with the writing.
- dspillett 9y agoI've not found time to try any of them yet so I can't comment on how they compare to Grammarly, but there are F/OSS alternatives. https://languagetool.org/ https://languagetool.org/ for one supports running your own instance of the server-side portion out-of-the-box. You could run it truly locally assuming your device is appropriate, or your own server which might be more flexible as you can support a greater range of devices and share custom dictionaries between them.
- owurkan 9y agoAlthough as a non-native speaker I find their service very attractive, I've so far refrained from installing their apps/extension. I was never confident enough about how Grammarly would keep safe every word I type (emails,...). This bug is a confirmation I should not trust them or any similar service.
- dazc 9y agoI had the same thought which is why I just navigate direct via the browser when I need it. Otherwise I just rely on standard spell-check.
- superasn 9y agoI tried it and my browsing exeprience was just terrible. It made Chrome so slow that there was a delay in typing and the character appearing. Haven't tried it again.
- pault 9y agoThis was my experience as well. I don't know how anyone is able to use it; it brought my 2017 MacBook pro to its knees every time I would start writing a HN comment. I uninstalled it after about 5 minutes.
- mapcars 9y agoNo issues with speed or anything, chromium, linux.
- wccrawford 9y agoI had no speed issues here, either. Chrome, Windows and OSX. That said, I removed it because the button in the lower right kept getting in the way of things like resizing the textarea.
- klibertp 9y agoWith English being my second language I find Grammarly absolutely essential. I dabbled in creative writing in my native language, was a bit proud of my skill and made it a point to use correct grammar, punctuation, and spelling in all kinds of written communication, even on IMs. To get to this point, I did primarily two things: I read a lot, and I wrote a lot. I then submitted my writing to my peers, similarly interested in creative writing, who would also - in addition to the story, characters and so on - criticise my word choices and my grammar. It took years, but it was enjoyable, and I acquired my second (and last, after programming) skill that could be of some value. A couple of years later, when I started working, I had to switch to English. It wouldn't be that big of a deal were it not for my experiences: every time I had to write anything, I felt incredibly constrained, like I'm missing half of my brain. I was used to being able to express myself precisely, clearly and elegantly in writing - all of that stopped working after the switch. It's incredibly frustrating, to the point that for a few years I was in complete denial and refused to write in English wherever I could get away with it. Well, I thought, I got proficient in Polish, so technically I should be able to get to the same point in English, right? It's easy - I just need to read a lot and have a group of people who'd like to read my writings and correct my mistakes. Easy! ...however, I'm not in high school anymore. Between work and the little social life I have, there's not that much time available for pursuing other matters. I do read a lot, exclusively in English, but these are mostly tech-related articles, blogs, and books, written by people who couldn't care less about beauty and elegance of their writing. It's actually counterproductive if my goal is to get better at writing - such posts are chock-full of both errors and merely weird wordings and constructs. And nobody seems to care. There is a creative writing StackExchange (and many other places), where I could submit my texts to get the criticism and corrections I need. Unfortunately, I don't have the time - even if I had the skill - to do my part of the deal, that is, to read and comment on writings of others. I'd feel bad exploiting strangers like that. As you probably already guessed, this is where Grammarly comes up. It gives me a bit of the feedback I need to improve my writing. It's not at the level of other humans, which is obvious, but it does catch some mistakes and some stylistic problems. It doesn't rely on unpaid work of others, so I have no qualms about using it. I'm not worried about following its advice because even if it's wrong, nobody would care. The amount of contempt for the language in the tech community is staggering; average tech-related writing is on such a level that I'd rather chop my hand off than write like that, but it shows just how unimportant correctness and elegance is for people (as long as it gets the point across... right?) So, to summarize and get back to the topic at hand: Grammarly is non-ideal on so many fronts, that to simply enumerate them would take until Friday (it's Wed today). But it's also the only tool I can rely on, and it does an acceptable job at what it does. It breaks web pages, it's unusable from outside a browser, it's error indicator is frequently displayed 3+ lines from where it should be, it's stupidly dumb and cannot, by itself, tell where the additional "actually" is actually needed, but it's the only help I can get, so I use it. Of course, if your goal is merely communication you do not need anything other than basic spell-checker and a book on basic grammar. On the other hand, if your goals are similar to mine, then Grammarly is one step above that combo. It isn't, and probably won't ever be, anywhere near the level of human reviewers, but it is something. PS. For a long time, I wanted a feature in Grammarly that would automatically slurp content of blog posts and articles in, so that I can just click a couple of times and then read the post without all the mistakes and weirdness people so often put in there. Reading the top-voted comment here, about the license, I see why they won't implement it. Similarly, I guess Emacs plugin is not going to emerge anytime soon. Whatever you use Grammarly for, you should assume it's public. It doesn't make it any less usefull for writing comments on some sites or posts for my blog, though.
- watertom 9y agoI blocked Grammarly at my last company, nothing like giving a company tracking access to everything you type or read, and their EULA gives them the rights to everything they track. Using Grammarly is stupid, paying them is downright insane.
- ocdtrekkie 9y agoWe block extensions, period, on Google Chrome, as it prevents most malware outright. But then we've also discovered Grammarly's Microsoft Office plugin installs to the user folder (without requiring admin rights) as well. I've made a request to our antivirus vendor to add detection and blocking of Grammarly specifically, for the moment we're detecting it a different way.
- stryk 9y agoMay I ask how you're detecting it? If you can't say [or don't want to] for whatever reason that's fine, I'm merely curious is all.
- ocdtrekkie 9y agoWe have a couple different layers we can work with here, both on the computers and the network.
- rwx------ 9y agoI never felt comfortable using SaaS for checking the grammatical mistakes. If you are linux user then "the language tool" is your best option. https://languagetool.org/ https://languagetool.org/ you can download it and run it as stand alone application
- qubitcoder 9y agoThanks for this suggestion. Unfortunately, LanguageTool failed to catch some basic errors, like subject-verb agreement. E.g. I'll close the ticket once the item have been completed.
- marijn 9y agoAnother nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".
- mariushop 9y agoSpot on, had a similar problem on an web editor I work on.
- LocalPCGuy 9y agoIt was also breaking sites built on JS frameworks like Angular and Ember (probably others, those are the two I saw specifically) where the framework expects to be controlling the DOM (and Grammarly was messing with things causing out of context changes that the frameworks didn't expect)
- Zelphyr 9y agoNot to mention, because of the placement of their hover in the bottom-right its next to impossible to resize a textarea with their plugin installed.
- k_sh 9y agoYep. I recently had a client that kept having layout problems with an email template I had written for him, after he had edited the content in WYSIWYG. Turns out Grammarly was injecting HTML into the editor, which in turn was being included in the email body!
- btown 9y agoAs a web developer, setAttribute('data-gramm', 'false') is your friend. For better or for worse, between browser extensions loaded by the end user, and "tags" injected by your well-meaning business analytics team - see my comment here: https://news.ycombinator.com/item?id=16314501 https://news.ycombinator.com/item?id=16314501 ), the extension ecosystem has become the new Internet Explorer in terms of compatibility testing. Luckily most of the workarounds are trivial, but it's essential to have good QA on actual client machines if you're doing, well, anything at all.
- jordache 9y agogarmmarly perhaps ranks up there amongst the most annoying startup names.
- deleted 9y ago[deleted]
- tomswartz07 9y agoI have no idea if it's still an issue, but ~1.5 years ago, I was sorting through my email, and discovered that a small plain text message was taking up >3MB in my inbox. I dug in a bit, and it turns out that Grammarly was embedding a gigantic amount of code into the email messages in the form of stylesheets and other things. Needless to say, after raising it up the chain, we had the extension blocked company-wide.
- nijaru 9y agoI uninstalled it a couple of years ago when I realized it was doubling the load times for every single page I visited. That embedded code is probably why.
- djsumdog 9y agoAre there any good open source grammar checkers for English? Spanish? German? I recently loaded Wordperfect for Win3.1 into a Win3.1+Dosbox instance because I remember it's grammar checker back in the 90s was far superior to what's built into MS Word today. I've been meaning to test it out and do a comparison blog post.
- ivanfon 9y agoThere’s LanguageTool, a wonderful open-source tool. I’ve only used it for English, but it supports a lot of languages. There’s also addons for a lot of editors. https://languagetool.org/ https://languagetool.org/
- _pmf_ 9y agoThat's almost as pathetic as their "Lily the Social Media Manager" ad.
- peterhadlaw 9y agoKind of tangential, but does anyone else worry that systems like these will start to dictate what is "correct" language. Basically pushing narratives subtly through "correcting" totally acceptable speech.
- draw_down 9y agoOh my god, come on.
- Jesus_Jones 9y agoIt's an old worry. For years people have complained about microsoft word's hegemonic recommendations. I've read articles where 'real writers' had to turn off the recommendations, it was messing them up. Today we have less of a world wide leader (would google's algorithms be number one?), so there's less chance of one thing winning.
- ggg9990 9y agoMost people with any writing capability do not use these tools. They are for foreign speakers of English or extremely poorly educated native speakers, they only affect the bottom 50% of written content which is not what affects the development of language.
- klibertp 9y agoUm, I just wrote a lengthy comment about how this is not exactly the case: https://news.ycombinator.com/item?id=16322795 https://news.ycombinator.com/item?id=16322795 It's only mentioned in the comment, but the amount of mistakes in tech-related writing, by native English speakers and otherwise, is gargantuan and overwhelming, and I'd wish using something like Grammarly (if safe, open source and so on) was a requirement for putting your writing on the web. As it is, the quality of writing is so bad, that I (as a foreign speaker) don't improve my English in any way by reading it, and I have to be very careful not to repeat these mistakes in my own writing later.
- alishan 9y agoHow did they fix it?
- mkagenius 9y agoShould wait to see if data was compromised, they can fixed the extension though.
- scosman 9y agoWhat's the etiquette for disclosure timeline on something like this? It feels like 99.9999% of end users won't see this public disclosure, and waiting enough time for auto-updates to be applied would be ideal. Public disclosure as soon as the patch is available lets bad actors know about it while the vast majority of users are still vulnerable.
- tedivm 9y agoProject Zero is very aggressive about releasing exploit details as soon as a patch is available- they don't wait for users to actually have a chance to upgrade. This caused some drama when they were releasing vulnerabilities to password managers.
- jwilk 9y agoIn the free software world, full disclosure when the fixed version is available is a normal practice. Partial diclosures are rather frowned upon.
- tetha 9y agoThe bad actors pay people to find these issues. It's prudent to assume that blackhats know about this already anyway. Thus, it's beneficial to push fixes asap in order to minimize the window for the blackhats. It's a choice between visible pain and invisible weakness. The early disclosure hurts and amplifies the issue. However, the malicious actors you need to worry about would be glad for every day without disclosure, because every day without disclosure is profit to them.
- bertolo1988 9y agoI don't want to be mean or anything... but how retarded do you have to be to jeopardize users expectations like this? This is outrageous. > Grammarly had fixed the issue and released an update to the Chrome Web Store within a few hours, a really impressive response time. Oh my god. Impressive is your insane lack of competence and responsability.
- xg15 9y agoI think Chrome's (and now Firefox') awkward extension sandboxing is partially to blame, though. When you add an extension page script, you get access to a page's DOM, but you're completely isolated from the page's own JS: You get your own JS context and window object without any modifications the page may have done to it. That's usually reasonable as a page can mess with the built-in methods of its context, so if an extension were to rely on them, the risk of privilege escalation attacks would be really high. Except sometimes an extension does want to interact with the page JS, (e.g. for accessing data the page only keeps in JS objects but not in the DOM.) As far as I know, there is no safe way to do this in Chrome. The recommended (!) way is to inject a script element into the DOM and exchange data with the page script via some makeshift communication channel, e.g. postMessaging yourself. This will of course drop you right back into the hall-of-mirrors of potentially manipulated builtins that the page script isolation was trying to keep you out of. But apparently now it's ok if you have to deal with that by yourself. From the looks of it, it seems Grammarly tried to open exactly that kind of communication channel and didn't correctly secure it.
- bzbarsky 9y ago> I think Chrome's (and now Firefox') Chrome and Firefox have _very_ different behaviors here. In Chrome, there is no way at all to get hold of the page's JS objects. In Firefox, the default behavior is that you don't interact with them, but you can explicitly ask for them and once you have them you can work with them. Depending on what you do with them, you may or may not be creating security bugs, of course. Critically, in Firefox you can have your separate clean builtins _and_ be interacting with actual page JS objects at the same time. There are arguments for and against both models, of course.
- AgentME 9y agoThere's no reason to send the grammarly auth token into the page's javascript context to begin with. The ajax connections can be done with the auth token in the extension's protected content script context.
- szbelieves 9y agoIts not surprising what so ever, where's that ad money coming from? Must be shady practices.
- evan_ 9y agoThey sell a “pro version” with extra features.
- sriramkarnati 9y agoEvery website now holds Grammarly token ;)
- yeukhon 9y agoI am waiting for the typical "CEO of Grammarly here. I will answer any questions you may have" comment, but I guess not.
- chipperyman573 9y agoNot everyone reads hackernews
- shervinafshar 9y agoI'm sure someone at that company does.
- alanh 9y agoSo… I of course had no specific idea about this, but in 2014(?) I declined recruiting pursuits from Grammarly after realizing that their developers were almost entirely managed from another hemisphere. It sounded like a very top-down, low-collaboration, anti-engineer environment. I am not at all surprised that major issues like this can and would occur in such an environment.
- shervinafshar 9y agoLast year I signed up for a paid subscription to Grammarly...then I read terms of use[1]. I know...it should have been the other way around, but here it goes: > "By uploading or entering any User Content, you give Grammarly (and those it works with) a nonexclusive, worldwide, royalty-free and fully-paid, transferable and sublicensable, perpetual, and irrevocable license to copy, store and use your User Content in connection with the provision of the Software and the Services and to improve the algorithms underlying the Software and the Services." First I thought that may be this is just me being paranoid. So I compared their terms of service with Evernote's[2] and summarize the differences for them in the support ticket asking termination of my account. I reproduce that here for reference: > In Evernote's TOS > – It's clearly noted that the user retains their Copyright to the content; > – and the license to Evernote is a limited and they don't "obtain any right, title or > interest" other than they point out; > – they don't require sublicensable and transferable rights to User Content which is different than having the rights to share the content with other contractual partners (which they require); > – the agreement on content is irrevocable as long as the content is stored on the service. [1]: https://www.grammarly.com/terms https://www.grammarly.com/terms [2]: https://evernote.com/legal/tos.php https://evernote.com/legal/tos.php Edit: Formatting.
- stefanchrobot 9y agoThanks! Uninstalled straight away. I think the TOS issue is more important than the security one.
- enknamel 9y agoIs the grammarly ToS more than a CYA? I think they may do it that way to protect themselves from being sued after retaining your work. But I don't like the possibility of them owning your work.
- shervinafshar 9y agoI agree that like many of such documents, it is CYA indeed. I don't mind CYA, but this is just sloppy encroaching legalese gobbledygook.
- joemag 9y agoBetween this disclosure and grammarly.com, I've been trying to understand how Gramarly works, and therefore understand the impact of this event. Let me know if i got this right: 1) Grammarly is a fancy grammar/spelling correction tool. 2) You use it by opening an account, and installing their browder extension. 3) As you type text into a web page, the extension sends that input back to Grammarly, where their software analyzes it and provides correction recommendations. 4) The text that was sent back is persisted under your account, and is available for retrieval. 5) A software bug in their extension allowed a script on any site to see your Grammarly auth token. 6) As the result, any malicious site could log into your account, and see what you've been typing. Is that the rough gist of it? If yes, then how in the world does #4 make any sense? Why store and expose that data, knowing that it's likely to contain troves and troves of sensitive and PII information...
- Sephr 9y agobit.ly had a similar vulnerability that I detected in 2008 through their bookmarklet. Unfortunately it seems I lost my exploit PoC. https://eligrey.com/blog/bitly-vulnerabilities/ https://eligrey.com/blog/bitly-vulnerabilities/
- blackRust 9y agoIt doesn't say anything about token rotation and lifetime. Is there any information directly from Grammarly? How long are those tokens valid for? Did they invalidate all existing tokens?
- pvdebbe 9y agoThe day I heard about Grammarly (saw a Youtube ad). Free to use, I thought to myself, this surely monetizes by analysing all my input in their servers, wherever they are. It looks like a good product. If they offered a true offline version for desktop with 4+ updates a year, I could see myself paying for it.