4 ms·

Google, Microsoft can get your passwords via web browser's spellcheck

66 points by SN76477 4y ago

deleted 4y ago
[deleted]
enviclash 4y ago
I find this outrageous. It also applies to the text of all of my employer' emails (at least those managed in the mentioned web browser), according to a prompt (with no option to reject, IIRC) I read the other day. Edit: sorry I should have captured that prompt! I am not able to remember what it said, it might have been from the company rather than the browser.
- cmeacham98 4y ago
  > It also applies to the text of all of my employer' emails Yeah I'm going to need a source on that one, as far as I know spellcheck only sends individual words not entire emails.
  - enviclash 4y ago
    Thanks for improving my knowledge on how spellcheck works. Still, should I assume that a list of words cannot be kept? It sound to me like a naive assumption in the current landscape.
    - smileybarry 4y ago
      That’s the Standard spell checker. The Extended spell checker — optional and tells you it sends text to Google/Microsoft — is the one mentioned here. You can just switch to the normal spell checker which is entirely offline and works off a word list.
t-writescode 4y ago
This is why I argue that TikTok is meaningfully no worse than Facebook, Google or Microsoft. They’re all collecting basically everything you put into them, keyloggers and all. You can’t just single out one because it’s from China, imo.
- mackatap 4y ago
  But tiktok does much more than that. They collect the name of every document on your phone and every app that you have installed.
  - protonbob 4y ago
    Wow that is crazy. Do you have a source for that for me to share by the way?
    - upwardbound 4y ago
      Go to their Privacy Policy page: https://www.tiktok.com/legal/privacy-policy-us?lang=en https://www.tiktok.com/legal/privacy-policy-us?lang=en Click on "What information do we collect?" Scroll down to the section "Information we collect automatically " and the sub-section "Device Information". This is what it says: Device Information We collect certain information about the device you use to access the Platform, such as your IP address, user agent, mobile carrier, time zone settings, identifiers for advertising purposes, model of your device, the device system, network type, device IDs, your screen resolution and operating system, app and file names and types, keystroke patterns or rhythms, battery state, audio settings and connected audio devices. Where you log-in from multiple devices, we will be able to use your profile information to identify your activity across devices. We may also associate you with information collected from devices other than those you use to log-in to the Platform. One of the listed items is "app and file names".
  - t-writescode 4y ago
    They must be using exploits for that, then, since iPhone lets me know and control all my sensitive information like pictures, contacts, camera, etc!
wildrhythms 4y ago
From the article: >The 'spellcheck' HTML attribute when left out from form text input fields is usually assumed by web browsers be true by default. Text inputs. So what about inputs of password type? MDN says this: >If [the spellcheck attribute] is not set, its default value is element-type and browser-defined. This default value may also be inherited, which means that the element content will be checked for spelling errors only if its nearest ancestor has a spellcheck state of true. https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/spellcheck https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att... So do browsers apply spellcheck="true" by implicit default to inputs with type of password?
- gausswho 4y ago
  'This attribute is merely a hint for the browser.' Browser can do what it wants with your inputs.
  - thfuran 4y ago
    Well, sure. A browser obviously can do whatever with the inputs you give it. But what do they actually do?
caprock 4y ago
Is this also true for Grammarly?
- dixie_land 4y ago
  All of the companies I've personally worked at ban Grammarly for that reason. Some enforce it better (managed policies) than others (a wiki page no one bothers to check)
  - adultSwim 4y ago
    Huge issue for CoPilot too.
blondin 4y ago
can we assume that the problem only happens when actually typing and not if you pasted sensitive text in the fields?
haburka 4y ago
Worthless clickbait - both of these processes that send to external servers are opt in and very clear that it is doing what it’s doing. Also, no big company would intentionally try to store and use your passwords against you. They have no incentive to do this. This is security theater.
3qz 4y ago
This is also sending your credit card information btw

66 points by SN76477 4y ago

deleted 4y ago

[deleted]

I find this outrageous. It also applies to the text of all of my employer' emails (at least those managed in the mentioned web browser), according to a prompt (with no option to reject, IIRC) I read the other day. Edit: sorry I should have captured that prompt! I am not able to remember what it said, it might have been from the company rather than the browser.

cmeacham98 4y ago
> It also applies to the text of all of my employer' emails Yeah I'm going to need a source on that one, as far as I know spellcheck only sends individual words not entire emails.
- enviclash 4y ago
  Thanks for improving my knowledge on how spellcheck works. Still, should I assume that a list of words cannot be kept? It sound to me like a naive assumption in the current landscape.
  - smileybarry 4y ago
    That’s the Standard spell checker. The Extended spell checker — optional and tells you it sends text to Google/Microsoft — is the one mentioned here. You can just switch to the normal spell checker which is entirely offline and works off a word list.

t-writescode 4y ago

This is why I argue that TikTok is meaningfully no worse than Facebook, Google or Microsoft. They’re all collecting basically everything you put into them, keyloggers and all. You can’t just single out one because it’s from China, imo.

mackatap 4y ago
But tiktok does much more than that. They collect the name of every document on your phone and every app that you have installed.
- protonbob 4y ago
  Wow that is crazy. Do you have a source for that for me to share by the way?
  - upwardbound 4y ago
    Go to their Privacy Policy page: https://www.tiktok.com/legal/privacy-policy-us?lang=en https://www.tiktok.com/legal/privacy-policy-us?lang=en Click on "What information do we collect?" Scroll down to the section "Information we collect automatically " and the sub-section "Device Information". This is what it says: Device Information We collect certain information about the device you use to access the Platform, such as your IP address, user agent, mobile carrier, time zone settings, identifiers for advertising purposes, model of your device, the device system, network type, device IDs, your screen resolution and operating system, app and file names and types, keystroke patterns or rhythms, battery state, audio settings and connected audio devices. Where you log-in from multiple devices, we will be able to use your profile information to identify your activity across devices. We may also associate you with information collected from devices other than those you use to log-in to the Platform. One of the listed items is "app and file names".
- t-writescode 4y ago
  They must be using exploits for that, then, since iPhone lets me know and control all my sensitive information like pictures, contacts, camera, etc!

wildrhythms 4y ago

From the article: >The 'spellcheck' HTML attribute when left out from form text input fields is usually assumed by web browsers be true by default. Text inputs. So what about inputs of password type? MDN says this: >If [the spellcheck attribute] is not set, its default value is element-type and browser-defined. This default value may also be inherited, which means that the element content will be checked for spelling errors only if its nearest ancestor has a spellcheck state of true. https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/spellcheck https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att... So do browsers apply spellcheck="true" by implicit default to inputs with type of password?

gausswho 4y ago
'This attribute is merely a hint for the browser.' Browser can do what it wants with your inputs.
- thfuran 4y ago
  Well, sure. A browser obviously can do whatever with the inputs you give it. But what do they actually do?

caprock 4y ago

Is this also true for Grammarly?

dixie_land 4y ago
All of the companies I've personally worked at ban Grammarly for that reason. Some enforce it better (managed policies) than others (a wiki page no one bothers to check)
- adultSwim 4y ago
  Huge issue for CoPilot too.

blondin 4y ago

can we assume that the problem only happens when actually typing and not if you pasted sensitive text in the fields?

haburka 4y ago

Worthless clickbait - both of these processes that send to external servers are opt in and very clear that it is doing what it’s doing. Also, no big company would intentionally try to store and use your passwords against you. They have no incentive to do this. This is security theater.

3qz 4y ago

This is also sending your credit card information btw