[HN Gopher] Google, Microsoft can get your passwords via web bro...
       ___________________________________________________________________
        
       Google, Microsoft can get your passwords via web browser's
       spellcheck
        
       Author : SN76477
       Score  : 29 points
       Date   : 2022-09-17 19:23 UTC (3 hours ago)
        
 (HTM) web link (www.bleepingcomputer.com)
 (TXT) w3m dump (www.bleepingcomputer.com)
        
       | enviclash wrote:
       | I find this outrageous. It also applies to the text of all of my
       | employer' emails (at least those managed in the mentioned web
       | browser), according to a prompt (with no option to reject, IIRC)
       | I read the other day.
       | 
       | Edit: sorry I should have captured that prompt! I am not able to
       | remember what it said, it might have been from the company rather
       | than the browser.
        
         | cmeacham98 wrote:
         | > It also applies to the text of all of my employer' emails
         | 
         | Yeah I'm going to need a source on that one, as far as I know
         | spellcheck only sends individual words not entire emails.
        
           | enviclash wrote:
           | Thanks for improving my knowledge on how spellcheck works.
           | Still, should I assume that a list of words cannot be kept?
           | It sound to me like a naive assumption in the current
           | landscape.
        
             | smileybarry wrote:
             | That's the Standard spell checker. The Extended spell
             | checker -- optional and tells you it sends text to
             | Google/Microsoft -- is the one mentioned here.
             | 
             | You can just switch to the normal spell checker which is
             | entirely offline and works off a word list.
        
       | [deleted]
        
       | t-writescode wrote:
       | This is why I argue that TikTok is meaningfully no worse than
       | Facebook, Google or Microsoft. They're all collecting basically
       | everything you put into them, keyloggers and all.
       | 
       | You can't just single out one because it's from China, imo.
        
       | wildrhythms wrote:
       | From the article:
       | 
       | >The 'spellcheck' HTML attribute when left out from form text
       | input fields is usually assumed by web browsers be true by
       | default.
       | 
       |  _Text_ inputs. So what about inputs of password type?
       | 
       | MDN says this:
       | 
       | >If [the spellcheck attribute] is not set, its default value is
       | element-type and browser-defined. This default value may also be
       | inherited, which means that the element content will be checked
       | for spelling errors only if its nearest ancestor has a spellcheck
       | state of true.
       | 
       | https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att...
       | 
       | So do browsers apply spellcheck="true" by implicit default to
       | inputs with type of password?
        
       ___________________________________________________________________
       (page generated 2022-09-17 23:02 UTC)