Google, Microsoft can get your passwords via web browser's spellcheck

Started by Corrine, September 18, 2022, 02:09:12 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Corrine

From Bleeping Compute at Google, Microsoft can get your passwords via web browser's spellcheck:

QuoteExtended spellcheck features in Google Chrome and Microsoft Edge web browsers transmit form data, including personally identifiable information (PII) and in some cases, passwords, to Google and Microsoft respectively.

While this may be a known and intended feature of these web browsers, it does raise concerns about what happens to the data after transmission and how safe the practice might be, particularly when it comes to password fields.

Both Chrome and Edge ship with basic spellcheckers enabled. But, features like Chrome's Enhanced Spellcheck or Microsoft Editor when manually enabled by the user, exhibit this potential privacy risk.

See the referenced article for additional information.


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

plodr

Since you can turn off enhanced spellcheck, go into Chrome and Edge and type or paste this into the address bar
chrome://settings/?search=Enhanced+Spell+CheckBe sure to turn it OFF!!!

I just checked Brave (you can never be too safe) to be sure it doesn't have this "feature". Phew, it doesn't.
Chugging coffee and computing!

v_v

Thank you Corrine and plodr for the very interesting and helpful information.  I do not use Google Chrome so thankfully I was immune for that one.  However I do use Microsoft Edge and sure enough the "Microsoft Editor" version of enhanced spell check was activated.  This is not something that I chose or "manually enabled".  Indeed I did not even know that it existed until now.  Apparently Microsoft on its own decided that this feature should be activated by default.  So I clicked on "Basic" to deactivate the enhanced feature.  Plodr's link works for this, but if you want to search for it, it is in the browser "Settings" under "Languages".

While doing this I also decided to check the numerous other Chromium-based browsers that I use and I can report that NONE of the following have this feature:

Brave ; Iridium ; Iron ; Opera ; Slimjet ; Vivaldi ; Epic.

So if you are using any of the preceding browsers you should be in the clear for this particular issue.

v_v
Justice, Equity, and Meaningful, Productive, and Fulfilling Lives to All Earthlings

v_v

Upon further study of the article referred to in Corrine's link the article mentions that the Microsoft Editor is an extension or "Edge Add-on".  However when one goes to "Manage extensions" in Edge, "Microsoft Editor" is not listed as an extension, even when it is activated.  At least in my current version of Edge (105.0.1343.42) it appears to be a standard feature of the browser that, as I said in my previous post, Microsoft has unilaterally decided will be activated by default.  So I can only guess that the feature was added in some previous Edge browser update.

Further research has essentially confirmed my last sentence.  Apparently Microsoft began experimenting and distributing this feature as a standard part of the browser back around October 6, 2021.  And again based on my experience it appears to be activated by default.  So be forewarned.

v_v
Justice, Equity, and Meaningful, Productive, and Fulfilling Lives to All Earthlings

plodr

Thanks for looking into this closer v_v.
I hate when companies decide what I need and then turn it on without warning me.

Fewer features usually means less things to be compromised so I prefer programs as simple and "Feature-less" as possible.
Chugging coffee and computing!