Leaving Spellcheck Enabled Is a Privacy Risk (2016) | Hacker News Reader

Leaving Spellcheck Enabled Is a Privacy Risk (2016)

github.com

107 pointsbehnamoh39 comments

The conspiracy theorist in me thinks that Google deliberately makes Chrome's offline spell check be as poor as possible, to give people incentive to give all text to them under the guise of spellchecking. It seems like every day or so, there will be some common word that is marked as misspelled, usually a plural or possessive form of a word that is in their spellcheck dictionary.

The developer in me thinks that this is because nobody at Google cares about the experience if the user chooses incrementally slightly more privacy, and so it simply gets no attention.

Title of submission should be: 'Leaving spellcheck Enabled On Chrome Is a Privacy Risk'.

In the spirit of trying to do constructive discussion, the original post references the long dead Signal Chrome app. The new desktop garbage they push is a Node.js app called Signal Desktop. They use native spellchecking provided by Node and Hunspell (even on Windows, which could use native windows API available for 8 and newer and which probably is privacy violating)

To the best of my knowledge, Hunspell is privacy conscious software.

EDIT: Additional context, https://github.com/electron-userland/electron-spellchecker also confirms it only uses Hunspell on windows.

Thank you this will help anyone with paranoia of being watched.

What about things like spotlight? If I work in healthcare and I search for "Jane Doe medical records.txt" does part or all of that search end up hitting a webservice somewhere?

You can use an SSL proxy/snooper to find out. I use Charles to see what is actually happening at that level, you would be surprised (or not) at how much stuff is sent to third parties.

https://www.charlesproxy.com/

That used to be straight forward, but now most of the apps come with certificate pinning and for seeing through network request, toying with tools Frida are now needed.

Is there anything that can be done with a non jailbroken iPhone to circumvent certificate pinning? I'm reading[0] that Frida can work "if you can include Frida’s libraries in the app - either via debugging an app you own, or repackaging someone else’s app and injecting the dylib."

Is repackaging/injecting hard to do?

Thanks!

[0] https://andydavies.me/blog/2019/12/12/capturing-and-decrypti...

Can certificate pinning be defeated?

It's not something I'd expect your average user to be able to do, but it is possible and is regularly done for various reverse engineering purposes. The approach I've seen involve changing what certificate is pinned to one that is locally controlled.

That being said I don't think it's nearly as common for certificate pinning to be present as people think- in fact it was deprecated in 2017 because it caused so many problems. Instead things like HSTS and transparency logs are used to prevent damage from malicious issuance of certificates, and organizations can typically override things with their own CA.

If your software is pinned to a specific certificate (even if that certificate is a root CA) your software won't work in many corporate environments. One of the exact reasons mentioned- medical data- is a big driver in this. My company has APIs used by medical companies, and they have to whitelist our service in their firewalls because many of them MITM all traffic to ensure that PHI isn't sent out over an unapproved service by mistake.

> in fact it was deprecated in 2017 because it caused so many problems. Instead things like HSTS and transparency logs are used to prevent damage from malicious issuance of certificates, and organizations can typically override things with their own CA.

Still kinda salty that pinning was deprecated from HTTPS. It wasn't perfect (accidental/malicious pinning was far too easy seeing how it was merely controlled by an HTTP header), but the current alternatives (Certificate Transparency, CAA DNS records) aren't an adequate replacement. Sure Certificate Transparency helps to detect a misused certificate, but it doesn't actively prevent it from being used, and CAA requires that the CA isn't "lying" about the header through a "bug" or otherwise.

It is kind of "hilarious" that enterprises are defeating the ability of a client to prevent a MiTM eavesdropper on the net, for the sake of ensuring privacy of transmitted data.

Interesting. I wonder if Little Snitch can do this (I bought it a while back)

By default on iOS every single search in the app search pane hits the web, character by character.

That and iCloud Backup are the first two things I disable on a vanilla iOS.

Fun fact. iCloud backup "conveniently" records all phone history (calls, text messages). And maybe the authorities cannot get into your phone (debatable) but Apple always gives them your backups (warrant+gag order). And that includes ALL call logs and ALL your SMS and iMessages.

I'm not condoning Apple's decision to not perform end-to-end encryption on iCloud backups, but they would be pretty useless if they didn't include call logs and text messages. If I lose my phone and restore from a backup on a new one, I want my old text messages as much as any other piece of data.

Google, not that I typically support things they do, found a way to do both:

https://support.google.com/googleone/answer/9149304?co=GENIE...

As far as I know, appleid's have some kind of password/authentication system that could be used to encrypt backups.

It doesn't say it stores text messages? It says it stores text messages on Android which means they are not backed up.

It also says you use Android messenger which hooks up to Google's services.

The text messages have to be stored somewhere.

What text are you reading? https://support.google.com/googleone/answer/9149304?co=GENIE... says

  What gets saved by Android
  
  The following data is backed up in your Android settings. You don't need to turn on Google One's backup to save this data.
  
  App data
  Call history
  Contacts
  Settings
  SMS messages

Note, "by Android", not "on Android" as you claim.

It's certainly technically possible for Apple to encrypt iCloud backups the same way that they do with Keychain and iMessage (when backups are disabled).

How did our parents thrive without permanent records of all their personal phone conversations?

>and iMessages

Not if you don't have iMessage enabled in iCloud settings.

If the Snowden slides about PRISM are to be believed (and we don't have any reason to doubt their credibility), then ever since October 2012, your iCloud data (device backups, email, message history, photos, notes, et c) are available for download by the US military intelligence community directly from Apple servers, with no warrant required (rubber stamp secret police FISA "court" orders are not warrants and they have no oversight).

Apple has, of course, denied this:

“We have never heard of PRISM,” said Apple spokesperson Steve Dowling in a statement. “We do not provide any government agency with direct access to our servers, and any government agency requesting customer data must get a court order.”

Shortly thereafter, the heads of many of the affected companies met with Obama at the white house to coordinate their next steps at counteracting the damage. The initial cover story was that they were meeting to discuss the healthcare.gov disaster, but it turned out that the meeting was actually about the NSA's comprehensive illegal spying programs being disclosed.

https://www.nytimes.com/2013/12/18/us/politics/as-tech-indus...

Reuters reported in January of 2020 that an ex-Apple employee told them that Apple Legal scrapped a 2018-2020 project to do clientside end-to-end encryption of the iCloud device backups (which would render this collection useless) as a result of pressure from the US government.

"That person told Reuters the company did not want to risk being attacked by public officials for protecting criminals, sued for moving previously accessible data out of reach of government agencies or used as an excuse for new legislation against encryption."

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

Non-e2e-encrypted iCloud Backups are on by default for every single iOS device if it is set up with an Apple ID.

Please do not believe the Apple marketing narrative about individual privacy.

What does oversight mean? If FISA warrants were reviewed by a second judge, would that not also be a "rubber stamp"?

Checks and balances by a theoretically adversarial party to ensure no misuse/abuse of the system, much like what a judge is supposed to do in the case of issuing a traditional search/seizure warrant.

It seems like you're aware that the FISA court just rubber stamps everything, so resultantly it might as well just not exist because it's simply a farce to make it seem legitimate by invoking the term "court". You're right in pointing out that a second FISA "court" judge would not make any difference.

Ultimately though, even oversight would not solve the problem of the fact that they should just be getting warrants for doing police surveillance in the first place. The bar to getting a federal judge to sign off on any technical mumbo jumbo ("IP address this, ISP that") is hilariously bad/low and they amount pretty much to rubber stamps already. The mind reels when you think that they set up a special fake court simply to avoid that.

I haven't done a lot of iCloud recoveries, but regular backups have passwords by default.

On macos every help search is the same. (haven't checked catalina)

By default, yes.

I don't believe Signal Desktop runs as a Chrome app anymore, can anyone confirm?

That’s correct.

Just an FYI, you can run it in Linux on Chromebook:

https://support.google.com/chrome/a/answer/9025903?hl=en

The title ought to include "in Signal", or more generally, "in apps that use online dictionaries". I always disable that. And it's easy to check; just test with no uplink.

Also, misspelling is a profiling risk.

AFAIK leaving the text translation feature enabled (even if you disable for a particular language) is even more of a risk.

Text translation in Chrome doesn't send anything to Google servers unless you actually translate a page.

It detects what language the page is written in with an entirely client side model (which is why it's accuracy is poor).

Is this a chrome/electron only issue, or is it OS level as well? What about Firefox?

Chrome issue, you can disable it in the settings page.

(2016)

Have any of the relevant issues changed since 2016?

For one, Chrome Apps for non-ChromeOS aren't a thing anymore.

Also, it's customary to add that notice on HN regardless of how timeless the content is.

Yes, of course the year is always there if it's not this year.

What I mean is to that this same insecurity principle could apply to other situations.

Reply on news.ycombinator.com