Comment by geocrasher
5 years ago
Years ago I worked at a company where many people were using Grammarly. One of the top devs took a look at it, and saw that the text was sent to Grammarly's server unencrypted and warned everyone not to use it. Some still did.
At my previous engagement, a large number of staff spoke English as a second or third language, and Grammarly was prevalent. Even as a native English speaker, they wanted me to use it as a sort of proof reader. I'll admit that it caught some of my dumber mistakes, but I never felt comfortable using it. I could have proof-read my work better is all. Perhaps if I wasn't given mind-numbing work, the quality would have been better.
My previous role was at a public facing ecommerce site. One day I started noticing a lot of public traffic to internal administrative endpoints that were failing - likely bots, but also to URLs that bots would have never known existed. Urls that only someone internal to the company would even know existed, due to the complex way they were crafted. It was very concerning.
We spent a LOT of time tracking down, and finally realized that the "bot" traffic was coming about 30 minutes after one of our employees legitimated visited the site. We found that user was using grammarly. Once we deactivated grammarly, all of the bot traffic stopped.
As best as I could tell, every URL that particular person went to in their browsers, grammarly had a service about 30 minutes later that would try and hit the url directly and ascertain what was there.
Haven't been on the crusade against it ever since.
Did something like grammarly attempt to correct your post here?
>Haven't been on the crusade against it ever since.
You have been or you haven't been? It sounds like a contradictory statement from the rest of your comment.
Because of the proven URL visiting bot, they don't have to. Everyone understands it's not an idle threat that Grammarly snoops on everything you write.
Why is Grammarly keeping track of the urls you visit when it has nothing to do with checking your grammar?
Are you writing blog posts or message board comments? Are you on social media? Writing to one person or many? Are you writing for financial, health, tourist industries, or for your academic qualifications? To entertain, persuade or inform? A screenshot of the page can be reviewed and classified later.
All to improve the service, of course. You know, what they say in the privacy policy.
(Note: I have no insider information)
We can only speculate but I notice Grammarly has a feature for plagiarism detection[0].
> Ensure your work is fresh and original by checking it against 16 billion web pages.
How do they know what text is on 16B web pages? Presumably they have a web crawler of some sort.
[0] https://www.grammarly.com/plans
3 replies →
I mostly wonder how? Is it an extension or program? I thought it was just a website where you can paste in a text-box for proof reading, and that sort of website shouldn't be able to track you everywhere afterwards, right?
1 reply →
Perhaps another site that person visited frequently was stealing their Grammarly auth token with this bug? https://bugs.chromium.org/p/project-zero/issues/detail?id=15...
> "Haven't been on the crusade against it ever since."
haven't -> have, right?
I believe they mean that the abuse was so blatantly obvious that they didn't have to argue the case anymore.
> wanted me to use it as a sort of proof reader.
I can't imagine working in a place like this. I often write with some unusual but perfectly valid grammar constructions that are a result of being well read. Running what I've written, the codification of my thoughts, through a statistical homogenization machine is dystopian in a way I had never imagined. What kind of business was it?
Imagine running famous writers through this thing, even if they're just journalists. Gross. I'm gonna run Moby Dick through Grammarly later and see what it has to say.
While I don't use Grammarly, this doesn't strike me as a very fair description of what grammar checkers are meant to do. Just like spellcheckers, they only make the changes you let them make. If you blindly accept every suggestion they make, then yes, I suppose you're running your text "through a statistical homogenization machine," but that's even more foolish than blindly accepting every suggestion a spellchecker makes.
I do use a "grammar and style check" built into Ulysses fairly frequently, even on fiction. This is a server-side service like Grammarly, but without the keylogging-ish aspects. (It only works in Ulysses, and you have to explicitly go into "revision mode" and click the "Check Text" button.) And, sure, it's optimized for business writing and is going to make a lot of dumb suggestions. But not all the suggestions are dumb; it really does catch genuine mistakes and even make style suggestions worth considering (e.g., "the phrase here is so overused it's in our database as an overused phrase, so are you sure you want to use it"). And, of course, sometimes I really am writing something for business, and some of the suggestions that are superfluous in creative writing might actually be useful.
I don't like Grammarly's approach explicitly because of the "send everything to Grammarly in the background", but I think people write off style checkers as pointless a little too quickly. Even the stupidest grammar checker, like the one built into macOS (sorry, Apple), will catch things like inadvertently doubled words, which is something I'm prone to do when I pause in the middle of writing a sentence to collect my thoughts.
> I do use a "grammar and style check" built into Ulysses fairly frequently,
I parsed this sentence as you running Grammarly on the novel by James Joyce, which would be an interesting experiment given that Joyce deliberately changes his style and grammar to mimic famous authors of the day, sometimes mid-sentence.
1 reply →
> I often write with some unusual but perfectly valid grammar constructions that are a result of being well read.
That's lovely for you. It sounds like you're very clever. However, most writing in the workplace is intended to communicate concrete ideas, and benefits more from clarity than cleverness.
That doesn't have to mean, and in fact should NOT mean, bland.
9 replies →
I hear clever and I think of the scene from Fight Club. Clever is not something good.
https://m.youtube.com/watch?v=PXcEPSUl0uE
I hate to break it to you, but you’re not writing Moby Dick at your office job. You’re trying to communicate a (possibly complex) idea in a way that another person can understand it and make a decision.
> Running what I've written, the codification of my thoughts, through a statistical homogenization machine is dystopian in a way I had never imagined.
This is why Grammarly exists.
And if you can't do it without Grammarly, maybe you shouldn't have that job.
11 replies →
> I hate to break it to you, but you’re not writing Moby Dick at your office job.
What if he does? Do you like generalization?
1 reply →
You're missing the value-prop of Grammarly -- to help someone who doesn't know write more like a fluent native English speaker. Helping someone write "more average" is exactly the point until they're fluent enough to know when and how to break the rules.
Wait until you find out about the 5 paragraph essay that's taught in HS that follows this model.
> who doesn't know write
In my experience it doesn't.
It helps people who are already reasonable good at writing English to write slightly better. Through only if their writing is limited to "business" English.
For e.g. papers it's in my experience a catastrophe.
There are also multiple categories of errors it can't cope with and does bad recommendation for. It's the kinda of errors I'm doing a lot. Maybe due to having some dyslexia, maybe because it's my second language, or maybe because my brain thinks slightly different (not joking; Luckily it's just different, not worse.).
1 reply →
> You're missing the value-prop of Grammarly -- to help someone who doesn't know write more like a fluent native English speaker.
That's not a part of the value of Grammarly. The tool is going to recommend mistakes; if you can't recognize them, then it will hurt you a lot more than it helps.
I couldn't either. I don't work there anymore.
> Imagine running famous writers through this thing, even if they're just journalists. Gross.
Try comparing the text of a Great Illustrated Classic book to the text of the actual book it "adapts".
The goal is not to make famous writers write like journalists. It is to make people who struggle with writing write at the level of journalists.
I only know this company as the annoying YouTube pre-roll ad company. Any company that needs to advertise on YouTube that heavily raises red flags, IMO. Not surprising to hear they are cretins. For what purpose do they use the keylogging data. Doubtful they tell their customers all the exact details. "We use the data to improve the service." Gimme a break.
I'm starting to form a really negative impression of YouTube ads as well. Lots of scammy stuff all over the place. I'm kind of intrigued by all the "This young scientist invented ...", "This single father came up with a solution that his boss wouldn't give freedom to explore and so he broke out on his own to improve the world...". All these thin and exceptionally vague human interest stories filled with anonymous non-identifying biographical information leading up to some purported great product.
At first I was fooled by those productions since they had some non-zero amount of polish to them that looking back I realize is professional stock footage of some kind. Now I know it's junk faceless import products pretty much that are being peddled. There's a whole genre to them and it's funny now to see past them immediately when they appear, but irritating too.
Who still sees YouTube ads (or any ad for that matter) on todays web? I’m thinking anyone using the web without an adblocker is either a masochist or a fervent disciple of the “adtech” industry.
"Who still sees YouTube ads (or any ad for that matter) on today's web?"
Someone testing homegrown methods of blocking online advertising traffic on their own network.
I never see ads except when testing. I do not use an adblocker for downloading and watching YouTube videos. I use methods that work outside the browser. Adblockers require "modern", graphical web browsers.
"Modern", graphical web browsers are funded by online advertising.
I do not require a browser for accessing YouTUbe.
So, both of my phones have the following keyboard option:
"Suggest text corrections
Tap words or phrases underlined in green or tap the more menu icon when you see a green dot, to review grammar and writing suggestions.
Powered by Grammarly"
Does this mean that if I have text correction turned on while using the keyboard on my phone, because it is "powered by grammarly", it will be sending unencrypted information to Grammarly?
Personally, I couldn't care less if some giant company is reading my information, but I don't want that transmission being sent unencrypted.
Edit: I should mention that this is not an app that I have installed on my phone. This is literally just the text prediction for my keyboard by default.
Looks like Samsung is adding the Grammarly functionality to their built-in (still an app, technically) keyboard in an upcoming update, or they already have.
So now, very likely, both Samsung and Grammarly have access to everything you type on your phone.
Thankfully there's a few open source keyboards.
I've been checking out FlorisBoard, available on fdroid. Sadly, Google and Samsung keyboards are very good at swype/glide, FlorisBoard is coming along though, & I prefer to support it because the other two can't be trusted.
Both phones I was referencing were Samsung devices.
Do you know that grammarly keeps this information and doesn't toss it after it's AI looks for patterns for training?
1 reply →
Yes, all your text is being sent to Grammarly servers. It's done over HTTPS, so no third party can see what you type in, only you and Grammarly see your texts.
That's really bad actually. Especially if they are storing it away in a database associated with your unique ID for surveillance for 3rd party companies and the government.
Hmm, so if I understand things correctly: The means of transmitting that information is (supposed to be) secure, but the information within it - if the means of transmission (HTTPS) is compromised in any way - means a third party would then be able to read that information. Right?
2 replies →
…until there is a security breach at grammarly
I feel like I can't function without it. Grammar mistakes can be seen very badly by others. If only being able to understand the other person was sufficient.
Grammarly has become a crutch and I am having a hard time finding an alternative.
This is my method to write grammar sensitive content -
- Write initial draft in notepad
- Review the document
- Paste content into grammarly
- Review their suggestions
- Review the content one last time.
I just couldn't find anything that is non obtrusive and secure.
Edit: I read through the article. My method seems to be the most secure way to use grammarly. But I am deleting the extension and the app.
I've been using ProWritingAid instead of Grammarly. They have discount deals every once in a while, incl the Lifetime sub.
I have a relative with severe dyslexia who is a native English speaker. I wonder if grammarly could help him, even with things like spelling, too.
It does, it's not just that though, it also helps with picking the right words and phrases for your target audience and what type if a message you are writing.
1 reply →
What does it even offer that MS Word doesn't? Word has all sorts of grammar and style checking.
The obvious one: integration with every text box on your system.
Which is exactly the very very scary prospect of the thing. Giving Word this ability while using Word makes sense. Giving some other software access to 100% of everything that occurs on the system is very unnerving. <shudder>
For all the years that I used Word, its grammar checker used incorrect rules for when to use "which" and "that".
This issue may be fixed now, but I would never trust a grammar checker with such a lousy track record for basic issues like which/that.
Doesn't HTTPS encrypt your traffic to Grammarly's server?
Why would that matter? The traffic is encrypted in transit but still received as unencrypted plain text by Grammarly.
> the text was sent to Grammarly's server unencrypted
What does this mean exactly? That they were using HTTP instead of HTTPS, or some custom unencrypted format?
It may have nothing to do with the protocol. It can mean that everything Grammarly receives, no matter how transmitted, is unencrypted, in the same sense that this comment I sent to HN is. Of course this makes sense, but I think the difference is in the expectation of what is and isn't sent.
Years ago, you used something else instead of Grammarly.