Leaving Spellcheck Enabled is a Privacy Risk

[ghost]

• I have searched open and closed issues for duplicates

---

Bug description

Being that Signal for Desktop runs within Chrome. If a user happens to have the "Use a web service to resolve spelling errors." checked, the user is inadvertently sending all text to the Google servers hence, a lapse in privacy protection.

Use a web service to help resolve spelling errors: Use the same spell-checking technology in Chrome as Google Search. Chrome sends the text you typed to Google's servers.

Source: https://support.google.com/chrome/answer/114836?p=settings_privacy&rd=1

Recommended solution

Take a proactive measure to check and block output of text to Google's servers by disabling this spell check feature; see EFF's Privacy Badger's plugin as they take this measure with "Use a web service to help resolve navigation errors."

• If/Else
  • Feature a dialog box highlighting this issue and potential security lapse allowing the user to take proper precaution.

Steps to reproduce

• Options to enable/disable feature are under advanced settings in Chrome's settings panel.
• Intentionally misspell a word in the text box under Signal Desktop to enable/disable feature.

Screenshots

Platform info

Browser: Chrome 51.0.2704.103 (64-bit)
Signal version: 0.14.0

Link to debug log

N/A

[Dyras]

I don't think it's up to Signal to decide whether or not this should be blocked, but that's just me. The only way of enabling that feature is to voluntarily enable it.

[KarolTrzeszczkowski]

@Dyras maybe there should be a warning about the risk? Most of Signal users base on a trust to peer review and Open Whisper Systems using Signal. As i understood, OWS's philosophy is that there are no powerusers and the only way to make private communication popular is to assume, that most of users don't understand how these things work. I'd assume (i'm user not dev), that since you've put it there it means that it's safe to use it. Maybe you somehow anonimized it or whatever. Nobody expect such a trap. There should be at least a warning.

[nrizzio]

From the Google Glass support FAQ:

When you say "OK Glass," everything that follows is recorded and sent to Google for processing. Glass support would therefore require entrusting a third party with all of your responses, which violates the end-to-end encryption that Signal otherwise provides.

Precedent says that it's reasonable to disable or require that spellcheck be disabled.

[liliakai]

The setting that Privacy Badger disables is enabled by default. The spell check service setting is disabled by default, so, no, I don't think this issue is worth mucking with the browser settings or creating an in-app dialogue.

Glass would likely not be a problem its voice recognition service was disabled by default.

If anything, I would consider disabling spellcheck within the app entirely (via the spellcheck HTML attribute). Long ago, I globally disabled spellcheck in my browser profile and have never looked back. Does anyone really want to see an ugly red squiggle under every "brb", "omg", and url they paste into a chat? Is there a compelling argument for spellcheck in the context of a messaging app?

[KarolTrzeszczkowski]

It's sometimes useful when you use foreign language. I sometimes misspell easy words and thats embarrassing thing. For instance I've just written "embarassing". :D For me it's useful.

[Dyras]

I'm also part of the club that sometimes manage to misspell really simple words, so I wish we still had spellcheck.

[ghost]

Thank you everyone for some interesting dialog.

@Dyras & @liliakai Let me ask you this:

What happens when a user has previously enabled the "Use web service to resolve spelling errors" in the past—simply forgot about it—and then installs Signal desktop? The setting is still enabled and because the user forgot that it was enabled, compromises their own security. This will happen all the time when adopters of E2EE are the layperson.

To quote @KarolTrzeszczkowski:

...that most of users don't understand how these things work.

I realize that there is an oversight on the user's part, however, It would be great if there was a dialog box that came up highlighting this potential lapse in privacy so the user can take proper action. This can be in the form of a welcome screen with a few questions to ask the user as part of the "setup process."

We cannot expect the common user to have the foresight to remember all of these steps. Users want a set it and forget it ability. An argument for this would be Apple. For their user base, customers just want a product that works. They don't care about the internals or how it works—they just want something they can pull from the shelf and expect it to work out of the box. The Apple Genius Bar is a prime example and the fact that they are non-stop busy with an online reservation system speaks to this; in a sense this what OWS is trying to do with encryption—make encryption easy and accessible for the masses.

Moreover, what if a user simply wants to use the web service to resolve spelling errors outside of Signal? My proposal wherein Signal for Desktop blocks the sending of data to Google's servers would resolve this; again, have an option to do so so the user is in control and OWS is not dictating anything.

--Break--

The setting that Privacy Badger disables is enabled by default. The spell check service setting is disabled by default, so, no, I don't think this issue is worth mucking with the browser settings or creating an in-app dialogue.

Should there be a proactive stance from OWS, the Signal for Desktop plugin would disable the setting if enabled, and then clearly mark it as does the Privacy Badger plugin. In this case, the user can see why the setting was turned off and should they want to re-enable it, they can. However, as I have previously stated, a user cannot have it both ways. So, the question then becomes, is there a way to block the data from being sent to Google's servers from within the Signal extension while leaving the rest of the spell check service unaffected?

--Break--

@KarolTrzeszczkowski:

It's sometimes useful when you use foreign language. I sometimes misspell easy words and thats embarrassing thing. For instance I've just written "embarassing". :D For me it's useful.

@Dyras:

I'm also part of the club that sometimes manage to misspell really simple words, so I wish we still had spellcheck.

We do not lose spell check ability by disabling the "Use a web service to help resolve spelling errors." or blocking the data stream. Chrome has a dictionary built into the browser and spell checking still works with the Google feature turned off.

[liliakai]

At a glance, it looks like Privacy Badger is doing this via the the privacy API which is only available to extensions, and not packaged apps.

[ghost]

@liliakai Thank you for shedding light on this i.e., privacy API.

However, there can still be a welcome screen with a walk through to ensure previously enabled settings are brought to the attention of the user and asks them if they want to protect their privacy by disabling these services.

[diego898]

@liliakai what do you think about what @Zer0Nin3r said?

[thierryzoller]

why is this closed?

[frei0]

why is this closed?

Signal desktop no longer runs in chrome.

[ErikUden]

Meaning the spell check I see within Signal has nothing to do with Chrome anymore? Wonderful.