Google, Microsoft can get your passwords via web browser's spellcheck (opens in new tab)

This is why I argue that TikTok is meaningfully no worse than Facebook, Google or Microsoft. They’re all collecting basically everything you put into them, keyloggers and all.

You can’t just single out one because it’s from China, imo.

From the article:

>The 'spellcheck' HTML attribute when left out from form text input fields is usually assumed by web browsers be true by default.

Text inputs. So what about inputs of password type?

MDN says this:

>If [the spellcheck attribute] is not set, its default value is element-type and browser-defined. This default value may also be inherited, which means that the element content will be checked for spelling errors only if its nearest ancestor has a spellcheck state of true.

https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att...

So do browsers apply spellcheck="true" by implicit default to inputs with type of password?

Is this also true for Grammarly?

I find this outrageous. It also applies to the text of all of my employer' emails (at least those managed in the mentioned web browser), according to a prompt (with no option to reject, IIRC) I read the other day.

Edit: sorry I should have captured that prompt! I am not able to remember what it said, it might have been from the company rather than the browser.

Worthless clickbait - both of these processes that send to external servers are opt in and very clear that it is doing what it’s doing. Also, no big company would intentionally try to store and use your passwords against you. They have no incentive to do this. This is security theater.

This is also sending your credit card information btw

can we assume that the problem only happens when actually typing and not if you pasted sensitive text in the fields?