Ask HN: Is Google Chrome's autotranslate feature a huge vulnerability?

Re:Ask HN: Is Google Chrome's autotranslate feature a huge v... by rahimnathwani on Friday August 17, 2018 @09:04AM (#17782480)

It might be fun for you try this yourself.

Connect two computers to the same network. On one, use some MITM proxy software. On the other, set all the traffic to go via this proxy, either transparently (via default gateway) or explicitly via proxy settings.

Then see if you can intercept the info being sent from your browser to Google translate.

I'm not at a computer right now, but I guess that:

1. The auto-translate feature uses https, so that the traffic between you and Google is not available via network-level MITM.

2. The page contents are not sent to Google at all, but only the URL

[ Parent | on HN ]

Re:Ask HN: Is Google Chrome's autotranslate feature a huge v... by eat_veggies on Friday August 17, 2018 @10:28AM (#17783032)

You don't even need a proxy--just open up your dev tools and watch the network.

1. It does use HTTPS. It'd be insane if it didn't.

2. Individual strings from the page get sent to the translate API:

https://i.imgur.com/2nAlbp4.png

[ Parent | on HN ]

Re:Ask HN: Is Google Chrome's autotranslate feature a huge v... by z_open on Friday August 17, 2018 @11:16AM (#17783443)

How could google not have the page contents? The content generated from the URL as requested by google may not have the same content that you currently have.

[ Parent | on HN ]

Re:Ask HN: Is Google Chrome's autotranslate feature a huge v... by beaconstudios on Friday August 17, 2018 @09:34AM (#17782686)

how would 2. work for pages that are behind authentication?

[ Parent | on HN ]