<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
On 2010-11-29 23:08, Charles Pritchard wrote:
<blockquote cite="mid:4CF42449.3000903@jumis.com" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
Browser vendors may consider limiting such lookups, and that
receiving more than a thousand lookups means that a script has
gone awry. Doing so would limit any reasonable chance of a brute
force attack discovering anything. A brute force attack with
getSpellingRanges would use a dictionary to fill a contenteditable
area and test to see if the word is in the system dictionary. The
success of such an attack would be reasonably limited were
spelling lookups limited by the UA.<br>
</blockquote>
<br>
This is all growing out of proportion, this whole issue can be
resolved by just thinking logically.<br>
<br>
If passwords are being stored in the dictionary then that is a
security issue with the UA and not HTML etc.<br>
If a dictionary stores user words without asking the user first or
the user specifically stores it then that is a implementation issue
of the dictionary/OS/UA/whatever.<br>
Password fields should never have spell-checking enabled (not just
for security reasons but because the dictionary might mess up the
password you are typing causing a failed login)<br>
A javascript or similar has no business stepping through the
spelling dictionary, that is UA or OS territory, and I fail to see
how a javascript could possible support all the hundred+ languages
in use anyway.<br>
Forms and content fields can have hinting, where they desire spell
checking to be used (commentary fields on websites, article content
fields etc), but it is up to the browser/user/OS settings if it'll
auto-enable checking on those fields.<br>
<br>
And currently this is mostly how browsers do this (some better or
worse than others though).<br>
<br>
Some CSS enhancements to possibly match the dictionary GUI to the
site's look could be interesting though, but CSS stuff is another
group than WHATWG so...<br>
<br>
Only thing I see to miss in what is mentioned here is sitebased
custom dictionaries,<br>
that is something that could be and should be specced. For example,
you might want to use the same base dictionary (original or user
extended), but a different site/sub dictionary depending on if you
are writing articles on Gamasutra or posting emails on WHATWG.<br>
But again, the actual UI for that is as well the prerogative of the
UA.<br>
<br>
<pre class="moz-signature" cols="72">--
Roger "Rescator" Hågensen.
Freelancer - <a class="moz-txt-link-freetext" href="http://EmSai.net/">http://EmSai.net/</a>
</pre>
</body>
</html>