[whatwg] Exposing spelling/grammar suggestions in

[Roger Hågensen]

On 2010-11-29 23:08, Charles Pritchard wrote:
> Browser vendors may consider limiting such lookups, and that receiving 
> more than a thousand lookups means that a script has gone awry. Doing 
> so would limit any reasonable chance of a brute force attack 
> discovering anything. A brute force attack with getSpellingRanges 
> would use a dictionary to fill a contenteditable area and test to see 
> if the word is in the system dictionary. The success of such an attack 
> would be reasonably limited were spelling lookups limited by the UA.

This is all growing out of proportion, this whole issue can be resolved 
by just thinking logically.

If passwords are being stored in the dictionary then that is a security 
issue with the UA and not HTML etc.
If a dictionary stores user words without asking the user first or the 
user specifically stores it then that is a implementation issue of the 
dictionary/OS/UA/whatever.
Password fields should never have spell-checking enabled (not just for 
security reasons but because the dictionary might mess up the password 
you are typing causing a failed login)
A javascript or similar has no business stepping through the spelling 
dictionary, that is UA or OS territory, and I fail to see how a 
javascript could possible support all the hundred+ languages in use anyway.
Forms and content fields can have hinting, where they desire spell 
checking to be used (commentary fields on websites, article content 
fields etc), but it is up to the browser/user/OS settings if it'll 
auto-enable checking on those fields.

And currently this is mostly how browsers do this (some better or worse 
than others though).

Some CSS enhancements to possibly match the dictionary GUI to the site's 
look could be interesting though, but CSS stuff is another group than 
WHATWG so...

Only thing I see to miss in what is mentioned here is sitebased custom 
dictionaries,
that is something that could be and should be specced. For example, you 
might want to use the same base dictionary (original or user extended), 
but a different site/sub dictionary depending on if you are writing 
articles on Gamasutra or posting emails on WHATWG.
But again, the actual UI for that is as well the prerogative of the UA.

-- 
Roger "Rescator" Hågensen.
Freelancer - http://EmSai.net/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.whatwg.org/pipermail/whatwg-whatwg.org/attachments/20101129/55da73f6/attachment-0002.htm>