(security) translation feature shares sensitive info with tech giants
Issue
From a code inspection it is clear that fedilab is using three different translation services:
1. translate.fedilab.app ← privacy policy needed
I applaud the use of translate.fedilab.app
. Although it would be better for privacy by giving a zero trust option whereby translations were done locally on the device itself by running the Argos-Translate python scripts. At least translate.fedilab.app
seems to be relatively more trustworthy than some of the other cloud services, but you should really also improve on that by adding a privacy policy to the translate.fedilab.app
website, most particularly telling users when their queries will be deleted.
2. Deepl ← remove it
DeepL is revolting from a privacy standpoint because ALL text is surreptitiously shared with a privacy-abusing US tech giant (Cloudflare). And to worsen matters, DeepL conceals that fact and goes out of their way to mislead users into thinking that they have privacy. It’s deeply disturbing how good their security page is at deceiving users to market their commercial service.
3. Yandex Translate ← remove it
Do users know potentially sensitive msgs (private & direct) are being leaked to a Russian tech giant for translation, the profits of which are taxed to finance Putin’s war?
Fixes needed
From a security standpoint, these changes are needed:
-
scrap DeepL & Yandex, or at a bare minimum heavily caution to users that their data is being shared with Cloudflare and Yandex so they can decide whether it accommodates their security policy & threat model.
-
establish a privacy policy for
translate.fedilab.app
so users know the retention period. -
add a local translation feature so there is a zero-trust option
-
consider replacing DeepL & Yandex with translatelocally.com (which is EU funded) and apertium.org
Steps for reproducing the issue
Just look at the code.