4 ms·

Anybody else uncomfortable with the fact that these drop-in keyboard replacements are effectively sanctioned keyloggers that send keystrokes to a remote server?

spindritf 12y ago
When you turn them on, Android will even warn you of that possibility. SwiftKey has some sort of cloud (opt-in) feature[1] so it's a keylogger with benefits. [1] http://swiftkey.com/en/more-about-cloud/ http://swiftkey.com/en/more-about-cloud/
ecopoesis 12y ago
Apple doesn't allow third party keyboards when you're using a password field, so someone is thinking of it.
- bruceboughton 12y ago
  Password fields are not the only sensitive data inputs.
MartinMcGirk 12y ago
I occasionally get uncomfortable with this. I had an eerie experience with SwiftKey on Android a few months ago where I was sending someone my bank account details over SMS (I know, I know) so they could wire me some money, and I typed "My bank account number is" And the next suggested word from my keyboard was my actual bank account number. Same thing happened with my sort code. I guess I sent my details to someone a few months before and it just remembered the info. Other than that slight "oh crap" moment though, the fact it listens to and remembers everything I write comes in super handy. Turns out I use the same few phrases a lot more than I thought I did, and swiping away at my keyboard, and having it predict my next word quickly and accurately saves me SO much time.
Ethan_Mick 12y ago
By default, iOS keyboards cannot interact with other parts of the app/their container app, and cannot send information over the network. [1][2][3] If you do enable full access, then yep, anything is fair game. But that's a tradeoff users can make. [1] - https://twitter.com/SwiftKey/status/514540356918972416 https://twitter.com/SwiftKey/status/514540356918972416 [2] - http://swiftkey.com/en/blog/swiftkey-require-full-access/ http://swiftkey.com/en/blog/swiftkey-require-full-access/ [3] - https://developer.apple.com/library/ios/documentation/General/Conceptual/ExtensibilityPG/Keyboard.html https://developer.apple.com/library/ios/documentation/Genera...
- boynamedsue 12y ago
  It doesn't appear that SwiftKey allows for swiping across the keyboard unless you give it full access. I just installed it and then removed it because of this.
unfamiliar 12y ago
This is the primary reason that I chose swype over swiftkey on iOS. It doesn't require internet access, so as far as I understand it, all my keystrokes are completely sandboxed inside it. No way I'm agreeing to have everything I type transmitted to a third party.
- ctdonath 12y ago
  Can anyone elaborate on this (or at least confirm)? I can deal with "remote keylogger" _if_ I feel I can trust the business (however ill-defined that may be). Real sore point is ye ole NSA/FBI/whoever being able to demand/siphon that data, so on-device sandboxing is much preferred. SwiftKey is pretty neat, but may switch to Swype once I'm convinced it's worth the few bucks for a local secure sandbox.
  - unfamiliar 12y ago
    I have more practical concerns. I might "trust" the company not to abuse or sell my data - but do I trust that they are actually competent enough to secure it? It is abuse by hackers which gain access to the data that I am worried about.

spindritf 12y ago

When you turn them on, Android will even warn you of that possibility. SwiftKey has some sort of cloud (opt-in) feature[1] so it's a keylogger with benefits. [1] http://swiftkey.com/en/more-about-cloud/ http://swiftkey.com/en/more-about-cloud/

ecopoesis 12y ago

Apple doesn't allow third party keyboards when you're using a password field, so someone is thinking of it.

bruceboughton 12y ago
Password fields are not the only sensitive data inputs.

MartinMcGirk 12y ago

I occasionally get uncomfortable with this. I had an eerie experience with SwiftKey on Android a few months ago where I was sending someone my bank account details over SMS (I know, I know) so they could wire me some money, and I typed "My bank account number is" And the next suggested word from my keyboard was my actual bank account number. Same thing happened with my sort code. I guess I sent my details to someone a few months before and it just remembered the info. Other than that slight "oh crap" moment though, the fact it listens to and remembers everything I write comes in super handy. Turns out I use the same few phrases a lot more than I thought I did, and swiping away at my keyboard, and having it predict my next word quickly and accurately saves me SO much time.

Ethan_Mick 12y ago

By default, iOS keyboards cannot interact with other parts of the app/their container app, and cannot send information over the network. [1][2][3] If you do enable full access, then yep, anything is fair game. But that's a tradeoff users can make. [1] - https://twitter.com/SwiftKey/status/514540356918972416 https://twitter.com/SwiftKey/status/514540356918972416 [2] - http://swiftkey.com/en/blog/swiftkey-require-full-access/ http://swiftkey.com/en/blog/swiftkey-require-full-access/ [3] - https://developer.apple.com/library/ios/documentation/General/Conceptual/ExtensibilityPG/Keyboard.html https://developer.apple.com/library/ios/documentation/Genera...

boynamedsue 12y ago
It doesn't appear that SwiftKey allows for swiping across the keyboard unless you give it full access. I just installed it and then removed it because of this.

unfamiliar 12y ago

This is the primary reason that I chose swype over swiftkey on iOS. It doesn't require internet access, so as far as I understand it, all my keystrokes are completely sandboxed inside it. No way I'm agreeing to have everything I type transmitted to a third party.

ctdonath 12y ago
Can anyone elaborate on this (or at least confirm)? I can deal with "remote keylogger" _if_ I feel I can trust the business (however ill-defined that may be). Real sore point is ye ole NSA/FBI/whoever being able to demand/siphon that data, so on-device sandboxing is much preferred. SwiftKey is pretty neat, but may switch to Swype once I'm convinced it's worth the few bucks for a local secure sandbox.
- unfamiliar 12y ago
  I have more practical concerns. I might "trust" the company not to abuse or sell my data - but do I trust that they are actually competent enough to secure it? It is abuse by hackers which gain access to the data that I am worried about.