22

When I enable an input method (a keyboard app) on a Nexus device, I see the following confirmation message:

This input method may be able to collect all the text that you type, including personal data like passwords and credit card numbers. It comes from the app Highway. Use this input method?

I understand this warning. Because of the way an input method works, it has the ability to collect everything I type, and I have to trust the author not to abuse this ability. But when I enable an input method on my Samsung Galaxy S3 (and maybe other Samsung devices; I haven't tried), I get a different message (my emphasis):

This method can collect all of the text you enter, except passwords, including personal data and credit card numbers. It comes from the app Highway. Use anyway?

I've checked entering a password into a web form, and setting the device password. In both cases, it still uses the (3rd-party) input method I choose to enter the password. So why does Samsung claim that the input method can't collect passwords? Are they doing something incredibly clever in their version of Android, or are they just talking nonsense?

Improve this question
3
  • I guess it's the latter, or a variant of it: rewrite their statement to "it will not collect passwords" might be believable. It can not is a lie IMHO, though hard to prove (except counting the example of the user writing a text like "my password is foobar", as how shall the app recognize that?). How can Samsung be that sure to always know where a password is entered?
    – Izzy ♦
    Nov 28, 2013 at 20:25
  • 2
    TBH, my guess is that it means you can't use a 3rd-party keyboard to enter the lock screen password when unlocking the screen. But if it still uses the selected keyboard to set the password, that's no security benefit.
    – Dan Hulme
    Nov 28, 2013 at 21:40
  • 1
    It's simply not honest to suggest a keyboard has no access to passwords you type using it. That's a contradiction in itself. The keyboard app has access to everything you type (if that would exclude passwords, you couldn't type them), and thus can collect everything. If it does do so, is a different issue not fitting the phrasing. I don't say they intentionally placed a "false claim", but it simply cannot be true. Correct would be "can collect all of the text you enter, but will possibly/hopefully/... exclude...". For 3rd party apps, they cannot be sure. Write one, blame them :)
    – Izzy ♦
    Nov 28, 2013 at 22:40

1 Answer 1

Reset to default
1

As a programmer I find this interesting. Password fields can be (and usually are) treated differently than normal text boxes. Given that Android is open source I guess it's possible that Samsung has at least attempted to include code that prevents a password field from passing information typed in it back to the keyboard application, but like others have stated I am skeptical.

In order for a keyboard application to collect your data it has to include the extra step of capturing your input, storing it somewhere, even if it's just temporarily in an instance variable, and then sending it on to a third party. I would be interested to hear what Samsung says about this and how they supposedly prevent it, but I'm guessing that's an answer we aren't likely to get.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .