2

I use SwiftKey on my phone. I also try out a lot of custom Android keyboards as and when they are released on Google Play.

I would like to know if custom keyboards available on Google Play can capture my passwords as I type and send it across Internet? Is there any mechanism built into Android that would stop them from doing that?

6

Of course a keyboard app can capture your passwords as you type them, along with everything else you type: naughty text messages, credit card numbers, web searches, everything. You couldn't have a mechanism to stop it, because in a sense, that's what it's for.

It can only send this or any other information across the internet if it has the appropriate permission, "full network access." Almost all apps use this permission, though, and a keyboard might want it in order to download new language files, or to show ads if it uses that revenue model. SwiftKey, for example, has a "cloud sync" service to let all your devices share the same training data. This can only work by transmitting words you've typed, and statistical data about text you type, across the internet to their servers.

Android warns you that this is the case every time you enable a third-party keyboard in the Language & input settings. Nexus devices show a dialog with the message:

This input method may be able to collect all the text that you type, including personal data like passwords and credit card numbers. It comes from the app Highway. Use this input method?

but as I mention in another question, manufacturers can replace the message (perhaps with one that's not entirely true) or disable it completely.

  • Android warns you that this is the case every time you activate a new keyboard. Actually I have never seen any sort of warning when I activate SwiftKey. Yes, while downloading it, it shows all the permissions this app requires. – Naveen Dec 9 '13 at 11:47
  • @Naveen I've added more info about this warning to my answer. – Dan Hulme Dec 9 '13 at 12:11
  • 1
    There's no risk in using the keyboard that came with your phone. The manufacturer (or custom ROM author) has full control over all the software on your phone. If they want to read everything you type, they can do that whatever keyboard you use. If you don't trust the OS vendor, you can't trust the device at all. – Dan Hulme Dec 9 '13 at 12:21
  • 1
    Besides, a part neither of us mentioned: the "full network access" permission is not necessarily a requirement to send data I guess; an app could simply pass the upload job to the installed web browser via an intent, couldn't it? Not sure if that could be done "silently" (without the user noticing), though. – Izzy Dec 9 '13 at 12:25
  • 1
    Sure not. But the app could check for "display off" to do that. In any case: if that's possible at all, the app might have but a single try; still: the user would only note that when it's already done (iow: too late for him, but the cry would be as loud that nobody would miss it, and the app burned :) – Izzy Dec 9 '13 at 12:30
3

Theoretically yes: it's the nature of a keyboard to know all your key-presses. So if the app has the Internet permission, it could also send this to "some place".

For closed-source apps, it's difficult to check whether they do so or not (the only way doing that would be monitoring their network activity over a long time, best done on the router). With open-source apps, that's easier, as the code is freely available, and thus could be investigated directly.

A few years ago I would have said: if it's a reputable developer, you're on the safe side. With todays spying reports, it's hard to say... So if you want to be absolutely sure, there's no other way then using an open-source keyboard, grab the code, and compile it for yourself (← paranoid mode ;)

  • 1
    +1 for mentioning the relative merits of open-source & closed-source software. It's also worth noting that open-source isn't a guarantee in itself: you have to examine and understand the source carefully, or trust someone to do it for you. And for keyboards where uploading what you type is a feature, like SwiftKey, there's no guarantee at all! – Dan Hulme Dec 9 '13 at 12:14
  • If you want to be on the safe side, and have enough skills, you could also try decompiling the specific keyboard app, to see what it does exactly. Of course, I'm not saying anyone should do it, but there's the option to do so, and if you're afraid of your privacy, you'd definitely feel safer if you knew what exactly is transmitted to the certain keyboards developers' server. – fonix232 Dec 9 '13 at 12:33
1

Yes, ALL keyboards capture your input and there is no way guarantee that the data does not leave your device. If the keyboard is 'cloud-powered' then it is insecure by design since everything you type gets sent over the wire.

IMHO you should not trust GBoard (Google official) neither 3rd party keyboards unless their source is open and available for public auditing.

I would strongly recommend AnySoftKeyboard which is FOSS complaint offering "trust by transparency" as an alternative to belief. http://anysoftkeyboard.github.io/

-1

Use a keyboard which doesn't ask permissions for full network access. In this case you don't have to be worried about someone stealing your passwords. You can see the full list of permissions in app list.

  • Such as?? Is there a third-party keyboard that neither asks nor takes permission to collect one's text data?? – user240067 Oct 9 '17 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.