Hacker News Reader

Comment by nwh | Hacker News Reader

iOS8 keyboards still make me very uncomfortable. How many of them contain keyloggers?

It's not even if I have one installed, the people I communicate with will be using them too, and they can compromise me.

View on HN

I'm pretty sure they are sandboxed and can't access the network at all. Actually looks like you can set a flag to access the network.

https://developer.apple.com/library/ios/documentation/Genera...

Not to mention third-party keyboards are not allowed in password fields. I guess that's unfortunate for anyone with non-standard unicode in their passwords, though.

Can users see this flag?

By default, it is false. The app cannot change it without asking the user first. You cannot see it.

http://i.imgur.com/bSIhNOP.png

Big scary warning, I like it. Swiftkey does badger people to enable it though, so presumably it's sending a lot of data back to their servers as a business model. Nasty.

SwiftKey says they do not send any data unless you explicitly enable it (separately from Full Access):

https://iossupport.swiftkey.com/hc/en-us/articles/201466641-...

Nice scary warning indeed. Default/Suggested action should probably be "Don't allow" tho.

well swiftkey iirc does some data analysis on stuff like commonly used words and then uses those for suggestions for new users. its not totally without user benefit, though the potential for evil is certainly there.

Is a keylogger the best way to determine a list of commonly used words?

While it has the potential for privacy issues, it is also the basis for the entire product. The only way to build prediction is to have data.

I think Nasty is a bit strong here.

I have SwiftKey installed and there is an option in the Settings->General->Keyboard->Keyboards->SwiftKey allows me to toggle it on/off:

https://i.imgur.com/RUN4nno.png

But now you can't swipe enter or get predictions. To use it anywhere near as advertised, they extort your data out of you.

I can't speak for anybody else's apps, iOS or Android, but Glyf sure doesn't have a keylogger included, at the very least...

I didn't mean to suggest that at all, I was commenting on the concept of having executable keyboards outside of the usual application sandbox rather than yours in particular.

Reply on news.ycombinator.com