In this report, we examine cloud-based pinyin keyboard apps from nine vendors (Baidu, Honor, Huawei, iFlyTek, OPPO, Samsung, Tencent, Vivo, and Xiaomi) for vulnerabilities in how the apps transmit user keystrokes. Our analysis found that eight of the nine apps identified contained vulnerabilities that could be exploited to completely reveal the contents of users’ keystrokes in transit. We estimate that up to one billion users could be vulnerable to having all of their keystrokes intercepted, constituting a tremendous risk to user security.
  • ozymandias117@lemmy.worldEnglish
    5·
    7 months ago

    Are the on-device pinyin keyboards unusably bad at typing?

    I know it’s complex to get the right meaning with the English alphabet, but I’m surprised at cloud-based keyboards

  • jol@discuss.tchncs.deEnglish
    41·
    7 months ago

    That’s why I keep my keyboard gagged behind a no-network order. My keyboard has no business being online.

  • Dark Arc@social.packetloss.ggEnglish
    1·
    7 months ago

    So does this affect English/European keyboards or just Asian keyboards?

    It seems like the mechanism is exploiting an insecure connection (or rather a connection using predictable encryption where the same input results in the same packets) to the cloud for translating keystrokes into logographic characters?

    Did I understand correctly? I definitely didn’t do a thorough read.

    I also think it’s kind of interesting Gboard wasn’t included (?)

    • Carighan Maconar@lemmy.worldEnglish
      1·
      7 months ago

      It’s about using a cloud-based model to better predict the next keystroke.

      Think of the next-word-prediction of the likes of GBoard or SwiftKey, but for just strokes/characters. There’s a local model, but it’s limited in depth and complexity, and then a cloud based one, that can do more but as shown here has security flaws.

      • Dark Arc@social.packetloss.ggEnglish
        1·
        7 months ago

        Well, it can’t just be about that. There are ways to salt the data so that it’s not predictable. I’m not an expert in that area, but I know it’s a technique that’s often employed by cryptography experts when this is a major concern.

    • lemmyreader@lemmy.mlOPEnglish
      11·
      7 months ago

      I also think it’s kind of interesting Gboard wasn’t included (?)

      Indeed. But given it’s Google I would not be surprised if Gboard has keylogger features.

      • Dark Arc@social.packetloss.ggEnglish
        2·
        7 months ago

        I think that would be far too large of a liability for Google for the minimal amount of data they’d get back.

        Google mostly cares about metadata for their advertising business (per my understanding).