Some have pointed out that password fields are excluded from using an alternative keyboard. This tells me that even Apple is a bit concerned about the consequences of logging key strokes. I’m not sure about everyone else, but I generally use a password to protect all of the other things I write with my keyboard. If every other keystroke is logged and transmitted to a server, my password becomes far less relevant.
This is worrisome.
At the very least, allow keyboards to type in “secure” text boxes if I have “full access” disabled on the keyboards, meaning they have no network connectivity.
Isn’t this good news? Why worrisome?
This would seem to be an obvious problem with software that is a keyboard. People are just now figuring this out?
Yeah, this is why that, for the moment at least, I don’t want to consider using third-party keyboards.
I can only imagine how many of those Android keyboards are logging usernames and passwords.
Denying the keyboard network access is no good because the keyboard is an application that can store and later retrieve information when network access is restored. It boils down to the author’s conclusion of the linked article–trust.
It is not so obvious, many years of conditioning by physical wired keyboard usage have seen to that. Because we have extended the assumption of security to wireless and virtual keyboard equivalents doesn’t mean people are ignorant, of all the many things to think about, input devices don’t bubble to the top of the list. Not everybody is conditioned to be suspicious of everything software.
It’s the eternal circle. Apple releases a product. Nerds bitch that said product doesn’t include/support “obvious” feature. After much deliberation Apple includes/supports the feature. Nerds suddenly realize that the feature has security/privacy/usability implications that they hadn’t considered. Nerds whine that Apple “doesn’t care” about security/privacy/usability. Rinse. Lather. Repeat.
This is absolutely the behavior that should exist. It’s called privacy and security. Sorry, alt keyboard users. There is danger in what you do. Android lets you violate this basic tenet of security. Apple won’t.
So, here’s my assumption, with all the things assumptions entail:
If you have iCloud password sharing (or perhaps one of the password manager apps like LastPass or 1Password), then you can still enter passwords. Of course, this assumption hinges on whether the password entry is still possible to be logged by the keyboard when it is being entered by another service.
If my assumption is correct, then it could be an incentive for people to create more randomized passwords.
Now that I’ve wildass speculated, I’ll go read the article to see if the author has the same idea. 🙂
Well, one could, in theory, vastly restrict the APIs a “keyboard” could use, to prevent it having any network access.
Combine that with the per-App sandbox and it might be impregnable enough.
Hell, wired keyboards aren’t secure if someone else has access to the hardware.
USB keyloggers aren’t rocket surgery…
That is why 3rd party keyboards are optional. You have to trust the maker of the keyboard as much as you currently trust Apple.
SwiftKey seems to have a pretty legit response. http://support.swiftkey.net/knowledgebase/articles/372699-a-warning-says-swiftkey-may-collect-personal-data What do you think?