0

Background: I am a normal smart phone user, with no experience in information security. I want to download a new keyboard for my Android 6 phone off Google Play, as my current keyboard is not great. I am not handling valuable information in my phone, other than online account passwords including banking passwords, etc.

Question: How can I assess the risks presented buy any particular keyboard? What risks should I look out for?

  • In terms of key-logging, am I more or less OK if a keyboard does not require network access? If so, can the keyboard gain network access in other ways than asking directly for the network access privilege?

  • Is asking for access to my Bluetooth bad?

The SwiftKey Keyboard wants access to:

  • Calendar
    • Calendar events plus confidential information
  • Contacts
    • Find account on the device
  • Location
    • Precise location
  • Full storage access
  • Networking:
    • Full network access
    • Connect and disconnect from wifi
    • View network connections
    • View wifi connections
    • Receive data from the internet

(and some other non-important things, like controlling phone sleep and vibration)

This seems like a security disaster to me; it is terrifying to think what can be done with these permissions!

How do I protect myself?

Improve this question
5
  • Google is generally good at vetting apps that are presented in its play store. If an app is popular, it is reasonable to assume it doesn't do a lot of horrible stuff. It all comes down to trust. Google has been caught illegaly sending location data, and everytime you run a program on your desktop, it basically has the same permissions
    – J.A.K.
    Commented Dec 22, 2018 at 14:58
  • Check reviews, google the app and throw in some 'security' keywords, check CVE database...
    – they
    Commented Jan 2, 2019 at 13:30
  • Sidenote: I would be much more concerned about running Android 6 since it is no longer receiving security updates as of August 2018 Android 6 has 770 vulnerabilities at the time of this post While a newer version like 9 has 45 That would likely offer more protection than trying to analyze the app.
    – they
    Commented Jan 2, 2019 at 13:37
  • 1
    @they: Er...in a perfect world. The truth is that I just don't have the money to buy a recent phone. (and up till recently I was using Android 4!)
    – user195136
    Commented Jan 2, 2019 at 14:46
  • Understandable. I just wanted to raise the point for the sake of information.
    – they
    Commented Jan 3, 2019 at 14:42

1 Answer 1

Reset to default
1

I am not handling valuable information in my phone, other than online account passwords including banking passwords, etc.

Aren't these passwords valuable enough? They are the key to your banking accounts and online accounts!

How can I assess the risks presented buy any particular keyboard?

For an average or normal smartphone user, there's nothing much that can be done about it. Security experts can sniff the packets and try to see if anything sensitive is being passed on to the servers.

In terms of key-logging, am I more or less OK if a keyboard does not require network access? If so, can the keyboard gain network access in other ways than asking directly for the network access privilege?

It should be okay, as long as you trust the application. Even apps without network access can wreak havoc on the phone if they contain malware. It's better if you go with a trusted keyboard app from trustable sources like Google Play.

Regarding the permissions being asked by SwiftKey keyboard, they've explained the purpose of each permission on this link. Although there's no guarantee that the information gathered is used only for the specified purposes.

My suggestion would be to go with a trusted keyboard app like Gboard or Swiftkey.

Improve this answer
2
  • What about apps that claim to be secure, and ask for next to no permissions, like Notrack Secure Keyboard ?
    – user195136
    Commented Dec 22, 2018 at 15:25
  • @hat Indeed, it does not ask for permissions, and hence you can be sure that it won't transmit any data over the network. But what if the app contains malicious code or exploits some security loophole or vulnerability present in Android 6?
    – pri
    Commented Dec 22, 2018 at 15:58

You must log in to answer this question.