Background: I am a normal smart phone user, with no experience in information security. I want to download a new keyboard for my Android 6 phone off Google Play, as my current keyboard is not great. I am not handling valuable information in my phone, other than online account passwords including banking passwords, etc.
Question: How can I assess the risks presented buy any particular keyboard? What risks should I look out for?
In terms of key-logging, am I more or less OK if a keyboard does not require network access? If so, can the keyboard gain network access in other ways than asking directly for the network access privilege?
Is asking for access to my Bluetooth bad?
The SwiftKey Keyboard wants access to:
- Calendar events plus confidential information
- Find account on the device
- Precise location
- Full storage access
- Full network access
- Connect and disconnect from wifi
- View network connections
- View wifi connections
- Receive data from the internet
(and some other non-important things, like controlling phone sleep and vibration)
This seems like a security disaster to me; it is terrifying to think what can be done with these permissions!
How do I protect myself?