Privacy Keyboard urgently needed

K8y

I typed in a very unique word on a privacy comms app, like Signal, and immediately afterwards I switched to my X (twitter) account and had a visual image of that exact word pop up in my feed.

Only way for this to happen is X and others are receiving keyboard strokes from our keyboard. Keyboard sends them.

Is there any keyboard that doesn't, and is trusted by the GoS community? GoS should build their own because even if all other security/privacy precautions are taken, if they keyboard allows your strokes to be sent out, you're cooked.

Johnnyloans

K8y

Disable sensors on as many apps as you can. What you type could theoretically be recreated in another app based on you tapping your phone and sensors picking up on it.

Onlyfun

K8y
florisboard has private clipboard at least

Elysium

Most users here use FUTO Keyboard or Heliboard I think. There is a speech to text FUTO app that works offline integrated into the keyboard.
Notable mentions are probably Floris Board and Fossify Board and some other more niche keyboards.
A few users here also use Swiftkey from Microsoft with disabled Internet permission.
You should check if you have copy from clipboard notification still toggled on in system settings.

K8y

Elysium should check if you have copy from clipboard notification still toggled on in system settings.

isn't that just if i copy something? in my case I merely typed the words on a secure app...

K8y

Johnnyloans Disable sensors on as many apps as you can. What you type could theoretically be recreated in another app based on you tapping your phone and sensors picking up on it.

wow, scary. just saw it did have sensors...so sensors are connected with keyboard strokes?

Also I checked keyboard (futo) and i had sensors off. but the other app had sensors on.

Zayne

Johnnyloans What you type could theoretically be recreated in another app based on you tapping your phone and sensors picking up on it.

So apps with the sensor permission can perform keylogging?

Onlyfun

Johnnyloans

Can you share any article on this?

Johnnyloans

K8y

The app X having sensors would theoretically be able to ready the sensors of your phone vibrating and being impacted by your fingers.

The location of the tap changes the intensity felt by the sensor which is at a fixed location and there is a delay between taps (finger moving to the next letter) are clues.

It could figure out:
"Well they either typed: boat or mpdy
.... Probably boat"

Johnnyloans

K8y

You may be aware Of this already:

Easy place to check permissions
settings > security > privacy controls > permission manager > sensors

Novalissoide

K8y and go:
Settings > Security and privacy > More security and privacy > Allow sensors permission to apps by default
Toggle this OFF. And do it in secondary profiles and Private Space if any.

Johnnyloans

Or the situation could be:
you typed a word that's popular right now:
"I will go to the plant nursery for flowers."

Many people are doing that in spring.

Or while scrolling on X, it notices what you pause to look at and it knows your interests from last week or year.

Johnnyloans

Norman IDK why anyone else here isn't mentioning it.

Elysium

Johnnyloans Or the situation could be:
you typed a word that's popular right now:
"I will go to the plant nursery for flowers."

Many people are doing that in spring.

Or while scrolling on X, it notices what you pause to look at and it knows your interests from last week or year.

K8y

Johnnyloans app X having sensors would theoretically be able to ready the sensors of your phone vibrating and being impacted by your fingers.

how about network permissions, should this be toggled off too for privacy?

would toggling off sensors or network permissions cause normal comms apps like Signal to not work?

Norman

What keyboard did you use

K8y

Norman futo

Johnnyloans

K8y

Network would have to be on for X.

If the app gives or receives anything from the internet, you should have network on.

Sensors covers many things like
device orientation
air pressure (if the phone has it)
proximity to the screen like for auto screen off for phone calls
Movement (changes in acceleration)
Compass
How bright or dark it is
There could be more

Futo should be a safe keyboard

Norman

K8y

IDK why anyone else here isn't mentioning it. But considering you used a 'privacy comms app' with this keyboard, it is incredibly unlikely that your twitter feed showing you this image was related to your keyboard usage.

It's more likely to be related to your browsing behaviour on Twitter, or those that you follow. Or, if you don't use a VPN, a tracking cookie that shared 3rd party browsing behaviour with Twitter. Or just sheer coincidence.

HagbardCeline

Didn't know about the censors thing, now I'm paranoid removing it from every app including the system ones. Is there any app that really needs it, or that we should avoid removing the permissions from?

As for the keyboard, I've been using the GBoard with disabled internet access. This should prevent from leaking, no?

K8y

HagbardCeline I've been using the GBoard with disabled internet access. This should prevent from leaking, no?

is that done by toggling no for network permissions?

NoahRaketic

HagbardCeline I'm paranoid removing it from every app including the system ones. Is there any app that really needs it, or that we should avoid removing the permissions from?

You should not modify the permissions of any system apps. You can break things in unexpected ways by doing that. System apps are trusted. Don't tamper with them.

HagbardCeline As for the keyboard, I've been using the GBoard with disabled internet access. This should prevent from leaking, no?

No, this does not prevent data leakage. Gboard uses IPC with Play Services to send telemetry, not direct network access. The only way to stop Gboard from sending telemetry is by using the in-app privacy toggles.

The network permission is not an anti-data-exfiltration toggle. There are very many side channels that an app can use; it is not limited to IPC. If you don't think an app is trustworthy, you should not hand it sensitive data/permissions.

Johnnyloans

K8y

Correct. But you'd probably have to disable network for play services which would probably cause some apps to not work properly.

HagbardCeline

NoahRaketic

Understood, I'll add the permissions back again.

Is there a way to block apps from doing IPC?

NoahRaketic

HagbardCeline IPC scopes are a planned feature but have not been implemented yet. Currently, the only way to prevent two apps from communicating via IPC is by separating them across different secondary user profiles / private spaces.

Elysium

Norman IDK why anyone else here isn't mentioning it.

Sometimes I feel like people are actively looking for a solution to a very unlikely issue, rather than wanting to hear common sense.
We don't prepare for the thunderstorm hitting our house, but digitally some people are on that level lol.