Revoking network access from GBoard

[deleted]

Real talk. People who use GBoard, do you revoke network access or do leave it be? Disabling it reeks of privacy theatre, but feels good (even though the IPC is still available). Most importantly, how do you know if it needs it and for those of you who use Faster Voice, if your on-device voice models are still good? My context is Owner profile with Play services installed.

Enas

[deleted] I also am haunted by that thought. Though I don't have any google services or other google related apps installed. Still the only reason I use it with network enabled is for the spelling check of my local language (dictionary) and word prediction that is not supported as soon as I disable the network access.

N1b

[deleted] What about GBoard is it you like so much that you want to use it and are there alternatives that can do this for you?

I wrote an answer to your questions in this thread, the short version: Google can and probably will still track your keyboard inputs through other Google apps when installed and Google Voice input seems to run worse with no internet access, but there are good/better open source alternatives.

Hope it helps.

router99

[deleted]
Privacy theater? Surely you are being satirical. Absolutely revoke all permissions to it. That's a no brainer.

N1b What about GBoard is it you like so much that you want to use it and are there alternatives that can do this for you?
The ability to glide my finger across it to type is a big selling point. I used one of the keyboards available on F-droid on my previous phone and it required typing each letter. I still do it sometimes out of habit but it is much faster to glide.

spiral

[deleted]

Revoke revoke revoke

NightSky

Revoke every permission.

[deleted]

Enas Have you tried turning network on, removing and re-adding languages you need and then toggling Network off. This was how managed to make Faster voice typing work offline for my native language. Spell check shouldn't require real-time Network access.

[deleted]

N1b Thanks, I'll check out FUTO, but that thread doesn't seem to convene on a Gboard/SwiftKey all around open source replacement that's actively maintained, has a Direct Boot support, word suggestions, incognito mode, good design choices etc.

acutebee

N1b In my case, text correction just works, even using multiple languages it knows what I'm trying to say and the typing experience is fantastic. There is no open source keyboard that does that.

ve3jlg

N1b Google can and probably will still track your keyboard inputs through other Google app

I am no fan of Google and won't install any of their spying crapware on GOS or any of my computers.

But do you have any evidence, anything you can link to, to justify your statement?

Without evidence, I believe that people should believe your claim as little as they trust Google.

[deleted]

router99 Why is it a no-brainer? They're upfront about how it works, but opaque about some its less conspicuous data collection. They're not exfiltrating your key stokes and disabling network permission is mostly a matter of tradeoffs, not a no-brainer. I'm just trying to read the room here.

ve3jlg

[deleted] good design choices

frequently completely subjective to the user

bayerelm

[deleted]
The paper you link here looks interesting. However, I still don't really understand why you seem to believe that revoking the internet access permission would be a privacy theatre? Without internet access, there is absolutely no way for Gboard to send any data anywhere, at least for people who do not have Google Play Services installed. With GPS, I suppose there is the technical possibility for Gboard to contact GPS, but it is doubtful whether Google can collect substantial amounts of data that way (this is not what this process is for).

I understand the worries of this latter scenario, but I'm sure revoking internet access to Gboard does help your privacy substantially and isn't in any way a "privacy theatre."

Enas

[deleted] there is no Greek language spell checking pack to download for gboard unfortunately. But, all I did is left Gboard with network permission for a day used the Greek spell checking (assumed that it installed it somehow) and today I tested it with all the permissions revoked and it works!!! Thanks for the help!

[deleted]

bayerelm

Without internet access, there is absolutely no way for Gboard to send any data anywhere, at least for people who do not have Google Play Services installed.

Gboard could technically still send data via Bluetooth, Wi-Fi, Ultrasonic high-frequency sounds.

With GPS, I suppose there is the technical possibility for Gboard to contact GPS, but it is doubtful whether Google can collect substantial amounts of data that way

Its not doubtful at all. Interprocess communication is a thing that actually works.

[deleted]

bayerelm I appreciate the thoughtful reply. I already have Gboard usage analytics and 'Improve for everyone' disabled. Given that it respects my choices (I have no proof to the contrary) and with IPC still available, most of it comes down to personal trade-offs and not some substantial privacy gains. Are you okay to cut its remaining chatter at expense of no real-time translation, subpar offline voice-to-text, no GIFs and no sticker search? Even emoji search scoffs at no network access for some reason, but ultimately works. That said, I have Network disabled for anyone wondering, but discussion never hurt anyone.

N3rdTek

Gboard is the best peck typing and finger swypojg keyboard sadly. SwiftKey is a close runner-up. I had been using gboard with pretty much all the regular permissions active except location contacts and the questionable ones, but I had network on for the GIFs.

Very recently however though I have made the switch almost entirely to swiftkey, there was a singular instance where gboard suggested two emojis that a friend of mine would use every now and then that are not placed next to each other in the normal Emoji layout.
Now, this very well could be simply because I had network access on, but I had every other analytic and "improve for others" features disabled. I've never seen Gboard suggest emojis like it did and it's never suggested accurate text or predictions. But once I saw that I get why people fret on Gboard.

Sucks it's quite literally the best keyboard.
Ironically iOS Gboard and SwiftKey sucks ass.

router99

N3rdTek Your concern is really the type of emojis available?? Of all things relevant to the security and privacy world, it's emojis that are of utmost importance?

GrouchyGrape

I used gboard forever as it was simply the best for gesture typing which I can't currently live without. Then I found a fork of OpenBoard that enables gesture typing. I simply added Google's gesture typing library and it feels almost identical to gboard. Highly recommend.

Disclaimer: I'm not a developer and didn't/don't know how to read code and audit the source. So use caution if your threat model requires that.

N3rdTek

router99 available? No you didn't even read my post.
It suggested a very specific grouping of emojis that only one of my friends use in conversation, he used to do something like 🥵🫦 which if you try looking in the Emoji drawer those two do not exist next to each other, so there would be literally no reason for a keyboard to suggest them unless it is learning from my typing habits. So even though I had the majority of the Analytics and learning features disabled the fact it's still learned which Emojis my friend would use, despite not having used them in several months, I find very concerning.

As a result Now I understand why everyone Rants and Raves about disabling network access for gboard

Besides, who the hell made you king of Privacy and Security? Does only one threat model exist now and if it isn't yours prepare to be mocked?

[deleted]

I used FlorisBoard in the past which has gesture typing and when you type emojis, you get recent emoji tab where your frequent emojis are grouped together. It might be of interest to you. That is if I remember correctly @N3rdTek

TranceSeven

Sadly, FlorisBoard's swipe implementation is lacking precision and does not yet fill in the alternative suggestions above the keyboard. Also, only US English is currently supported. Note that this is with the "alpha" releases of 0.4.0, which hasn't been updated in over a year now. Work is still underway though and the last commits were in June.

I've no doubt it's a lot of work to get this right and they're never going to be able to compete with a team of Google's developers.