Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping.
I live in China and this software is cancerous not just in the encryption failure, it also nestles into a computer like a trojan. Creates 2 fallback installations and will reinstall itself after removal if you reboot in between, unless you get rid of all 3 installations at once, where they are deliberately trying to obfuscate the uninstall button (triple confirmation, swapping the confirm/cancel buttons and button background colors, etc.).
It’s a nasty piece of crap that come preloaded on any phone (android, at least) and Windows-PC here.
It’s time to switch to Linux!
I mean the CCP is aiming to have people use Kylin? If the government and the entire populace starts using Linux instead we’ll just see the same BS on Linux instead. It’s not an OS/platform issue, but an issue of bad actors.
On the plus side maybe then it’ll finally be the year of the Linux desktop.
monkeys paw curls
Don’t worry, there is also a Linux version.
Oof
Then they’ll install the Linux version. People here are so indoctrinated, they like it.
As if other keyboard apps are any different, I don’t think Microsoft bought SwiftKey just for fun?!
Really? Isn’t this kind of thing scandalous enough to tank companies?
It’s in their EULA read their terms of services
It’s not a bug, it’s a feature.
So use Fcitx 5 Android instead. It’s a open source IME application without requesting any permission except Notification, especially without network permission.
https://github.com/fcitx5-android/fcitx5-android
It’s stories like this that don’t surprise me as much as make me ask: How the fuck do you store and process this much data to get anything useful out of it.
You just save the first 50 digits typed after some email is typed, and you have all the passwords you need!
This only applies if a username is a email
And if it is then what happens when people actually email someone? Autocorrect during login?
I don’t think they’re saying that method would yield 100% clean data but it would give you all the “necessary” data with the absolute bare minimum storage requirement. At some point people will log into their email and for most people if you have their email password you have the password they use for everything
Naomi Wu has literally been talking about pwnd Chinese IMEs for years in her sidechannel critiques of Signal.
Didn’t swiftpad or whatever its called send every key pressed to Microsoft?
Not a China shill. China is horrible. Microsoft less so as they don’t commit genocide in slow motion. But still, I think this sort of thing is more common than we think.
Use FOSS.
What are the best FOSS options for Android keyboard apps? I’ve been struggling with this lately.
I use OpenBoard (it’s available on fDroid. Maybe the play store too).
I don’t know if it’s the best but I like it. If you type in multiple languages you do need to hit a “language switcher” key on the keyboard to switch to the autocorrect for that language. A very minor complaint. Otherwise it’s great.
And it will learn swear words. No more ducking ducks.
deleted by creator
I only dislike it for German. My other languages are Spanish and English, which have the same layout minus one extra key not even used in English. But in German Z and Y change places, so that always trips me up.
Having to remember to switch to the different language when writing a bilingual email is also annoying and does happen somewhat more often than you’d imagine.
For m
“Notice the lack of surprise.”
Imagine willingly installing a keylogger, lol
Same with Microsoft keyboard and almost every other keyboard app.
So when the Chinese do it it’s scary, but when the Americans do it it’s just “established practice”?
Neither of the groups should be allowed to do it.
Whataboutism doesn’t really apply when pointing out a double standard. It’s true that both places shouldn’t do the bad thing, but it’s more about the individual’s reaction to that thing depending on who does it. The average US citizen will criticise the CCP for doing plenty of the same things their government currently does, or has done in the past, that they support.
Furthermore, it’s important to note that when this kind of thing happens, people treat it as China’s government’s fault, but when Tesla cars explode, people don’t consider that the US government’s fault.
I don’t get it? Why are they talking in the article about not using the right type of encryption. The problem isn’t the encryption, but the fact that it is sending your keystrokes to the mothership, right?
In a surprise to absolutely nobody, China spies on their people.
As opposed to which country?
And everyone’s people
TIL this only happens in China
