Small Number of SwiftKey Users Discover App Leaked Private Data to Strangers

[MacRumors]

A week after launching a new emoji-predicting keyboard, SwiftKey is now facing some pushback after a few users noticed that the main SwiftKey app was propagating suggestions related to the email accounts, phone numbers, and names of complete strangers (via The Telegraph). The Microsoft-owned app, available on iOS and Android, is widely known for its artificial intelligence and machine learning tools, which create custom word predictions based on what each user has previously typed.

In order to fully take advantage of these features, SwiftKey accesses various personal bits of information -- previous texts, emails, and regularly used names and phrases -- to bolster its database, with a synchronization feature that keeps all of a user's data updated across various devices. Now, one SwiftKey user has discovered that someone unknown to them was given access to this data thanks to the app's predictive features. Thankfully, the stranger was helpful in informing the compromised user about their privacy slip.

"A few days ago, I received an email from a complete stranger asking if I had recently purchased and returned a particular model of mobile phone, adding that not one but two of my email addresses (one personal and one work address) were saved on the phone she had just bought as brand-new," said the user. "It also suggested, when she typed a zero, the telephone number for someone I had phoned recently."

According to the anonymous source, the stranger went through every letter in the alphabet and got predictive suggestions of the affected user's contact list and even the address of private servers used to connect to the internet at their workplace. A similar occurrence happened for one Redditor recently, but this time it crossed a language barrier as well, with German predictions of private information suggested for a user in the United Kingdom.

According to SwiftKey, the problem stems from a bug in that synchronization feature, so the company has deactivated syncing information across devices until it can get to the root of the problem. A spokesperson for the company said, "Recently, a limited number of our customers noticed unexpected words pre-populating when typing on their mobile phone," but promised users that the app is "okay to use" in the meantime given the low number of users affected and that their personal data will not be lost while the sync ability is down.

Article Link: Small Number of SwiftKey Users Discover App Leaked Private Data to Strangers

 

[macduke]

This is one of the reasons I don't use third party keyboards. And probably the reason Apple restricts their use for password fields. But the main reason, even after two years, is because they still seem to be glitchy. The Google keyboard was handy, but I just know they're mining my data. No thanks!

 

[2457282]

When alternate keyboards first came to the iphone I tried downloading them. First question is to give the app 100% access to my phone. Never thought that was needed or appropriate so I decided not to use these keyboards. Today we have an example of the potential danger of giving full access. This I am sure is a bug that will get fixed, but I am always leary of other apps that could be more malicious.

 

[Glassed Silver]

Any third-party keyboard that wants internet access gets binned, plain and simple.

Is the implementation still as ****** as before on the latest iOS releases?

I haven't checked in a while, but I'd love to use something other than the awful stock keyboard again, I'm just not into crashes, the keyboard not showing or these sorts of shenanigans (well, I wouldn't grant online access anyways)

Glassed Silver:mac

 

[infinitejest]

Yep, that's exactly why I don't use third party keyboards.

 

[C DM]

This is one of the reasons I don't use third party keyboards. And probably the reason Apple restricts their use for password fields. But the main reason, even after two years, is because they still seem to be glitchy. The Google keyboard was handy, but I just know they're mining my data. No thanks!

Just don't give the keyboard full access.

 

[TrueBlou]

Well colour me shocked, apps (and the keyboards are apps) that request and are given full access to everything you have/do/type, collate personal information. And naturally once that information is stored somewhere even you don't have access to, it becomes at risk.

This is precisely why I don't use them and avoid services that are "free" whenever I can. Such as these, Google and so on and so on. Nothing is free, many of the companies make millions/billions off the back of your information. When your information becomes a commodity it's no longer something that is private, safe or confidential. Sure I need to use Twitter and Facebook for work and the wife insists on using it to keep in touch with our family, but I don't, not for my personal life.


I'm sure I was going somewhere with that rant, bloody morphine
Anyhoo, probably like most people I gave these a shot when they first appeared, at the first hurdle of wanting access to both my information and the internet they were swiftly (pun certainly intended) deleted.

I'll stick to the stock Apple keyboard and services where possible at the very least they should offer a better than average chance of anonymity and security. Not that I've anything to hide, I'm perfectly open, as anyone who's suffered my rants on here will know but it's a principle thing, I like control of what's mine.

 

[Oblivious.Robot]

I remember downloading Swiftkey when it was laughed way back then, and got rid off it when it wanted full access and the Apples warning dialogue showed up.

Edit - If I remember correctly either this or multiple other keyboard apps require full access to even work, yes?

 

[TrueBlou]

I remember downloading Swiftkey when it was laughed way back then, and got rid off it when it wanted full access and the Apples warning dialogue showed up.

Edit - If I remember correctly either this or multiple other keyboard apps require full access to even work, yes?

Pretty much, or at least they "need" access for the features you'd want them for in the first place. Last I used them they were very little beyond a standard keyboard without it.

 

[macduke]

Just don't give the keyboard full access.

I guess, but then that often mitigates a lot of the benefits in the first place.

 

[C DM]

I guess, but then that often mitigates a lot of the benefits in the first place.

Sometimes it does, often enough it doesn't (to some degree depending on what you want out of the keyboard).

 

[miknos]

Just an example of why you should never give full access to third party keyboard. Some even ask for your contacts!

Luckily many work without giving full access. I'm using Path Input and I'm loving it.

 

[avanpelt]

If Apple would just add a swipe keyboard and make their predictions better, there would be much less reason for people to seek out the SwiftKey solution.

For example, I'm often typing out a town name called Sugar Hill. I've been doing this for years with the Apple keyboard. Even so, when I type in "Sugar" and then add a space, the predictions from the Apple keyboard are "and", "in", and "daddy". If I toggle the caps lock on to make it even more obvious that I want it to predict "Hill", the predictions simply change to "And", "In", and "Daddy". I don't think I've used the term "Sugar Daddy" a single time on any of my iOS devices.

In my experience, Apple's keyboard does not seem to learn based on what you type despite the fact that Apple says it does.

 

[LizKat]

When alternate keyboards first came to the iphone I tried downloading them. First question is to give the app 100% access to my phone. Never thought that was needed or appropriate so I decided not to use these keyboards. Today we have an example of the potential danger of giving full access. This I am sure is a bug that will get fixed, but I am always leary of other apps that could be more malicious.

I'd love a reliable alt keyboard, but for it to be useful it must be predictive past fixing typos. And that’s the sticking point for me right there. It has to gather at least some data about me, and in permitting that then I may put at risk info I’d rather not see distributed more widely. It’s hard to see how a company can actually make assurances that a “glitch” won’t happen. Even the best of apps can have "one or two" bugs...

As far as testing any new app, I can be enthusiastic but I'm also wary. I might think I need it or want it, but what I don't need is something half-baked or misbehaving to the point of causing me to wipe my device and start over. How many times do I want to wonder if my personal data was compromised anyway?

So I maintain an extra iPod touch with an isolated username setup and only the stock iOS permanently maintained on it. When I’m interested in a new app, I download it onto that device for openers. I want to see what it asks for and how it behaves for awhile. Some apps never get past that step.

But if I like the app then I put a special throwaway mail account on my testing device and use it to surf the news sites like AP or Reuters for a while, mailing links from it to another dummy account that I have on an old iPad Mini (also having only a stock setup on it).

And so forth -- gradually widening the test device’s window on the world and checking to see how the new app behaves in assorted circumstances. If I have questions or concerns, this is the timeframe in which I ask developers questions.

If after awhile I haven’t noticed any weird behavior while using the app as well as the browser and test mail account, then I ditch the test setups, cleaning off the testing devices so they’re ready for use again sometime. LOL well it’s a way to justify having the old gear around anyway.

Final step: think whether I really need that app, and then if I like it enough, install it on my iPhone or iPad.

I'd love to have an alt keyboard that could pass that shakeout. So far? Still waiting.

 

[Glassed Silver]

If Apple would just add a swipe keyboard and make their predictions better, there would be much less reason for people to seek out the SwiftKey solution.

For example, I'm often typing out a town name called Sugar Hill. I've been doing this for years with the Apple keyboard. Even so, when I type in "Sugar" and then add a space, the predictions from the Apple keyboard are "and", "in", and "daddy". If I toggle the caps lock on to make it even more obvious that I want it to predict "Hill", the predictions simply change to "And", "In", and "Daddy". I don't think I've used the term "Sugar Daddy" a single time on any of my iOS devices.

In my experience, Apple's keyboard does not seem to learn based on what you type despite the fact that Apple says it does.

That's my feeling with a lot of what they promise these days.

Siri is the same. Still as ****ing clueless about anything as on its first day.
Still never learned a thing from when I corrected words by hand, hoping it's a form of feedback that'll train her, because according to Apple Siri learns my speech on the fly.

It does **** all and the keyboard is pretty similar in that.

I hope they didn't invest a lot of time into these features, or they are just vapor features to begin with.

It doesn't take freaking mass data crunching to learn that when word B follows word A very frequently, maybe word B should get priority for word suggestions.

Glassed Silver:ios

 

[tkukoc]

I use word flow (Also-Microsoft's) on my SE but stick to the stock keyboard on my 6s+. Really wish Apple would just add in a swipe keyboard! There's plenty of people who would use it. And since they would design it, they could leave the dictation button there as well.

 

[JosephAW]

Apple promised no one could get our data. Deleting swift keyboard now.

 

[chriscrk]

For example, I'm often typing out a town name called Sugar Hill. I've been doing this for years with the Apple keyboard. Even so, when I type in "Sugar" and then add a space, the predictions from the Apple keyboard are "and", "in", and "daddy". If I toggle the caps lock on to make it even more obvious that I want it to predict "Hill", the predictions simply change to "And", "In", and "Daddy". I don't think I've used the term "Sugar Daddy" a single time on any of my iOS devices.

"I DON’T HAVE A SUGAR DADDY . I’VE NEVER HAD A SUGAR DADDY . IF I WANTED A SUGAR DADDY, YES I PROBABLY COULD GO OUT AND GET ONE. BECAUSE I AM WHAT⁉ SICKENING! YOU COULD NEVER HAVE A SUGAR DADDY BECAUSE YOU ARE NOT. THAT. KIND. OF. GIRL. BABY EVERYTHING I HAVE I’VE WORKED FOR AND GOTTEN MYSELF. I HAVE BUILT MYSELF FROM THE GROUND UP... YOU ****ING BITCH‼"

 

[0098386]

I gave Swiftkey a go when 3rd party keyboards were first available. I liked it, but I deleted it soon after reading about privacy concerns. Really glad I did now.

 

[Shirasaki]

If SwiftKey just happen to be the keyboard leaking user input, then a third party keyboard from China requires full access to ALMOST any feature it has when trying to play it around. Without full access that keyboard is just a keyboard, with a little bit better localisation for Chinese I think.
Nowadays promise is something disposable. Any company can turn around and magically forget whatever they said before.

 

[RMo]

According to SwiftKey, the problem stems from a bug in that synchronization feature

The idea of SwiftKey Cloud (that's what this feature is) always made me nervous, so I'm glad I never turned it on. The keyboard is usually pretty good, but sometimes it picks up things like e-mail addresses or phone numbers (and if you're using Remote Desktop, Citrix, etc., it might even pick up passwords--iOS switches to the native keyboard for these designated fields, but when it's not a native widget it doesn't know).

Just don't give the keyboard full access.

That's not really the issue here, at least if you believe two points SwiftKey claims:

1) Full Access technically allows the keyboard to access the Internet, but, unless otherwise instructed, SwiftKey only uses Full Access to communicate and share data between the SwiftKey keyboard itself and the SwiftKey app installed on your phone (languages, skins, etc.).

2) SwiftKey only transmits data on the Internet if you enable SwiftKey Cloud (which, of course, also requires Full Access, but Full Access, but having Full Access doesn't mean Cloud is enabled).

 

[C DM]

The idea of SwiftKey Cloud (that's what this feature is) always made me nervous, so I'm glad I never turned it on. The keyboard is usually pretty good, but sometimes it picks up things like e-mail addresses or phone numbers (and if you're using Remote Desktop, Citrix, etc., it might even pick up passwords--iOS switches to the native keyboard for these designated fields, but when it's not a native widget it doesn't know).



That's not really the issue here, at least if you believe two points SwiftKey claims:

1) Full Access technically allows the keyboard to access the Internet, but, unless otherwise instructed, SwiftKey only uses Full Access to communicate and share data between the SwiftKey keyboard itself and the SwiftKey app installed on your phone (languages, skins, etc.).

2) SwiftKey only transmits data on the Internet if you enable SwiftKey Cloud (which, of course, also requires Full Access, but Full Access, but having Full Access doesn't mean Cloud is enabled).

Well, if full access isn't provided then none of that could even be in play anyway. But, yes, I guess to be more technical in this specific case, there might be another option beyond full access that can control the particular cloud aspect of it all that is in question here. That said, it's not that something bad was done on purpose or anything like that, it was an error of some sort.

 

[aces99]

That's my feeling with a lot of what they promise these days.

Siri is the same. Still as ****ing clueless about anything as on its first day.
Still never learned a thing from when I corrected words by hand, hoping it's a form of feedback that'll train her, because according to Apple Siri learns my speech on the fly.

It does **** all and the keyboard is pretty similar in that.

I hope they didn't invest a lot of time into these features, or they are just vapor features to begin with.

It doesn't take freaking mass data crunching to learn that when word B follows word A very frequently, maybe word B should get priority for word suggestions.

Glassed Silver:ios

Tell me about it, Siri is about a useless as tits on a bull. He/she rarely understands what I say and brings me everything but what I am asking for & need. The predictive & auto correct keyboard is just as bad. I type better and faster without it because when I am typing a word and click the space bar it changes the word I had right to something else. So I have to go back and change it back. It does that constantly so I am always loosing time having to reread everything I type and having to go back and change the words it got wrong. So I finally just quite using it as it was slowing me down. But I really wish they would perfect it as it does have promise and usefulness if they got things right.

 

[RMo]

there might be another option beyond full access that can control the particular cloud aspect of it all that is in question here. That said, it's not that something bad was done on purpose or anything like that, it was an error of some sort.

There is another option--it's the option to enable SwiftKey Cloud.

But yes, this was an error on their part and I didn't mean to imply differently. But mistakes do happen and it's one reason I'm glad I haven't enabled Cloud. (There could even be a "mistake" where it transmits this data without Cloud enabled since Full Access technically allows that, but hopefully their claims are accurate.)

 

[C DM]

There is another option--it's the option to enable SwiftKey Cloud.

But yes, this was an error on their part and I didn't mean to imply differently. But mistakes do happen and it's one reason I'm glad I haven't enabled Cloud. (There could even be a "mistake" where it transmits this data without Cloud enabled since Full Access technically allows that, but hopefully their claims are accurate.)

Right, I understood it basically the way you meant it. I was just saying that (at least if I recall correctly) the top level kill switch for it all is basically the full access option--if that is never granted or is disabled then people who aren't sure or are worried about something won't really need to worry about it.