In this report, we analyze the Windows, Android, and iOS versions of Tencent’s Sogou Input Method, the most popular Chinese-language input method in China. Our analysis found serious vulnerabilities in the app’s custom encryption system and how it encrypts sensitive data. These vulnerabilities could allow a network eavesdropper to decrypt sensitive communications sent by the app, including revealing all keystrokes being typed by the user. Following our disclosure of these vulnerabilities, Sogou released updated versions of the app that identified all of the issues we disclosed.
Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping.
Doesn’t the iOS keyboard have all kinds of apps tied to it and do more than just a keyboard? Also can’t iOS users install 3rd party keyboards like Gboard on iOS just like Android? I’m not sure what the deal is, but having more than one option is good for everyone.
The iOS keyboard definitely has integrations that I never use, but I am just learning that you can, in fact, download wholesale keyboard apps on iOS as well. Skimming them through, they have a ridiculous number of installs (judging by the number of reviews) and atrocious privacy policies. The last part is concerning! 😅
Doesn’t the iOS keyboard have all kinds of apps tied to it and do more than just a keyboard? Also can’t iOS users install 3rd party keyboards like Gboard on iOS just like Android? I’m not sure what the deal is, but having more than one option is good for everyone.
The iOS keyboard definitely has integrations that I never use, but I am just learning that you can, in fact, download wholesale keyboard apps on iOS as well. Skimming them through, they have a ridiculous number of installs (judging by the number of reviews) and atrocious privacy policies. The last part is concerning! 😅