In this report, we examine cloud-based pinyin keyboard apps from nine vendors (Baidu, Honor, Huawei, iFlyTek, OPPO, Samsung, Tencent, Vivo, and Xiaomi) for vulnerabilities in how the apps transmit user keystrokes. Our analysis found that eight of the nine apps identified contained vulnerabilities that could be exploited to completely reveal the contents of users’ keystrokes in transit. We estimate that up to one billion users could be vulnerable to having all of their keystrokes intercepted, constituting a tremendous risk to user security.
  • moon
    21•2 months ago

    A billion vulnerable users is wild. I’m sure there are government entities taking advantage of this already

      • StellarExtract
        10•2 months ago

        Damn, I didn’t know what had happened to her. I really liked her content.

      • delirious_owl
        5•2 months ago2 months ago

        Yeah and didn’t she work with Citizen Lab in the past about this? I’m wondering what’s new here.

        • Aatube
          2•2 months ago

          What’s new is that apparently “We reported these vulnerabilities to all nine vendors. Most vendors responded, took the issue seriously, and fixed the reported vulnerabilities, although some keyboard apps remain vulnerable.”