Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping.
I live in China and this software is cancerous not just in the encryption failure, it also nestles into a computer like a trojan. Creates 2 fallback installations and will reinstall itself after removal if you reboot in between, unless you get rid of all 3 installations at once, where they are deliberately trying to obfuscate the uninstall button (triple confirmation, swapping the confirm/cancel buttons and button background colors, etc.).
It’s a nasty piece of crap that come preloaded on any phone (android, at least) and Windows-PC here.
It’s time to switch to Linux!
I mean the CCP is aiming to have people use Kylin? If the government and the entire populace starts using Linux instead we’ll just see the same BS on Linux instead. It’s not an OS/platform issue, but an issue of bad actors.
deleted by creator
Don’t worry, there is also a Linux version.
Oof
Then they’ll install the Linux version. People here are so indoctrinated, they like it.
Do people generally try to circumvent it? Are they too scared to uninstall it? Or do they just not care?
Worse. They think it’s useful.
Why? Useful for safety and security of the society?
Edit: Why downvotes? I’m trying to put myself in their shoes, it’s not how I view it lol
Comes with a built in translator and spell checker, and since access to Google translate is blocked, that’s often the only alternative.
Ah ok makes sense
Lol “I love this tool that they made, because they blocked me from Google translate.”
Nah. They don’t know Google translate. Or Google, for that matter. They know what they are supposed to know.
Of course some people know better, and those are the ones who will eventually get around the block - finding and installing a VPN is not rocket science, not even here. But if you keep 98% of the population contained, the rest won’t reach critical mass.
My guess is that it might either be more accurate in predictions or some additional convenience factors that makes typing this logographic language much easier and faster lol.
Or people are also simply used to it since it’s everywhere.
Didn’t swiftpad or whatever its called send every key pressed to Microsoft?
Not a China shill. China is horrible. Microsoft less so as they don’t commit genocide in slow motion. But still, I think this sort of thing is more common than we think.
Use FOSS.
I agree with the “Use FOSS” part, but I can’t help but notice a double standard thats often taken when these kinds of stories pop up. How come whenever a Chinese compant does something like this, China is always at fault? Why is it never America’s fault when something like this happens with an American company or product?
I wanted to ask if you were born yesterday but I’ll try to be more educative than sassy.
All companies in China exist purely with the blessing of the political party. No approval, no company. Everything is done by their books.
And in US is other way around, every political party has blessing of companies.
😂
Unexamined racism. “Collectivist asians” and denying Asian individuality is very normal in the US/Europe. Malcolm Gladwell can write a book saying Koreans are culturally incapable of flying an airplane and it’s fine. When Asians have human emotions it’s normal to turn it into some special exoticized thing like “saving face”. White people are individuals, Asians are a horde, nothing in Anglo culture prepares or encourages people to think about Chinese people as a billion individuals wandering around doing stuff for the same reasons you do. They’re a singular alien unit, if you go to war with Japan it’s only natural to lock all the Japanese people in a camp. Basically every book and newspaper article you’ve ever read talks about them they’re all wired together like the Borg, unless you put a ton of effort into critical thinking there’s no reason to escape that assumption.
Except the Chinese government has way more control over their companies than the US government does. In fact, there has been an explicit push recently by the government to increase their control and ownership of companies. It’s also consistent with how most large states operate, especially ones with a history of trying to control ethnically Chinese people outside of their borders.
That isn’t to say that a ton of anti China sentiment isn’t racist; it’s just that one doesn’t need to be racist make such a prediction. It’s true that many people who hate China hate it for the wrong reasons, but that doesn’t mean there aren’t things to take issue with.
Sure but stereotypes are involved in what you think a state owned bank owning 1% of Tencent stock practically means, and what kind of hateful thing you imagine a government that operates on the willing cooperation of millions of people is going to do with it. You don’t need to be racist to hate China, but there are a lot more racists than people who studied Chinese corporate structure and came to a rational conclusion about it.
I don’t know what “willing cooperation” has to do with anything. The US government has the willing cooperation of millions and had the willing cooperation of a majority of Americans in the past. That doesn’t mean the US government didn’t do some of the worst shit ever during the peak of their popularity. It’s also not like consent isn’t manufactured in China.
If anything, it’s my belief in the similarities of the Chinese and US governments that makes me think they would do hateful things with their power. People in China are the same as people here. I don’t have a rose tinted view of people here either.
What are the best FOSS options for Android keyboard apps? I’ve been struggling with this lately.
I use OpenBoard (it’s available on fDroid. Maybe the play store too).
I don’t know if it’s the best but I like it. If you type in multiple languages you do need to hit a “language switcher” key on the keyboard to switch to the autocorrect for that language. A very minor complaint. Otherwise it’s great.
And it will learn swear words. No more ducking ducks.
Seconded. I use Gboard because it has the same functionality but I have to sandbox it and restrict all internet access via firewall. I still don’t trust it and would prefer a FOSS alternative with the same functionality.
How do you do that?
You can sandbox an app using Shelter. You can block the internet access of that app using NetGuard. Both apps are available on F-Droid and easy to setup. No special OS needed but I strongly recommend GrapheneOS to avoid backdoors.
Thank you vm! NetGuard is awesome. I will test Shelter.
Glad to help. Consider dropping the NetGuard dev some coin, he’s doing incredible work. He also develops FairEmail which imho is the best IMAP email app in existence.
I’m partial to thumbkey. It even has a Lemmy community: !thumbkey@lemmy.ml
Thanks for the heads up. It’s really similar to the keyboard I use.
Think you mean SwiftKey which Microsoft just introduced bing AI into that you can’t turn off. I 100 percent assume they now use all your typing data to train their ai too. They won’t even let you use themes without logging in to an account so I again assume they also tie data to accounts.
deleted by creator
It’s stories like this that don’t surprise me as much as make me ask: How the fuck do you store and process this much data to get anything useful out of it.
You just save the first 50 digits typed after some email is typed, and you have all the passwords you need!
This only applies if a username is a email
And if it is then what happens when people actually email someone? Autocorrect during login?
I don’t think they’re saying that method would yield 100% clean data but it would give you all the “necessary” data with the absolute bare minimum storage requirement. At some point people will log into their email and for most people if you have their email password you have the password they use for everything
Yep, I only reacted to a “new requirement”: save space :)
China being China, no surprise here.
deleted by creator
As if other keyboard apps are any different, I don’t think Microsoft bought SwiftKey just for fun?!
Really? Isn’t this kind of thing scandalous enough to tank companies?
It’s in their EULA read their terms of services
I don’t get it? Why are they talking in the article about not using the right type of encryption. The problem isn’t the encryption, but the fact that it is sending your keystrokes to the mothership, right?
I feel like there should be a Lemmy version of everything now
I recommend free and open source software for everyone. Everything on this list is curated to feature the best alternatives to common proprietary software (according to Linux Cafe):
https://gitlab.com/linuxcafefederation/awesome-alternatives/-/blob/master/README.md
This list is good free, open source (FOSS) Android keyboards:
https://github.com/offa/android-foss#-keyboard
I think the best two are Simple Keyboard and AnySoftKeyboard. Simple Keyboard is pleasant to use, but is missing a several advanced features. ASK would be perfect if the swipe typing worked (it’s currently listed as beta, and is mostly actuate, but unfortunately when it does make a mistake fixing it is almost painful).
Finally, try to get comfortable going to alternativeto.net when you get frustrated with software. Worst case scenario you get frustrated with different software for a bit and switch back. Of course it notes the price and license model for each alternative.
ASK would be perfect if the swipe typing worked (it’s currently listed as beta, and is mostly actuate, but unfortunately when it does make a mistake fixing it is almost painful).
It crashes for me so often that I finally gave up using it.
Also there was a weird bug of where if you were working on a long document, towards the bottom of the document all of a sudden it will drag you all the way up to the top of the document, so then you had to scroll all the way back to where you were before, at the bottom of the document.
In a surprise to absolutely nobody, China spies on their people.
And everyone’s people
TIL this only happens in China
As opposed to which country?
It’s not a bug, it’s a feature.
deleted by creator
Look at this rich guy wasting chalk on his slate tablet, while everyone else has to use sticks and wet their mud tablets to erase them.
And it’s why I only use electrodes attached to my head that reads my thoughts
You’ll probably have breathing issues in the future, with that approach.
Never use a closed source keyboard app. It can read what you send for messages, websites you go to, search engine queries.
God bless gdpr
In fact it’s hard to find open source Chinese input methods that work well enough, the only ones I know of are Trime and Fcitx5_for_android.
Well, some links below: Trime: https://github.com/osfans/trime Fcitx5_android: https://github.com/fcitx5-android/fcitx5-android I’m currently using Fcitx5_android
These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.
lol.
The writer out here acting like this wasn’t an intended feature lol
And this is the only point of the article. Idk what all these other comments are on about, but this article is outlining lack of standardized protocols that made the software vulnerable to network eavesdropping.
This doesn’t point to a big CCP conspiracy, it’s just bad design.
