Warning to third party smartphone keyboard users.

[Callanta787]

This warning is for those who uses mobile keyboard from third party websites or download from playstore ,some keyboards are stealing records of your account numbers ,backup phrases and private keys eg touchpal keyboard ,stick with the keyboard that comes integrated with your smartphone.

Check out the image below to see what I'm talking about

[mk4]

Typing up your recovery seed on your phone is definitely a bad idea in terms of security; especially if you're storing big amounts. If I remember correctly, there was an article I've read last year concerning recovery seeds and a certain keyboard app storing keyboard inputs on their servers. Can't remember the whole story though.

As always, for big amounts of funds, hardware. wallets.

[Callanta787]

I was shocked to detect this today and I quickly uninstall the keyboard ,at the same time I have to move all my coins and tokens out of the wallet I imported the backup phrase seed using the keyboard to another new wallet right after getting rid of the shady keyboard. Not all apps are safe to use

[bernardos]

I am not too surprised really, I was wondering when something like this would happen.
A close friend of mine has several of these third party keyboards installed, just because they look better. He makes fun of me cause I use the standard keyboard that comes on every phone. I never understood what the benefit of having such software on your phone is. I mean you press the button and if it registers the inputs correctly that is all I am interested in, does it really have to be fancy as well?

Thanks for informing is about such possibilities of misuse.

[Indamuck]

Not surprised at all, at this point you need to assume anything you type, search, copy&paste, say, location, etc will be tracked and recorded when you are on a device connected to the internet.

[mersal]

This warning is for those who uses mobile keyboard from third party websites or download from playstore ,some keyboards are stealing records of your account numbers ,backup phrases and private keys eg touchpal keyboard ,stick with the keyboard that comes integrated with your smartphone.

Check out this link to see what I'm talking about
http://imgur.com/bdOtcjq

This is the reason why most of the bank accounts got hacked.

Anyone heard of virtual keyboards while using them they keyloggers won't harm us,for typing password we need to use virtual keyboards.

And don't use any chinese related keyboards they don't have security for our personal info.

[Harlot]

That's the problem with Google's playstore literally any developer can upload their app and be available to other people. There are no screening process or background checks done to this apps that is why a lot of them are ready for download. The thing is if you aren't really in need of those apps do not be tempted on downloading them especially the ones who have a few downloads and a bad rating because they aren't really worth it for you to try out.

[LTU_btc]

Thanks for warning. Honestly, I never thought about it. But when you can find thousands of third party keyboard apps, it might be big issue. As I understand, even major keyboard apps used by millions aren't good to use in terms of privacy - most of them collect all this data. I'm not even talking about all these less known apps. Though I haven't heard I haven't heard about victims who lost something because his data was stolen through phone keyboard.
I use default my phone keyboard Gboard by Google and as I understand they also collecting lot of data. It's really concerning thing when keyboard provider may know all my passwords, pin codes and other secret information.
Maybe someone can suggest keyboard app good in terms of privacy which don't collect all this data, I think it may be useful to know for lot of people here.

[o_e_l_e_o]

Typing up your recovery seed on your phone is definitely a bad idea in terms of security

As soon as you type your mnemonic phrase in to any electronic device (with the exception of a properly permanently air-gapped device), you should immediately consider it compromised and transfer all funds under that phrase to a new wallet.

Obviously third party keyboards are a risk, but please realize that the default keyboard is going the exact same thing - collecting all your inputs - and sending them to Google, Apple, Samsung, etc.

Also be aware that any third party app you download, not just keyboards apps, is a potential security risk if you are also storing crypto on your phone. Even some "trusted" wallet apps are a risk - for example, Coinomi was found to be using Google servers to spell check users who were entering their mnemonic phrase.

[dothebeats]

That's why Electrum moblie has its own keyboard for retyping the seed for recovery because the team knows that third-party keyboards do have the ability to hijack clipboard words and other saved strokes (virtual keylogging anyone?) I only use an iPhone for banking-related things and important documents. It serves as my work phone while Android, a Galsxy s9+, is mainly for leisure and entertainment purposes. Good thing wallet developers know better, and the use of their own virtual keyboard is a way to avoid using third-party keyboards if it was installed on a phone.

[boyptc]

I'm glad that I don't download any third party or customizable keyboards. I stick to the integrated one.

But this is an eye opener and great reminder to those who loves to download those kind of smartphone keyboards that never use such and the traditional way of keeping your private keys/seeds through writing is still the best.

Thank you for the reminder, I've appreciated your warn.

[mk4]

Good thing wallet developers know better, and the use of their own virtual keyboard is a way to avoid using third-party keyboards if it was installed on a phone.

Or better, instead of actually letting you type in your recovery seed when verifying the words after you create a new wallet, some of the better wallets instead lets you tap on the words. Great UX + better security, a win-win. Importing previously made wallets is another story though.

[BuxCoin]

many will download those fancy keyboard and use them , many website like net banking will display a separate keyboard or many anti virus software will also provide keyboard which is much safer to use

[Doranile432]

We have 100s of fancy keyboards on play store on android devices but stop trusting apps from playstore since I download a VPN that has inbuilt malware ,thank God I was able to detect when scanning using Antivirus

[ePesoInitiative]

Even some "trusted" wallet apps are a risk - for example, Coinomi was found to be using Google servers to spell check users who were entering their mnemonic phrase.

Jesus Christ! Glad I never use a phone for storing private keys. You are literally donating your bitcoins.

[rhomelmabini]

Good thing I never use these third-party keyboards and to be honest it is just a waste of RAM too if they are to be installed. Better if we stick to the default.

[Herbet Fry]

This is really scary. I wonder if a keyboard theme can do the same thing? Do you guys think it could record keystrokes as well? I guess it's best to use well know the software. I use grammarly on my phone and it has it's own keyboard. I am very hesitant to give details like private keys and passwords into third-party software. What else should we be careful of when using the google store? Pretty scary you must remain so vigilant.

[DdmrDdmr]

<...>

Allegedly Grammarly does not log your key strokes:
https://support.grammarly.com/hc/en-us/articles/360003816032-Is-Grammarly-a-keylogger-

passwords.
Grammarly does not record every keystroke you make on your device. Grammarly accesses only the text you write using a Grammarly product, and only for the purposes of checking your text and providing corrections. Additionally, Grammarly does not process anything you type in text fields marked "sensitive," such as credit card forms or password fields.

Of course you can always find statements to the contrary: https://techbeacon.com/security/grammarly-leaks-everything-youve-ever-typed-service-everything (2018 article):

Tavis Ormandy discovered that any webpage could easily hijack your session and steal all the information in your Grammarly account. And that includes absolutely everything you've typed into the service.

Although the above may have been addressed since then, it does go to state that nothing is free from vulnerability, so the less third-party whatever’s that can access your keystrokes the better.

We’ve also got the following to go by from reading Grammarly’s privacy policy: https://www.grammarly.com/privacy-policy#how-secure-is-my-information

Grammarly is committed to protecting the security of your Information and takes reasonable precautions to protect it. However, Internet data transmissions, whether wired or wireless, cannot be guaranteed to be 100% secure, and as a result, we cannot ensure the security of Information you transmit to us, including Personal Data and User Content; accordingly, you acknowledge that you do so at your own risk.

See also: https://www.quora.com/Is-it-safe-to-use-Grammarly