WARNING when using mobile device wallets (Android, iOS)

[NotATether]

Mobile wallets are not exactly the most secure wallets in the world, but in case you really have to use them, please keep in mind one very important piece of information.

DO NOT use third-party keyboards while you are using the wallet app!

Somebody has already been robbed because of this. You must only use the stock Android or Apple keyboard, and no others. Better if you uninstall all 3rd party keyboards completely. They collect all data you type on the keyboard at all times, which is a requirement for them to function properly, and there is no telling who is at the other end of the server!

[1714490520]

1714490520

[1714490520]

1714490520

[1714490520]

1714490520

[1714490520]

1714490520

[o_e_l_e_o]

Ideally, you should only use open source wallet apps which use their own virtual keyboard for entering seed phrases, where you can verify exactly what the keyboard is doing. Electrum is one such example. Even using the stock Android or Apple keyboard isn't completely safe. These stock apps are usually not open source and are so deeply embedded in the phone's firmware that it is near impossible to verify if anything suspicious is happening in the background. And neither Google nor Apple exactly have a great reputation when it comes to privacy, data harvesting, and spying on users/collecting data they promised they wouldn't.

[Charles-Tim]

I am using Android keyboard. I use to report some posts with the same sentence like 'not bitcoin discussion related, move to trading discussion. Did you know that only what I just need to put down is 'not bitcoin, and all other words will be suggested and I just need to click on them one by one to make the complete sentence. Third party key boards are the worst, but those ones that come on the phones should not be trusted. I have heard something like this before used to compromised someone's wallet too. One of the best way to verify seed phrase is virtual keyboard.

Ideally, you should only use open source wallet apps which use their own virtual keyboard for entering seed phrases, where you can verify exactly what the keyboard is doing. Electrum is one such example. Even using the stock Android or Apple keyboard isn't completely safe.

A wallet which generate seed phrase and not suggest virtual keyboard but requires you to click on the seed phrase to know if you backup the seed phrase correctly are also good. What can not make such wallet good is if they are close source and not reputed.

[Hatchy]

Thanks  for the security update. When using a mobile wallet connected to the internet, it's essential to know about some do's and don'ts to keep your funds safe. The internet has many harmful software like bugs or phishing attempts that can access your personal data without permission or even your consent. So we all have to be cautious with third-party software and carefully review the permissions they require before installing them.
For me, I see no reason why I would want to change my current keyboard and install another. Using the built-in keyboard is safer and avoids potential risks or issues that may affect your device's functionality. So please let's all stay safe and away from malwares.

[mk4]

And ultimately, only use mobile (and desktop) wallets on personal devices as hot wallets. Imagine storing your life savings on a device that could easily be compromised!

For 99% of people: Desktop wallets < Mobile wallets < Hardware wallets

[Synchronice]

Mobile wallets are not exactly the most secure wallets in the world, but in case you really have to use them, please keep in mind one very important piece of information.

DO NOT use third-party keyboards while you are using the wallet app!

Somebody has already been robbed because of this. You must only use the stock Android or Apple keyboard, and no others. Better if you uninstall all 3rd party keyboards completely. They collect all data you type on the keyboard at all times, which is a requirement for them to function properly, and there is no telling who is at the other end of the server!

What about Samsung keyboard? Samsung smartphones come with it. Windows Phones came with Microsoft's Word Flow keyboard app and Swiftkey belongs to MS too. While I absolutely agree with the advice that you give here, I still don't think that that would be an issue for that person.

If one doesn't download malicious apps, doesn't visit unknown websites, doesn't connect to public wi-fi, doesn't root smartphone, doesn't install custom ROMs without research and doesn't give unlocked smartphone to friends or strangers, then I think you won't get any problem, especially if you don't own a lot of bitcoins.

And ultimately, only use mobile (and desktop) wallets on personal devices as hot wallets. Imagine storing your life savings on a device that could easily be compromised!

For 99% of people: Desktop wallets < Mobile wallets < Hardware wallets

Regular mobile and desktop wallets? Sure, definitely but airgapped computer is one of the most secure way to store bitcoins.

[mk4]

And ultimately, only use mobile (and desktop) wallets on personal devices as hot wallets. Imagine storing your life savings on a device that could easily be compromised!

For 99% of people: Desktop wallets < Mobile wallets < Hardware wallets

Regular mobile and desktop wallets? Sure, definitely but airgapped computer is one of the most secure way to store bitcoins.

Yes, hence I said "for 99% of people" — because only a very small minority actually knows how to correctly setup an air-gapped device, and they most definitely don't need my security advice.

[NotATether]

What about Samsung keyboard? Samsung smartphones come with it. Windows Phones came with Microsoft's Word Flow keyboard app and Swiftkey belongs to MS too. While I absolutely agree with the advice that you give here, I still don't think that that would be an issue for that person.

The person I quoted in the OP was robbed while using Swiftkey, so I really do mean it when I say only use those keyboards that ship in stock Android and iOS. And as o_e_l_e_o said, built-in open-source keyboards in wallet apps are even better - although you should NOT be storing crypto on a Windows Phone, because those devices don't get security updates anymore.

[_act_]

What about Samsung keyboard? Samsung smartphones come with it. Windows Phones came with Microsoft's Word Flow keyboard app and Swiftkey belongs to MS too. While I absolutely agree with the advice that you give here, I still don't think that that would be an issue for that person.

What are you saying? When you go to app store and download a cloned one would be when you will realize that you are wrong. If you are good to know the right one, not everyone knows the right one. NotATether said you should not download third party keyboard which is the right thing to say. Or what are you expecting from him again? All phones comes with their own keyboard.

If one doesn't download malicious apps, doesn't visit unknown websites, doesn't connect to public wi-fi, doesn't root smartphone, doesn't install custom ROMs without research and doesn't give unlocked smartphone to friends or strangers, then I think you won't get any problem, especially if you don't own a lot of bitcoins.

You must be joking. If you are using a mobile phone and it is connected online, store just little amount of bitcoin on it, the rest should be on cold wallets.

[Findingnemo]

I am using Android keyboard. I use to report some posts with the same sentence like 'not bitcoin discussion related, move to trading discussion. Did you know that only what I just need to put down is 'not bitcoin, and all other words will be suggested and I just need to click on them one by one to make the complete sentence. Third party key boards are the worst, but those ones that come on the phones should not be trusted. I have heard something like this before used to compromised someone's wallet too. One of the best way to verify seed phrase is virtual keyboard.

If I am not wrong Gboard is the stock keyboard comes with most of the android devices and we all knows that what Google loves to do with the users privacy so definitely it can't be trusted. However Google claims that

What Gboard doesn’t send to Google:

Everything else. Gboard will remember words you type to help you with spelling or to predict searches you might be interested in, but this data is stored only on your device. This data is not accessible to Google or to any apps other than Gboard.

Keep in mind that privacy policies can change, so Google might opt for more tracking in the future.

I found fleksy also available on playstore and they clearly mentioned that app doesn’t collect user data and we can trust them since its UK-registered company[1].

1. Privacy Policy of Fleksy by Thingthing Ltd.

[Synchronice]

What about Samsung keyboard? Samsung smartphones come with it. Windows Phones came with Microsoft's Word Flow keyboard app and Swiftkey belongs to MS too. While I absolutely agree with the advice that you give here, I still don't think that that would be an issue for that person.

The person I quoted in the OP was robbed while using Swiftkey, so I really do mean it when I say only use those keyboards that ship in stock Android and iOS. And as o_e_l_e_o said, built-in open-source keyboards in wallet apps are even better - although you should NOT be storing crypto on a Windows Phone, because those devices don't get security updates anymore.

Okay, Swiftkey is owned by Microsoft and is not a random trojan keyboard that you find in play store. They may collect some of your data but personally, I don't think that Microsoft tries to steal seed phrases of their keyboard users. I don't want to look like I trust Microsoft, no, I know how shady they are but I believe their aim is not to steal my coins because it turn into a huge scandal and ruin their business (Okay, people don't care about privacy but they care when someone steals their money).

By the way, that's what I wanted to say in my post but I forgot. Electrum is an ideal wallet for android users and it comes with built-in keyboard, that's a way to go.

What about Samsung keyboard? Samsung smartphones come with it. Windows Phones came with Microsoft's Word Flow keyboard app and Swiftkey belongs to MS too. While I absolutely agree with the advice that you give here, I still don't think that that would be an issue for that person.

What are you saying? When you go to app store and download a cloned one would be when you will realize that you are wrong. If you are good to know the right one, not everyone knows the right one. NotATether said you should not download third party keyboard which is the right thing to say. Or what are you expecting from him again? All phones comes with their own keyboard.

I'm saying that if we don't trust Swiftkey which is owned by Microsoft, then we shouldn't trust stock Android (Google), stock Apple, stock Samsung and other keyboards.

If one doesn't download malicious apps, doesn't visit unknown websites, doesn't connect to public wi-fi, doesn't root smartphone, doesn't install custom ROMs without research and doesn't give unlocked smartphone to friends or strangers, then I think you won't get any problem, especially if you don't own a lot of bitcoins.

You must be joking. If you are using a mobile phone and it is connected online, store just little amount of bitcoin on it, the rest should be on cold wallets.

I don't say that you should use an internet-connected phone as a cold wallet. I'm saying that it's pretty safe to hold some coins on your smartphone and it's not necessary to worry if you follow some rules of what to do and what not to do.

[o_e_l_e_o]

What about Samsung keyboard?

The same as I described above - closed sourced and operated by a huge corporation which makes large amounts of money from your data. I wouldn't trust it.

Gboard: https://reports.exodus-privacy.eu.org/en/reports/com.google.android.inputmethod.latin/latest/
SwiftKey: https://reports.exodus-privacy.eu.org/en/reports/com.touchtype.swiftkey/latest/

All of these keyboards require internet access. I wonder why?

I found fleksy also available on playstore and they clearly mentioned that app doesn’t collect user data and we can trust them since its UK-registered company[1].

This is next to meaningless. Every big corporation has been caught breaching their privacy policy. They all gather data they aren't supposed to.

They may collect some of your data but personally, I don't think that Microsoft tries to steal seed phrases of their keyboard users.

No, I don't think Microsoft are deliberately trying to steal seed phrases. But if your keyboard is syncing what you type with random third party servers, then that is a massive security risk and you have no idea who else is going to be able to access that data.

I'm saying that if we don't trust Swiftkey which is owned by Microsoft, then we shouldn't trust stock Android (Google), stock Apple, stock Samsung and other keyboards.

Correct. If it's closed, then don't use it.

There are FOSS alternatives such as Openboard, AnySoftKeyboard, and Florisboard.

[Synchronice]

What about Samsung keyboard?

The same as I described above - closed sourced and operated by a huge corporation which makes large amounts of money from your data. I wouldn't trust it.

Gboard: https://reports.exodus-privacy.eu.org/en/reports/com.google.android.inputmethod.latin/latest/
Samsung Keyboard: https://reports.exodus-privacy.eu.org/en/reports/com.samsung.keyboard.themes/latest/
Swiftkey: https://reports.exodus-privacy.eu.org/en/reports/com.touchtype.swiftkey/latest/

Okay, I'll be more concrete about my view:
OP says that somebody has already been robbed because of using 3rd party keyboard, in this case, Swiftkey. It is very unlikely that that person got robbed because of this, so, to my mind, there is no connection between Swiftkey and lost coins.
But this view of mine doesn't mean that I'm saying we should use 3rd party apps. I don't even agree with OP about using custom Android/Apple keyboards because if we think that Swiftkey is a reason of his loss, then Apple or Google aren't any different from Microsoft. So, to sum up, even stock keyboards aren't a good option to my mind!

Definitely I agree with OP about using wallet that comes with built-in open-source keyboard!

[NotATether]

Okay, Swiftkey is owned by Microsoft and is not a random trojan keyboard that you find in play store. They may collect some of your data but personally, I don't think that Microsoft tries to steal seed phrases of their keyboard users. I don't want to look like I trust Microsoft, no, I know how shady they are but I believe their aim is not to steal my coins because it turn into a huge scandal and ruin their business (Okay, people don't care about privacy but they care when someone steals their money).

By the way, that's what I wanted to say in my post but I forgot. Electrum is an ideal wallet for android users and it comes with built-in keyboard, that's a way to go.

I'm not trying to imply that Microsoft steals seed phrases, but rather, that it is possible that some of the people whose job it is to analyze such collected data could have malicious intentions.

I'm saying that if we don't trust Swiftkey which is owned by Microsoft, then we shouldn't trust stock Android (Google), stock Apple, stock Samsung and other keyboards.

Ideally, your keyboard should not be sending any kind of data to 3rd party servers at all, whether it's spelling, predictive data or whatever. So if there is some setting in the keyboard you can find which disables all telemetry, then toggle it on and you should be OK. But there are many keyboards out there that collect such data and do not have such a switch. That's why I said you should stick to stock keyboards because I know they do have said switches you can turn off.

And maybe Swiftkey has such as switch too (I don't know, as I've never used it). But you wouldn't want to use some keyboard like Grammarly for example, which literally sends your keystrokes to them as advertised.

[BitMaxz]

The same as I described above - closed sourced and operated by a huge corporation which makes large amounts of money from your data. I wouldn't trust it.

Gboard: https://reports.exodus-privacy.eu.org/en/reports/com.google.android.inputmethod.latin/latest/
Samsung Keyboard: https://reports.exodus-privacy.eu.org/en/reports/com.samsung.keyboard.themes/latest/
Swiftkey: https://reports.exodus-privacy.eu.org/en/reports/com.touchtype.swiftkey/latest/

All of these keyboards require internet access. I wonder why?

The link you provided above for Samsung is the fake one it contains Facebook ads and that's not the official one they don't have a Samsung keyboard on Google Playstore you can only download them on Galaxy store.

And According to Samsung if you are afraid of your privacy you can request a source code of their keyboard directly at https://opensource.samsung.com/

I'm using Samsung all permission is denied and I disabled smart typing and other features. It only requires the internet when there is a new update or you enable other 3rd party content like Google and Emoji.

[o_e_l_e_o]

It is very unlikely that that person got robbed because of this, so, to my mind, there is no connection between Swiftkey and lost coins.

I say as much in that thread. OP made a number of other mistakes which are more likely the cause of his lost coins. However, he did use SwiftKey to enter his seed phrase, and SwiftKey does sync everything you type in it to the cloud, meaning his seed phrase is absolutely stored on at least one (although more likely several) unknown servers in unknown locations with unknown security and accessible by unknown persons. That is a massive security risk.

So, to sum up, even stock keyboards aren't a good option to my mind!

Agreed. Hence my FOSS recommendations.

-snip-

My bad. I've removed the link. I searched for keyboard on the site you linked however and found nothing useful. And if it were actually open source, then why isn't the source available? Privately requesting source code is meaningless - they could send you any code they like and you cannot verify that the code they send matches the code running their devices.

[Upgrade00]

I'm saying that if we don't trust Swiftkey which is owned by Microsoft, then we shouldn't trust stock Android (Google), stock Apple, stock Samsung and other keyboards.

As long as the keyboard can access your data and you cannot verify what they do with that data cause they are a close source service then you are at risk. It doesn't matter if it's a third party keyboard or a custom one, you don't trust; you should always verify what's going on.

[Yamane_Keto]

Mobile wallets are not exactly the most secure wallets in the world, but in case you really have to use them, please keep in mind one very important piece of information.

Thanks for the tips, I might add to them:

• Make sure that the keyboard does not get permissions to read files or clipboards, as your privacy such as addresses or even the private key can read them.
• Cancel the permissions for this keyboard to connect to the Internet, as it does not need to connect to the Internet.
• Use open source sources.

Do not complete your wallet seed word, as by choosing the first two letters, the wallet can suggest several words and choose from them. I think that even if the keyboard is connected to the Internet, not completing the word will complicate the task for them a lot.

Somebody has already been robbed (https://bitcointalk.org/index.php?topic=5461230.msg62613622#msg62613622) because of this. You must only use the stock Android or Apple keyboard, and no others. Better if you uninstall all 3rd party keyboards completely.

Good wallets give you a keyboard inside the wallet. For example, I tried to create a new electrum wallet on my phone, and this is the keyboard.

[sokani]

I found fleksy also available on playstore and they clearly mentioned that app doesn’t collect user data and we can trust them since its UK-registered company[1].

1. Privacy Policy of Fleksy by Thingthing Ltd.

I took some time to do some findings about Fleksy and it is not completely open source: Fleksy Acquired by Pinterest; Will Open-Source Some Components for the Benefit of the Blind. With the latest mobile wallet hack update, I'm no longer comfortable using the stock android keyboard to import my seed phrase, so even the idea of using a third-party keyboard app like Fleksy is a no go area for me. I think the best thing is to stick with wallets that support inbuilt virtual keyboard like electrum wallet to avoid this kind of hack.

[sheenshane]

IMO, I'm using a mobile wallet for how many years I never experience hacking or someone getting access to my wallet and it might be because, upon creation, I used my old laptop in generating a private key and then export the key into my mobile wallet.  I used Electrum which has its own keyboard inside as explained above, so I think even if you're using 3rd party keyboard it didn't affect you if you also disable permissions for the 3rd party app, it's a good idea to review and restrict permissions to ensure that the keyboard doesn't have unnecessary access to sensitive data.

The most that should be avoided is jailbreaking (iOS) or rooting (Android) your device, as it can weaken the device's security and make it more susceptible to attacks.

However, I highly discourage someone from using a mobile wallet app storing for the long term, isn't a good idea because the wallet app has low-security features.