WARNING when using mobile device wallets (Android, iOS)

[DYING_S0UL]

By the looks of it now I think I need to be a software developer. That way I can build my own keyboard and use it to import export my keys. Without this I have no other ways. I will always be in risk of being hacked. Currently I'm using stock keyboard with Custom Rom installed on my phone (Not stock OS). And you guys talking about security over a simple keyboard!! Now I think even the OS isn't even secure enough. Yes Android maybe Open source but many company doesn't use pure Android os, rather they would modify it and give it a custom skin job as they prefer.

BTW anyone use any linux distro? I was thinking to shift from Windows to Linux. Any suggestion?

[1714609461]

1714609461

[1714609461]

1714609461

[1714609461]

1714609461

[o_e_l_e_o]

That way I can build my own keyboard and use it to import export my keys.

There is a much simpler solution to all the issues being raised here about keyboard apps: Don't type your seed phrase in anywhere. Simple. If I type any seed phrase in to any non-airgapped device ever, I immediately consider it compromised.

BTW anyone use any linux distro? I was thinking to shift from Windows to Linux. Any suggestion?

Moving from Windows to Linux is always a good idea, but as I said above, don't think that making this one change suddenly makes all your wallets secure. If you have a bit of technical knowledge, then I would suggest using Debian. If you don't, then I would suggest Mint since it is the closest in look and feel to Windows and relatively easy to set up and use.

[DYING_S0UL]

There is a much simpler solution to all the issues being raised here about keyboard apps: Don't type your seed phrase in anywhere. Simple. If I type any seed phrase in to any non-airgapped device ever, I immediately consider it compromised.

Then how am I suppose to import the wallet? Little confused here. I have to type in the passphase, don't it?

Moving from Windows to Linux is always a good idea, but as I said above, don't think that making this one change suddenly makes all your wallets secure. If you have a bit of technical knowledge, then I would suggest using Debian. If you don't, then I would suggest Mint since it is the closest in look and feel to Windows and relatively easy to set up and use.

There are 3 version of mint? Which one did you use or prefer?

[hosseinimr93]

Then how am I suppose to import the wallet? Little confused here. I have to type in the passphase, don't it?

o_e_l_e_o is suggesting not to enter your seed phrase on a non-airgapped device.
If you create your wallet on an airgapped device using a safe tool and never enter your seed phrase on a non-airgapped device, you can be sure that there's no way for hackers to gain access to your seed phrase.

[Synchronice]

That means our bitcoins are never safe even when we store them in the most secure ways. Even hardware wallets because they are produced and distributed by centralized companies, and they can come under pressure from the government at any time.

No, no, it's not like that, you can feel very safe and secure. You have to ask yourself questions like how many bitcoins you hold, you have to know your neighborhood, friends, etc. If you don't live near Silicon Valley and your friends aren't top hackers or scammers or thieves, then you can feel safe and secure with your coins. You guys love too much drama, if you follow basic security advices, your wallet and coins will be very secure. Use airgapped computer, nothing will happen. I even bet, if you connect to internet with your computer and only visit websites like Youtube, twitter, facebook, instagram, won't click on ads and won't visit malicious/unknown websites, won't download pirated software and so on, I bet your wallet will be secure. It won't be a cold wallet anymore but even if you take care of hot wallet, you can feel very secure.

And tip! Follow o_e_l_e_o's advices, he is a great guy and knows what he says.

[o_e_l_e_o]

Then how am I suppose to import the wallet?

The real question is: Why are you importing it?

I have a mobile hot wallet, for which I accept the poor security of hot wallets because of the convenience they bring. In this wallet I store a small amount of bitcoin I can afford to lose. That's my only hot wallet. I don't need to import it anywhere else, because it's already on my phone. If I needed to change phones, then I'll set up a new wallet and send the coins across.

For every other wallet I own, of which there are many, there is almost no scenario in which I would ever import the seed phrase on to a phone. These are a variety of cold wallets, paper wallets, hardware wallets, etc. I have never imported one of these wallets to a phone, and if I ever did, then that wallet is immediately compromised and insecure.

There are 3 version of mint? Which one did you use or prefer?

If you are looking for the closest feel to Windows, and your computer isn't ancient, then Cinnamon. If you need something light on resources for older devices, then MATE or Xfce will be better.

[DYING_S0UL]

Then how am I suppose to import the wallet?

The real question is: Why are you importing it?

I'll set up a new wallet and send the coins across.

Because I may be a newbie who doesn't have enough knowledge about hot,cold,hardware wallet. I'm still new to this. And secondly I don't own any hardware wallet, where I live I don't think I can get my hands on these kind of tools. (If they support international purchase and stuff then I think I can buy those)

I'll try to follow the advice you gave about 'creating a new address and sending coins'.

Specs: core i5 9gen 8gb ram 250gb ssd ( I think I have enough hardware to support cinnamon, I'll give it a try.)

[o_e_l_e_o]

If a hot wallet is all you can use, then they can still be relatively secure if you take all the sensible precautions. One of those precautions is not importing your seed phrase in to multiple different pieces of software. Choose a good piece of wallet software such as Electrum, use it to generate a new wallet and write down your seed phrase, and then never enter that seed phrase in to any other wallet unless you are recovering your coins in an emergency.

And yes, that hardware will be absolutely fine with Cinnamon.

[dimonstration]

DO NOT use third-party keyboards while you are using the wallet app!

Does google keyboard(gkeyboard) and swiftkey keyboard counts on what to avoid for 3rd party keyboards. I’m using wallet software most of the time and I’m not aware that there’s still a possibility to hack my wallet through the use of tools outside the wallet.

I rarely check my wallet address that I copy when using mobile phone. Thanks for the heads up.

[un_rank]

Does google keyboard(gkeyboard) and swiftkey keyboard counts on what to avoid for 3rd party keyboards. I’m using wallet software most of the time and I’m not aware that there’s still a possibility to hack my wallet through the use of tools outside the wallet.

Yes, they are closed source and collect user information based on what you type presenting a security risk.
Go for free and open source alternatives.

I rarely check my wallet address that I copy when using mobile phone. Thanks for the heads up.

Yuu should always. Not just a quick glance at the first and last few words, but a whole look at the two addresses, i.e, where you are copying from and where you are pasting too.

- Jay -

[Volgastallion]

Does google keyboard(gkeyboard) and swiftkey keyboard counts on what to avoid for 3rd party keyboards. I’m using wallet software most of the time and I’m not aware that there’s still a possibility to hack my wallet through the use of tools outside the wallet.

Yes, they are closed source and collect user information based on what you type presenting a security risk.
Go for free and open source alternatives.

I think yes and no at the same time, you ended up in a cul de sac. Can you please say some third reliable keyboard partie? Also if you can, you can use them, b ut in  the long run who can assure you they are not gonna change something and make a backdoor in one update? and yes you can check that, but are you gonna be always checking every update in a cellphone? most people no.

[un_rank]

Can you please say some third reliable keyboard partie?

You mean open source keyboards? o_e_l_e_o already mentioned three in the first page of this thread: Openboard, AnySoftKeyboard, and Florisboard.

Also if you can, you can use them, b ut in  the long run who can assure you they are not gonna change something and make a backdoor in one update? and yes you can check that, but are you gonna be always checking every update in a cellphone? most people no.

I will rather have the problem of needing to check the source code than having no clue what goes on whatsoever.
Even if you cannot check the codes directly, following regular updates will give you a heads up if anything changes, but with closed source keyboards or platforms in general you have no clue.

- Jay

[NotATether]

By the looks of it now I think I need to be a software developer. That way I can build my own keyboard and use it to import export my keys. Without this I have no other ways. I will always be in risk of being hacked. Currently I'm using stock keyboard with Custom Rom installed on my phone (Not stock OS). And you guys talking about security over a simple keyboard!! Now I think even the OS isn't even secure enough. Yes Android maybe Open source but many company doesn't use pure Android os, rather they would modify it and give it a custom skin job as they prefer.

On desktops, the keyboard is hardware and cannot be rewired to do other stuff.

But on phones and tables, the keyboard is software based, and not only that, but developers can make their own keyboards, some of which violate privacy by collecting all kinds of data about you to sell. And it may just so happen that that they sell this data to malicious entities, where even anonymizing your key strokes will not protect you, because other people don't need to know who was typing it, just what was typed.

[Volgastallion]

By the looks of it now I think I need to be a software developer. That way I can build my own keyboard and use it to import export my keys. Without this I have no other ways. I will always be in risk of being hacked. Currently I'm using stock keyboard with Custom Rom installed on my phone (Not stock OS). And you guys talking about security over a simple keyboard!! Now I think even the OS isn't even secure enough. Yes Android maybe Open source but many company doesn't use pure Android os, rather they would modify it and give it a custom skin job as they prefer.

On desktops, the keyboard is hardware and cannot be rewired to do other stuff.

But on phones and tables, the keyboard is software based, and not only that, but developers can make their own keyboards, some of which violate privacy by collecting all kinds of data about you to sell. And it may just so happen that that they sell this data to malicious entities, where even anonymizing your key strokes will not protect you, because other people don't need to know who was typing it, just what was typed.

Yes indeed, also this its really easy to check to anyone, when you start to type or type in the Gboard in your cellphone you can see the three words recomendation to autofill by Gboard and..... yes that words are the words you sometimes write, so they are really know what you are typing.

One time i made a experiment and start to write seed words (not real ones) and after that when i put that word on other things not related, i can see in the suggestion of Gboard the next words.... nothing more to say.

And plus now with the IA integration, with dont have so much run to run, because with AI they are gonna say, "to help you we learn what are you typing and bla bla bla" and the regular people are gonna still gift their privacy even more.

One last thing i have to say or noted, maybe its only me in conspiracy, but the explorers on mobiles are also tracking us in the keyboard?, i mean they also read what we are typing no matter the keyboard its from other source? Example its Opera collecting what im typing asides o using a Gboard? i think YES. What its you point of view?

[NotATether]

One last thing i have to say or noted, maybe its only me in conspiracy, but the explorers on mobiles are also tracking us in the keyboard?, i mean they also read what we are typing no matter the keyboard its from other source? Example its Opera collecting what im typing asides o using a Gboard? i think YES. What its you point of view?

Google used to be strictly "don't be evil". We all know how that went.

Assume that all data being collected and sent over the network is being stored somewhere where it can either be hacked or sold to third parties, who will basically do whatever they want with it.

But why is Opera included in the mix? I'm curious, since they just have a browser AFAIK (and might track you through that, rather than through a keyboard).

[joniboini]

Example its Opera collecting what im typing asides o using a Gboard? i think YES. What its you point of view?

I don't think that's news though. Browsers always collect user data regardless of what keyboard apps you are using. I don't recall any popular Android/iOS browser having its own secure keyboard. Even if they do, we can't tell if they really keep no log or just log you as usual. You can probably avoid extensive logging with open-source and privacy-oriented browsers or keyboard apps just like mentioned before. CMIIW.

[Pmalek]

Also if you can, you can use them, b ut in  the long run who can assure you they are not gonna change something and make a backdoor in one update? and yes you can check that, but are you gonna be always checking every update in a cellphone? most people no.

No one can guarantee that. The difference is that if you want to and know how to, you can check what the software does and what was changed in the newer versions. There are no guarantees that the code is safe or free of bugs and vulnerabilities. Turn off automatic updates and download those that you want manually. Most people don't have the skills to check and read code. The best you can do then is to wait with installing the newer versions until some weeks or even months have passed. If no one reports anything suspicious, go ahead and upgrade. I doubt keyboard apps have many updates anyways. There isn't much to update. 

[o_e_l_e_o]

But why is Opera included in the mix? I'm curious, since they just have a browser AFAIK (and might track you through that, rather than through a keyboard).

Somewhat off topic, but Opera have a built in free VPN which is absolute trash (just like every other free VPN), not to mention being owned by a Chinese consortium with links to the CCP. I wouldn't trust it for a second.

Browsers always collect user data regardless of what keyboard apps you are using.

Some browsers like Chrome and Opera spy on you constantly, sure, but not all browsers. Just use Tor or Firefox instead.

[Volgastallion]

One last thing i have to say or noted, maybe its only me in conspiracy, but the explorers on mobiles are also tracking us in the keyboard?, i mean they also read what we are typing no matter the keyboard its from other source? Example its Opera collecting what im typing asides o using a Gboard? i think YES. What its you point of view?

Google used to be strictly "don't be evil". We all know how that went.

Assume that all data being collected and sent over the network is being stored somewhere where it can either be hacked or sold to third parties, who will basically do whatever they want with it.

But why is Opera included in the mix? I'm curious, since they just have a browser AFAIK (and might track you through that, rather than through a keyboard).

No i only mention one browser like an example nothing to do with Opera.


[/quote]

But why is Opera included in the mix? I'm curious, since they just have a browser AFAIK (and might track you through that, rather than through a keyboard).

Somewhat off topic, but Opera have a built in free VPN which is absolute trash (just like every other free VPN), not to mention being owned by a Chinese consortium with links to the CCP. I wouldn't trust it for a second.

Browsers always collect user data regardless of what keyboard apps you are using.

Some browsers like Chrome and Opera spy on you constantly, sure, but not all browsers. Just use Tor or Firefox instead.

Yeah i tried it when it was released and..... i never try something worst, also normal pages cant be accessed. THe speed? we normally can expect lower speed on VPN, but this its beyond low.

 I dont know that fact about chinesse consortium, but any VPN its something shady, one day i see some video who show 90% of the VPN are owned by ex Mossad and IDF guys.....

[Flexystar]

That's interesting. I never thought those cool font changing keyboards could be disaster like this? I believe this has got something to do with the key loggers type of application where one can remotely watch what is being typed on the other devices if they have those tracking software's installed.

Obviously if we are installing these keyboards then they will give us notifications that what permission to set and let me guess reading and writing data on the device would be first requisite since it is a keyboard.

I am pretty sure one can only be cautious about the app authenticity but the audacity is they will have five star reviews and let me guess they are also from cheap paid task sites and mostly bought one. Definitely no other way but to stick to original apps within our smartphones OR lets just switch to the Hardware Wallet and Paper Wallets. Best on the market so far.