Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping.

top 50 comments

sorted by: hot top controversial new old
[–] 354 points 3 years ago (4 children)

I live in China and this software is cancerous not just in the encryption failure, it also nestles into a computer like a trojan. Creates 2 fallback installations and will reinstall itself after removal if you reboot in between, unless you get rid of all 3 installations at once, where they are deliberately trying to obfuscate the uninstall button (triple confirmation, swapping the confirm/cancel buttons and button background colors, etc.).

It's a nasty piece of crap that come preloaded on any phone (android, at least) and Windows-PC here.

  • source
  • hideshow 6 child comments
  • [–] 74 points 3 years ago (3 children)

    It's time to switch to Linux!

  • source
  • parent
  • hideshow 5 child comments
  • load more comments (1 reply)
  • load more comments (2 replies)
    [–] 263 points 3 years ago (111 children)

    Alright China shills, you can stop changing the subject to how Google and the US are the "same".

    The troops advanced into central parts of Beijing on the city's major thoroughfares in the early morning hours of 4 June and engaged in bloody clashes with demonstrators attempting to block them, in which many people – demonstrators, bystanders, and soldiers – were killed. Estimates of the death toll vary from several hundred to several thousand, with thousands more wounded.[15][16][17][18][19][20]

    https://en.m.wikipedia.org/wiki/1989_Tiananmen_Square_protests_and_massacre

    If you lived in China you'd likely not know about this, since people who talk about it go to prison.

    Yeah the US is exactly like this so let's not talk about the Chinese government being awful to their citizens /s

  • source
  • hideshow 112 child comments
  • [–] 100 points 3 years ago (8 children)

    Simple solution is to block lemmygrad and hexbear in your app. That cuts down quite a few tankies and mainlaind Taiwan shills.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 46 points 3 years ago (3 children)

    Imagine being in Taiwan and having full access to information about China and the west and still shilling for China. Those types of people should be looking for a dominatrix, not a political philosophy...

  • source
  • parent
  • hideshow 4 child comments
  • load more comments (2 replies)
  • load more comments (7 replies)
  • load more comments (110 replies)
    [–] 223 points 3 years ago (2 children)
  • [–] 32 points 3 years ago (9 children)

    This is one of my favorite things about kbin over Reddit. So neat to see gifs in chat.

  • source
  • parent
  • hideshow 11 child comments
  • load more comments (7 replies)
  • load more comments (1 reply)
    [–] 151 points 3 years ago* (53 children)

    Didn't swiftpad or whatever its called send every key pressed to Microsoft?

    Not a China shill. China is horrible. Microsoft less so as they don't commit genocide in slow motion. But still, I think this sort of thing is more common than we think.

    Use FOSS.

  • source
  • hideshow 53 child comments
  • load more comments (53 replies)
    [–] 111 points 3 years ago (7 children)

    It's stories like this that don't surprise me as much as make me ask: How the fuck do you store and process this much data to get anything useful out of it.

  • source
  • hideshow 9 child comments
  • load more comments (5 replies)
    [–] 86 points 3 years ago (10 children)

    China being China, no surprise here.

  • source
  • hideshow 10 child comments
  • load more comments (10 replies)
    [–] 77 points 3 years ago

    Oh wow, who would have ever thought they'd do that? What a fucking surprise.

  • source
  • [–] 68 points 3 years ago (3 children)

    As if other keyboard apps are any different, I don't think Microsoft bought SwiftKey just for fun?!

  • source
  • hideshow 3 child comments
  • load more comments (3 replies)
    [–] 62 points 3 years ago (1 child)
    load more comments (1 reply)
    [–] 57 points 3 years ago

    I don't get it? Why are they talking in the article about not using the right type of encryption. The problem isn't the encryption, but the fact that it is sending your keystrokes to the mothership, right?

  • source
  • [–] 46 points 3 years ago (3 children)

    In a surprise to absolutely nobody, China spies on their people.

  • source
  • hideshow 3 child comments
  • load more comments (3 replies)
    [–] 41 points 3 years ago (8 children)

    I feel like there should be a Lemmy version of everything now

  • source
  • hideshow 8 child comments
  • load more comments (8 replies)
    [–] 40 points 3 years ago* (last edited 3 years ago) (23 children)

    The people here acting like their Gboard doesn't do the same is so funny.

    Edit : never used nor installed tiktok.

  • source
  • hideshow 26 child comments
  • [–] 113 points 3 years ago (1 child)

    It probably doesn't though. Obviously it's closed source making it harder to tell what's actually happening, but there's nothing stopping security analysts from looking at network usage and such. I would imagine that Google doesn't install a keylogger on every Android phone, not out of the goodness of their hearts, but because they don't want the bad publicity and lawsuits when it would inevitably be discovered.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (20 replies)
    [–] 39 points 3 years ago (2 children)

    These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.

    lol.

  • source
  • hideshow 2 child comments
  • load more comments (2 replies)
    [–] 39 points 3 years ago*

    It's not a bug, it's a feature.

  • source
  • [–] 35 points 3 years ago*

    And the Platinum Award for Least Surprising News Headline goes to...

  • source
  • [–] 33 points 3 years ago (24 children)

    And gboard or SwiftKey don't?

  • source
  • hideshow 25 child comments
  • load more comments (23 replies)
    [–] 32 points 3 years ago (1 child)

    Never use a closed source keyboard app. It can read what you send for messages, websites you go to, search engine queries.

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    load more comments
    view more: next ›