[Updated x2] Security Advisory: A.I.Type Keyboard Sends All Your Keystrokes To Their Servers In Plain-Text

One of the features that really differentiates Android from other mobile operating systems is the ability to install a custom keyboard that works for you. I constantly keep jumping between a variety of keyboards as new updates come out (right now I've settled on SwiftKey due to its unparalleled prediction technology), but when some of our readers pointed out A.I.type Keyboard's "psychic" word completion, I had to check it out.

However, what I found in A.I. Keyboard's Market description prevented me from even installing it - all smart predictions happen in the cloud, which means everything you type (or almost everything) gets sent over the data connection to their servers. You can turn it off - sure, but then you lose "psychic" abilities, which seems to be this keyboard's main selling point. I'm not even kidding about the "psychic" part - here's an excerpt from their Market page:

Psychic word completions and predictions are generated by A.I.type’s servers on the Cloud. When the device is offline or Internet connection is too slow, or if you disabled Cloud-based prediction, word suggestions will be generated by the device only.

Privacy notice: while installing A.I.type Keyboard, you will receive a warning message about collecting sensitive data. This is the standard general-purpose Android message issued for any downloaded keyboard and it does not pertain to A.I.type. Our keyboard DOES NOT COLLECT YOUR SENSITIVE DATA.

Do I want a random company to know what I'm typing into every single text field (outside of possibly password fields)? Pardon my language, but hell no.

Oh, and about that last privacy part... A.I. Keyboard probably doesn't collect your sensitive data, but what it does do is send all those prediction queries over to the cloud in plain-text, unencrypted, for everyone on your local Wi-Fi network or anywhere in the request's path to see. Like so:

GET /beta081/cell/predict?i=T4420&l=Th&t= HTTP/1.1

Host: 72.26.211.90

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Date: Fri, 21 Oct 2011 16:39:43 GMT

Connection: close

Th;;the;they;this;there;that;

GET /beta081/cell/predict?i=T4420&l=This+ke&t= HTTP/1.1

Host: 72.26.211.90

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Date: Fri, 21 Oct 2011 16:39:47 GMT

Connection: close

ke;;knowledge;keeps;key;killer;kept;

Here, check it out for yourself: http://72.26.211.90/beta081/cell/predict?i=T4420&l=Android+Pol (you should see http:// and "Pol;;police;political;policy;politics;poolplay;" as the result).

Needless to say, the app went to the trash right after our tests were over.

When I brought up my initial privacy concerns to A.I.type's CEO Eitan Fitusi before even digging into this, he had the following to say (all spelling left as is, text in italics added by me):

Hi Arten (that's not my name)

We here those concerning before and understand them, that why we work hard on our new local data model, that already available in the current version, We are going to release very soon a new version, that will have a setting for shutting down cloud support prediction, although the prediction quality is effected, it is still great, and as close as possible to the full scale prediction, what mostly damaged from lack of cloud is names, locations or other vocabulary that is domain specific.

This new version also including a new superior learning model that learn the user, and enhanced the predictioncorrectioncompletion quality based on the user writing style, names and unique words that's the users use, user model will be stored locally and won't sent data to the cloud at all.

Having say that, I know that it's not much, but I can assure you that we are very concern about are user privacy and very strict regarding their data.

Also if you look at it the other way, you can wright an email with whatever keyboard you like then send it via Gmail that officially state that its learn YOUR data (or WhatsApp, Viper, Skype…. They all have access to your data)

Any way as I say before next version will give the user the option to use only local services, and keep is data local only.

Let this serve as a wake-up call to both users placing trust in the cloud and developers who don't utilize even the most basic security and privacy standards (hey, https would have been nice).

Remember, all cloud services are not created equal. I hope for their sake that A.I.type fixes this blatant disregard for privacy in the near future, and as for the rest of you - you've been warned.

Update: A.I.type's response below:

Artem and everybody,

A.I.type is a serious company with over 100,000 users around the globe. We are fully committed to our users' privacy and security.

Please allow me to make a few statements with regard to this issue:

A. Sensitive data such as passwords and credit card numbers are never logged or sent to the servers.

B. Transactions to our servers are anonymous. The servers do not know or need to know who you are.

C. The servers do not log, analyze or share user texts. Once responded to, a prediction query is completely forgotten.

D. MyType, A.I.type’s auto-learning mechanism, doesn’t store your texts. It learns words and patterns and stores them only locally on the device in a unique format that only the keyboard can read. Learned information is never sent to the servers.

E. The user may turn off Cloud-based prediction if still in doubt. If the Cloud is disconnected, there is no degradation of auto-correction, and prediction still compares favorably with other systems on the market

With regard to the security issue you raise, we agree that there is an issue in data transmission which we will address. Our PC version has been encrypting all traffic since its inception, but the Android versions are yet to do so. This is obviously an omission on our part which we will fix ASAP. As we have clearly stated in our company policy, we take privacy and security seriously. In that spirit, we would like to propose that you allow us to notify you when we have deployed the fix to the market so that you can do a followup security review of our product.

Best regards,

Noam Rotem
Co-Founder, VP R&D
A.I.type

Update 2: A.I.type v1.1 brings support for encryption, which is currently not turned on by default. After a soak period, new versions will ship with it enabled.

[EMBED_APP]https://play.google.com/store/apps/details?id=com.aitype.android[/EMBED_APP]