Google's Gboard doesn't send your keystrokes, but it does leak chicken and noodles
Google's release of the Gboard keyboard alternative in iOS immediately had people asking whether they were sending too much information to the search giant.
There’s a new keyboard option for iOS: Gboard from Google. Remarkably, Google released it on iOS before Android, possibly because Google exercises much more control over the keyboard that’s part of Android. (For the record, and have at me with virtual sticks, I prefer the default Android 6 keyboard on my Moto G to the default iOS one.)
You can read elsewhere about the keyboard’s features. I tested it out and adopted it almost immediately to replace Swype, which I’d found increasingly driving me to distraction. (It doesn’t seem to know a lot of words I use commonly, and it wasn’t improving over time after a few initial gains.)
But a strong public reaction didn’t arise about the keyboard’s predictive word suggestions, emoji matching, and swipe tracking. In order to handle your keystrokes, any alternate input app has to be able to process them to send to iOS. The keyboards I’ve tried that have a networked component for improving or enhancing results also work if you disable it.
When you enable Allow Full Access for a keyboard (Settings > General > Keyboards, select a keyboard), Apple offers a frank description of the risk, although it’s rather alarming, as you can see above. Apple could have somewhat more granular restrictions, but for the last two iOS releases, it’s all or nothing.
With Google involved, many people expressed joking or serious concern that Gboard might give the search company even more information about their personal behavior.
Is it risky to give Google—or any company—access to all your keystrokes? Sure. But you can dig into two related aspects: what a company says it will do with your keystrokes, and which keystrokes you choose to tap into that keyboard.
Reading the fine print
Google has a short and crisp privacy statement about Gboard—you can find it under the Search History and Privacy section, tap Privacy. Google says it only sends the searches you perform by tapping the G icon, which makes sense: Obviously it needs the text of the search to perform it. You can also wipe the search history from Gboard at will. These searches don’t sync with other Google products you use, so you won’t see them appear elsewhere.
The leaky-soup test
That policy is fine, but I put it to the test by intercepting data sent from my iPhone to the Internet. I set up Internet Sharing to share my Mac’s Wi-Fi connection, then I connected my iPhone to that software base station. I then ran a network packet sniffer in OS X that let me capture all the Internet connections originating from the iPhone.
Because Google encrypts almost everything by default—more on that “almost” in a moment—I couldn’t see what iOS was sending to Google nor the responses. I’d need to insert a packet sniffer in iOS to see data before it was packaged in an encrypted https session, and that’s not possible without a jailbreak, if even then.
However, I could test typing in Gboard, and see that no data was being sent at all between iOS and the Internet while I typed. I could then tap the G icon and perform searches, and watch data get sent back and forth.
That “almost” I mentioned above? All the traffic was encrypted with one odd exception. Gboard can provide suggestions for GIFs to insert, too, including animated ones. When I tapped the “restaurants near me” suggestion in Gboard’s search area, Gboard requested one image in the clear: I believe it’s an American-style Chinese dish of fried glazed chicken and crispy noodles on top of vegetables.
A reverse image search on Tineye confirmed that it’s a photo from Panda Express used on a site promoting downtown Chicago. Since I live in Seattle and the nearest Panda Express is several miles away, I’m completely confused.
That’s a leak of information outside of encryption that someone on an open network, such as Wi-Fi at a coffeeshop, could intercept, and discern some information about your habits. The search query itself wasn’t revealed; just this image request to show a preview.
After this article was published, Google’s project manager looked into the issue, agreed it needed to be changed, and GBoard was updated to retrieve these “near you” image previews via https. I tested and confirmed the change was implemented.
Be selective in what you type
The second part of my formulation is that you can choose what you type on a keyboard. For certain kinds of data entry in iOS, notably passwords, Apple automatically switches away from any third-party keyboard, and only lets you use a built-in one. (It has a few that have minor variants that depend on the kind of entry.)
I use sometimes use iCloud Keychain to drop in credit-card numbers and passwords in Safari, although I turn to 1Password more often for the same via a Sharing sheet in Safari, integration in other apps, and copy-and-paste from the 1Password app. Since I never tap in that information on a keyboard, it’s never sent to a third-party alternative input app.
You could make a similar choice without using iCloud Keychain or 1Password by switching to Apple’s built-in keyboard whenever you need to enter private or sensitive data. For most of us, it’s much more rare that we’re tapping in something secret, especially in iOS, than performing general searches, writing email, or sending texts and tweets.
I don’t get too worked up about third-party keyboards from major firms like Google and Microsoft, or well-known, long-established companies like Smile, which has a TextExpander app with a keyboard option. And if you have any concerns about sending your data, Apple doesn’t opt you in: the Allow Full Access switch is always off by default when you add a keyboard.