Hacker News Reader

Comment by 7e | Hacker News Reader

Which modern keyboards do connect to the Internet? The Apple and Google keyboards, AFACT, use private federated learning to keep their vocabularies up to date with the latest trending topics. I don’t think this solves a problem I have, unless the offline dictation is somehow much better than the best big tech has to offer.

View on HN

GBoard does kinda "keylog" in the telemetry it sends (actually, it's more "wordlog"): https://www.scss.tcd.ie/Doug.Leith/pubs/gboard_kamil.pdf

It will also do this even if you block the keyboard's internet access as it will use Google Play Services to send the telemetry data.

Previously discussed in this deleted reddit post: https://www.reddit.com/r/Android/comments/ymo3r9/deleted_by_...

At least turning off the "Share usage statistics" option in Gboard settings actually does opt you out...

Do you have a source for that? Where it sends through play services if network access is disabled? What does it send specifically?

Read the linked PDF.

It doesn't mention anything about laundering data when network access is disabled

Look for play services.

From the linked PDF:

> The telemetry sent by the Gboard application does not go directly to Google. Instead, the data goes through a service known as the Clearcut Logger within Google Play Services

To be fair, I have not tested whether Gboard continues to send telemetry to GPS even after networking is disabled on Gboard but there's nothing stopping that from happening from a technical perspective. This is because Android apps access GPS over Binder and Android apps can access Binder services even if they have no INTERNET permission.

Thanks

There are numerous issues with the 'privacy-preserving' federated learning models that are used by Google and Apple. They have constantly been called out by privacy researchers and cryptographers due to their misuse of differential privacy. There is very little trust in the privacy-preserving measures that are being used by these companies. This is not to say that these methods are bad in general but in terms of how they are used by Google and Apple, they amount to little more than a PR stunt. There are numerous reconstruction attacks on their privacy protocols as used by things like GBoard.

Reply on news.ycombinator.com