Hacker News Reader

Hacker News

Comment by buro9 | Hacker News Reader

Full thread

buro9

Why does a keyboard need permissions that include:

1) Network communication (full network access)

2) Your social information (read your contacts)

The first makes it sound like it's a keylogger, and stops me in my tracks.

The second... just why on Earth would a keyboard need to have a list of contacts? Are you going to spam my friends?

If #2 was asked for without #1, I could charitably hope that the contacts are just used for word suggestions based on names and addresses. But due to #2 being asked for in addition to #1 I really just think this is a spam machine at best, and a leaking of private contacts at worse.

Is anyone from Minuum on here who can explain why those permissions would be required.

View on HN

I asked the very same question about #1 on the Play store, and the developers did respond quite quickly: the network access is required to download new language packs. This makes perfect sense to me, as much as I'd like to see something like keyboards split off into two apps: the keyboard, with no/minimal permissions; and the 'helper' app, for settings, dictionary building/importing, downloading language packs, etc.

As far as reading my social information, I have no idea why it requests that. However, upon checking XPrivacy, I can see that it has never even attempted to access accounts, contacts, SMS/MMS, etc. Which would lead me to speculate that this is either a mechanism for recommendations, or used to build up dictionaries. (Edit: I never have the keyboard build up dictionaries, so I never told Minuum to try to do anything along those lines.)

Under settings there is an option for you to import your android dictionary, as well as import contacts. I like that they it's opt in, and going by your comment it seems like they're being honest.

I emailed them just in case they didn't see the above, and their response is:

  We require network access in order to collect analytics on how the
  keyboard is used. This information is completely user anonymous
  and we only use it so we can improve the experience for our users.
  
  We request social contact information so that the app can import the
  names of your contacts into our dictionary locally on your phone.
  This information does not leave your phone. 
  
  We think it is of utmost importance to respect the privacy of our
  users and only request certain information to improve the user
  experience. For further information about privacy, please see:
  http://minuum.com/data/
  
  Please let us know if you have anymore questions,

Minuum co-founder here:

Please check out our data collection policy at http://minuum.com/data/ . We actually wrote a fair amount of it ourselves to try and reduce the “legalese” aspect. Hopefully, as you suggest, we can work to increase transparence more in the future.

As someone below mention the key reason we introduced network access was to enable language packs.

We also collect some analytics, but it's limited to data which is inherently anonymous. We really want to build an amazing keyboard that people will want to use every day so it’s critical we be able to answer basic questions like “Is the keyboard installed?” and “Was it used today?”. Otherwise we couldn't validate our design decision.

As stated in our data collection policy, if we ever want to collect anonymized typing statistics or other data related to what you type, that would be strictly opt-in and we would be as transparent as possible about it.

And yes, as others mentioned, we only access contact information if you use the import contacts feature in the settings.

Reply on news.ycombinator.com