HN Explorer

Our keyboards are tracking us

16 points by tukunjil ↗ HN
While using android, I just use the built-in (should called “forced to use”) google made GBOARD. What I’ve noticed since I use this, whenever there is any privacy oriented browser tab or any field to entry password or pin code, the keyboard UI becomes different– showing a incognito icon on left top. (Presenting themselves so much sincere to users privacy! Hahaha…) And while using gboard on my iOS, whenever I’m going to entry any password or browsing private tab, iPhone automatically switches to default built in iOS keyboard. After noticing this two common incident, I discovered a thing new. Whatever and whenever I type something in gboard (in android especially,) goggle and Facebook like services starts to show me exactly the same thing as advertisement! Which clearly means, Gboard is just collecting everything I types everywhere! To be noted that, I never uses Gboards built in search feature, gif feature. Even no voice typing. Very rarely I use the translate bottom from keyboard. Also all of privacy related options both in gboard settings and google account settings are strictly turned off in my side. I know that all other third party commercial keyboard apps (swift/gramarly…) tracks users typing. And gboard may track to enrich vocabulary and predictions (which will be acceptable in certain limit), But tracking everything for advertisement purposes, ai model training and further supplying to governmental agencies is never acceptable, nor anything ethical. Why I still using gboard on android (one of few ggl services I still use) is because their largest language collection (even with phonetic method!!), and secondly some tiny features such as undo/redo option, clipboard and theme….

What I thinking now is to modify the apk file firstly to stop getting updates and permanently cutting off gboards connection from internet. Is it a easy task to do? Suggest me if there any discontented Gboard version. Also please share thoughts about keyboard tracking.

4 comments

[ 49.6 ms ] story [ 142 ms ] thread
rasz
Keyboards were always dangerous.

Very first 1981 IBM PC 5150 had special diagnostic backdoor routine hidden in POST code:

https://minuszerodegrees.net/5150/post/5150%20-%20POST%20-%2...

IF REQUESTED, LOAD DIAG. CODE "Take the clock pin in the motherboard's keyboard DIN connector LOW for 40 ms. (Done by the KBD_RESET subroutine.) If the attached device responds with the byte of 65h, the attached device is a special IBM device that supplies diagnostic/test code to the 5150 via the keyboard port. If 65h received, load in the diagnostic/test code (255 bytes) via the keyboard port, then execute the code."

Not that dangerous as it was only active for a split second during boot. But it gave peopple ideas. Zenith Data Systems implemented something similar in its ZBIOS, except meant to be active _at all times_ when computer runs :o

seg000:7B03 in https://github.com/raszpl/Zenith_ZBIOS/blob/main/Zenith%20Z-... :

    seg000:7B03 Backdoor_loader proc near              ; CODE XREF: Keyboard_Process_Modifiers+30↑p
      cli
      mov     ah, IO_Port_64h_KBC_CMD_60_WRITE_CONFIG
      call    Keyboard_KBC_command
      call    Keyboard_KBC_wait_input_ready
      mov     al, 5                                    ; magic Keyboard command to initialize backdoor code upload
      out     IO_Port_60h_KBD_Command, al
      call    Keyboard_Read_Synchronous
      mov     cl, al
      call    Keyboard_Read_Synchronous
      mov     ch, al
      mov     ax, 0
      mov     es, ax
      mov     di, offset 500h                          ; payload lands at 500h
    
    backdoor_load_loop:
      call    Keyboard_Read_Synchronous
      stosb
      loop    backdoor_load_loop
      jmp     far ptr 0:500h                           ; executing our payload
    Backdoor_loader endp
triggered by pressing [T while holding Ctrl:

    check_Backdoor_init_key:                           ; CODE XREF: Keyboard_Process_Modifiers+E↑j
       cmp     ch, 1Bh                                 ; Set-1 scancode [ (Left Bracket) key
       jnz     short check_Backdoor_trigger_key
       or      byte ptr cs:0CEh, 1
       jmp     error_exit

    check_Backdoor_trigger_key:
       cmp     ch, 14h                                 ; Set-1 scancode T key
       jnz     short clear_backdoor_gate
       test    byte ptr cs:0CEh, 1
       jz      short clear_backdoor_gate
       call    Backdoor_loader
Good news for Zenith customers from 1989 someone with more sense disabled this in final bios, but dead code is still there :)
dormento
These are the kinds of comments i keep coming back to hn for.

Thanks for this piece of history.