iOS security problem gives third-party keyboards too much access

iOS security problem gives third-party keyboards too much access


iOS keyboard with network access
If a third-party iOS keyboard has this checked, it has network access.
Photo: Ed Hardy/Cult of Mac

Apple warns iPhone and iPad users that third-party keyboard apps can be granted network access without the user’s approval.

Apple has promised a fix in upcoming iOS and iPadOS updates.

iOS keyboards with too much access

The problem affects add-on keyboards like Google’s Gboard. This does far more than simply let users enter text — it includes a miniature web browser. To accomplish its additional features, it needs network access. Other keyboards have their own extra features that require access to the internet.

Users control how much access the third-party keyboards are given, but today’s warning says there’s a bug in this process.

Apple’s support website reads:

Third-party keyboard extensions in iOS can be designed to run entirely standalone, without access to external services, or they can request “full access” to provide additional features through network access. Apple has discovered a bug in iOS 13 and iPadOS that can result in keyboard extensions being granted full access even if you haven’t approved this access.

An unscrupulous add-on keyboard with network access could track everything you type and then send it all to a remote server where user names  and passwords might be extracted. Of course, the iPhone or iPad owner would first have had to install the keyboard themselves.

How to know if you have additional keyboards installed

Naturally, this is only a problem for people who have installed third-party keyboards. To check if you have, open the Settings app then go to General > Keyboard > Keyboards. All the installed keyboards will be listed.

Tap on any of the add-on keyboards to see what permissions it has. Any that have Allow Full Access checked can connect to the Internet.

Keyboard apps are deleted like any other iOS/iPadOS software. Find the app icon on the home screen, press on it until it starts to wiggle, then tap the X on the icon.

To completely disable a keyboard without deleting it, open the Settings app, go to General > Keyboard > Keyboards, then slide the name of the keyboard to be disabled to the left, off the screen.

Source: Apple


Daily round-ups or a weekly refresher, straight from Cult of Mac to your inbox.

  • The Weekender

    The week's best Apple news, reviews and how-tos from Cult of Mac, every Saturday morning. Our readers say: "Thank you guys for always posting cool stuff" -- Vaughn Nevins. "Very informative" -- Kenly Xavier.