Apple iOS Third Party Keyboards

I was having a cup of Coffee with a friend of mine and we were discussing various cyber security related topics and he mentioned that his daughter had downloaded a third party keyboard which was requesting “Full Access” to her phone.  The app prompted “gives the app full access to the Internet.”   Obviously she was concerned about what that meant.  So here’s the scoop.

When you install a “third party keyboard” app and you go in to add a new keyboard in the settings, Apple provides more information.  See the “Apple iOS – Add Third Party Keyboards” figure below.

Apple iOS- Add Third Party Keyboards
Apple iOS- Add Third Party Keyboards

The information that brings up states “If you enable Full Access, developers are permitted to access, collect and transmit the data you type.  In Addition, if the third party application containing the keyboard has your permission to access location, photos or other personal data, they keyboard can also collect and transmit that information to the keyboard developer’s servers. ”   Further, it states that if you disable the access and later enable the access, the app may still be able to access information that you previously typed while it was disabled.

Apple iOS About Third Party Keyboards
Apple iOS About Third Party Keyboards

The app, GIF Keyboard, description said that the full access was necessary to access the Internet, and said pretty much the same thing in the privacy section of the app when viewed on the Apple App Store.  The app was considerate enough to provide an online link to their Terms of Use.

GIF Keyboard Description in App Store
GIF Keyboard Description in App Store

First a disclaimer, I am NOT a lawyer.   I reviewed the agreement and I quickly find a couple of concerns in that agreement.:

 1) If you link your online account for the keyboard application to your social networking service, you are granting them access to your social account. 

2)  Any data that the keyboard application collects you automatically grant the vendor several “worldwide” rights, such as: irrevocable, non-exclusive, transferable royalty free, with rights to license and sub-license to use, copy, modify, adapt, …..

Ok, so my not so legal mind kind of gets the idea that they get your stuff and can do whatever they want with it.

I am still not clear if the keyboard application only grabs information while you are using their application or even when you are not using the keyboard app.  My thought is that the app will still have the access even if you are not using it.  (Anyone with a forensic background can prove or disprove this, please let me know!)

The bottom line.  Be sure to read the Terms of Service, Terms of Use, etc, when using any services, software, applications, etc.  Especially the free ones.

This brings to mind an old saying, “You get what you pay for.”  Well, be careful, you might get (or lose) more than you expect.