Fact · Voice privacy and security
Citizen Lab says most of the vulnerable keyboard apps it found in 2024 can be exploited by a passive network eavesdropper, who needs no action from the user.
Checked against its source on October 17, 2026
In the source's own words
“Most of the vulnerable apps can be exploited by an entirely passive network eavesdropper.”
Vulnerabilities across keyboard apps reveal keystrokes to network eavesdroppers, Citizen Lab, University of Toronto, 2024, Findings.
Open the original- What it measures
- Citizen Lab's 2024 report tested keyboard apps from nine vendors for flaws in how they send keystrokes over the network. The eavesdropper observes traffic on the network path between the phone and the vendor's server.
- What it does not show
- The vendors tested are mostly makers of input methods for Chinese. The report shows that the traffic could be read by a network observer, not that any vendor collected typed text.