Some Users Find Swype Keyboard App Makes 4000+ Location Requests Per Day

← Back to Stories (view on slashdot.org)

Some Users Find Swype Keyboard App Makes 4000+ Location Requests Per Day

Posted by timothy on Saturday May 3, 2014 @11:02PM from the now-where-are-you dept.

New submitter postglock (917809) writes "Swype is a popular third-party keyboard for Android phones (and also available for Windows phones and other platforms). It's currently the second-most-popular paid keyboard in Google Play (behind SwiftKey), and the 17th highest of all paid apps. Recently, users have discovered that it's been accessing location data extremely frequently, making almost 4000 requests per day, or 2.5 requests per minute. The developers claim that this is to facilitate implementation of 'regional dialects,' but cannot explain why such frequent polling is required, or why this still occurs if the regional function is disabled. Some custom ROMs such as Cyanogenmod can block this tracking, but most users would be unaware that such tracking is even occurring." Readers in the linked thread don't all seem to see the same thing; if you are a Swype user, do you see thousands of location requests, none, or something in between?

34 of 191 comments (clear)

Min score:

Reason:

Sort:

This sounds more like incompetence... by Torp · 2014-05-03 23:07 · Score: 4, Insightful

... than malice.
Or malice (location tracking) plus gross incompetence in implementation.

--
I apologize for the lack of a signature.
1. Re:This sounds more like incompetence... by mrxak · 2014-05-03 23:09 · Score: 4, Insightful
  
  Either way, I'm glad I don't use Swype.
  
  --
  -mrxak
  Onions Will Kill You
2. Re:This sounds more like incompetence... by TrollingForHostFiles · 2014-05-03 23:15 · Score: 2
  
  Read their FAQ about
  "Living language"
  This data mining ain't
  Excess baggage!
  BURMA SHAVE
  
  --
  cat /dev/random
3. Re:This sounds more like incompetence... by TheRaven64 · 2014-05-03 23:34 · Score: 5, Interesting
  
  The Google Keyboard for Android sends what you're typing to Google servers 'to improve suggestions,' so I don't think that asking for your location a lot is the worst invasion of privacy of a mainstream on-screen keyboard app. The AOSP keyboard also requires a phenomenal list of permissions, including the ability to download files without notification, read contacts, modify or delete contents of USB storage and view accounts on the device. No idea why it needs all of these things - I wouldn't mind so much if it had access to all of my data for improving predictions if it didn't also have the ability to make network connections.
  
  --
  I am TheRaven on Soylent News
4. Re:This sounds more like incompetence... by Nikker · 2014-05-03 23:52 · Score: 2
  
  According to Google Play Store this app has about 40K installs. We are saying that 40K x (60x60x24) x 2.5 = 8,640,000,000 rows added per day is something that not even the DBA noticed?
  
  That's a bit of a stretch.
  
  --
  A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
5. Re: This sounds more like incompetence... by robmv · 2014-05-04 00:01 · Score: 3, Informative
  
  download files without notification: dictionary updates
  read contacts: suggestions
  modify or delete contents of USB storage: I don't know why it needs this one, store dictionary outside private app directory?
  view accounts on the device: suggest your email address
6. Re:This sounds more like incompetence... by Nikker · 2014-05-04 00:23 · Score: 2
  
  Mistake on my math that would have been 2.5 / second, the real number would be:
  
  40,000 x (60x24x2.5) = 144,000,000 rows per day (still quite a bit).
  
  --
  A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
7. Re: This sounds more like incompetence... by TheRaven64 · 2014-05-04 01:21 · Score: 3, Interesting
  
  download files without notification: dictionary updates
  Could be bundled as part of the application, updated via the normal mechanism, without requiring it to have a permission that allows it to send data remotely ('download' can mean an HTTP GET with a really long query).
  
  read contacts: suggestions
  Most of the time, I'm not typing a contact's name so this sounds like it would lead to a lot of false positives. I've never seen it suggest a name that isn't a common English name though, so it doesn't seem to actually need this.
  
  modify or delete contents of USB storage: I don't know why it needs this one, store dictionary outside private app directory?
  If that is the case, it's bad design.
  
  view accounts on the device: suggest your email address
  It doesn't seem to ever do that for me...
  
  --
  I am TheRaven on Soylent News
8. Re: This sounds more like incompetence... by Minderbinder106 · 2014-05-04 01:24 · Score: 2
  
  I checked my Privacy Guard settings on my CM11 Nexus 5 and SwiftKey has never accessed my location data.
9. Re:This sounds more like incompetence... by WaffleMonster · 2014-05-04 07:08 · Score: 3, Interesting
  
  The Google Keyboard for Android sends what you're typing to Google servers 'to improve suggestions,'
  Google keyboard provides an option to turn the feature off so there is that.
  
  so I don't think that asking for your location a lot
  Is it asking for your location? Is a list of take it or leave it demands most apps make these days really asking a question?
  
  is the worst invasion of privacy of a mainstream on-screen keyboard app.
  Perfectly happy to declare all of these fine contestants winners of the privacy invasion contest. I must say proliferation of cheesy excuses to collect data is truly inspired. We need to know where you are at all times physically to configure a localization setting...yea that's it...
Regional dialects by jones_supa · 2014-05-03 23:18 · Score: 2

"Regional dialects". :D What an explanation.
1. Re:Regional dialects by Bing+Tsher+E · 2014-05-04 00:26 · Score: 2
  
  Yes, but no matter where you are if you're in an 'update' on some social networking thing, the logical choice is "I'm getting stupid" so no further scanning is necessary.
2. Re:Regional dialects by BasilBrush · 2014-05-04 04:12 · Score: 4, Informative
  
  You need to understand that this application is trying to anticipate what you're trying to type before you type it. If you're at a stop&go and you start to type "I'm getting..." your next word might be Gas, Beer or robbed but it's probably not going to be "ready for work" that would be more likely if you were at home.
  That's quite a fairy tale you've constructed there to excuse a spyware app on your favoured phone platform.
3. Re:Regional dialects by Hognoxious · 2014-05-04 06:18 · Score: 2
  
  Say I'm ganning, I mean going from Newcastle to London. That's about 300 miles, and I'll go from "Why aye man" via "Eee by 'eck" and "alright me duck" to "gor love a duck, guvnor".
  That's a change every 8 minutes - if I'm traveling in a jet fighter..
  By my reckoning it's polling 20 times as often as it could ever need to.
  
  --
  Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Re:Either way by mrxak · 2014-05-03 23:21 · Score: 4, Insightful

Hey, at least those cans and string aren't draining our batteries unnecessarily and uploading our every move to some company doing who knows what with it.

--
-mrxak
Onions Will Kill You
Can someone blow the lid on Android Apps? by Tasha26 · 2014-05-03 23:40 · Score: 5, Insightful

Each time an App wanted to update in the last 6 months, it was to increase its access to areas of my Samsung phone that I thought were completely un-necessary for it to work properly. Makes you wonder who in the Google Store is rubber stamping the ok on such Apps! When will privacy groups wake up and start lawsuits against App makers and/or Google? Maybe it will fist require a popular tech website to run a Top-10 Worst Privacy Infringing Apps in Google store.
1. Re:Can someone blow the lid on Android Apps? by jones_supa · 2014-05-03 23:58 · Score: 4, Interesting
  
  Maybe it will fist require a popular tech website to run a Top-10 Worst Privacy Infringing Apps in Google store.
  Could as well flip it around and instead make a third party give a "Privacy Gold Star" for apps that don't infringe your privacy and don't require unnecessary permissions from the phone operating system.
2. Re:Can someone blow the lid on Android Apps? by Solandri · 2014-05-04 00:43 · Score: 3, Informative
  
  If you're rooted, you can install XPrivacy. It doesn't try to block these apps, it just spoofs the data. So if I haven't given Swype permission to access location data, it will just get fed random locations all over the world every time it thinks it's getting my location.
3. Re:Can someone blow the lid on Android Apps? by Anonymous Coward · 2014-05-04 01:17 · Score: 2, Informative
  
  In the early 00's the requirement for having a firewall and an antivirus on your average Windows desktop PC went from 'good practice' to 'mandatory' as the number of malware types and exploits on the web exploded.
  With Android, it is swiftly thus becoming 'mandatory' to root your phone and install XPrivacy (or similar). Most people just have not realised yet quite how badly they need it.
4. Re:Can someone blow the lid on Android Apps? by quetwo · 2014-05-04 01:38 · Score: 4, Informative
  
  Hate to break it to you -- there is no human intervention required to publish to the Google Play Store, unlike the Apple App Store. The time from the last compile to the app being live in the store is about 15 minutes. So, to answer your wonder -- there is a lonely robot rubber stamping the ok on all those apps...
  Downloader beware!
5. Re:Can someone blow the lid on Android Apps? by nblender · 2014-05-04 01:50 · Score: 4, Interesting
  
  This is one of the things I hate most about Android (having recently switched from an iphone to a Nexus5). I tried to install flashlight app but the top 5 or 10 all wanted egregious access to my phonecalls, instant messages, or full network access. I gave up.
  Later I read a slashdot comment from an Android app developer who said shortly after making his app available in the Play Store, he started receiving messages from individuals offering to pay him a per-download commission on his app if he would consent to linking their "library" in with his app... It was a very attractive commission... So that explains the requests for access to unreasonable things... I don't know how this is different in IOS-land... Maybe the apps just get that access without anyone knowing? Or maybe someone at the App store decides whether a flashlight app needs access to instant message logs ...
6. Re:Can someone blow the lid on Android Apps? by BasilBrush · 2014-05-04 04:21 · Score: 2, Interesting
  
  I don't know how this is different in IOS-land... Maybe the apps just get that access without anyone knowing? Or maybe someone at the App store decides whether a flashlight app needs access to instant message logs ...
  First of all ever app operates in it's own sandbox, so no app can access the data of another app. So the scenario you suggest isn't possible on iOS.
  Secondly, yes, there's an app reviewer, assisted by automated tools, that's looking for whether your app does bad things.
  Thirdly, things such as requesting your location, as in this Swype example, then the OS pops up a dialog asking permission when the app first tries to do it. You can allow it or deny it. And you can change the permission whenever you like via the settings app.
  None of these things are true of Android. And that's why last year 97% of mobile malware was on Android, and 0% was on iOS. (The remaining 3% was on Symbian.)
Re:Either way by TDyl · 2014-05-03 23:50 · Score: 2

I can track you - I just follow the string to find you wherever you are. (What *are* you doing in that closet?)

--
Todd: I hope it proves as delicious as the farmers that grew them
Onr reason more to not use it by houghi · 2014-05-03 23:52 · Score: 5, Informative

If anytime, they should only do that when I launch it the first time. And otherwise, it should look at the setings my phone is using and ONLy as a way to sufets what you want, not to set it.
Mind you, they are not the only ones who think language and location are related. Among others, Google does this too. It does not look at my browser settings (which are in English) but instead guesses from my IP what language I should prefer. I live in Belgium aand guessing the language by location is wrong a LOT of the times.
There is a reason why my browser setting is in English. That is because I WANT it in English. And just because I visit my parents in Spain or my sister in Germany or friends in the USofA does not mean there is any change in preferece in my language.
To me it is broken by design.

--
Don't fight for your country, if your country does not fight for you.
Re:Battery Life by dotancohen · 2014-05-04 00:02 · Score: 2

I have! About three weeks ago I noticed that my battery was drained before the end of the day, whereas until that time it would last me two full days. I have been using Swipe since well before then, though, so if this is related then the 'feature' was just recently implemented.
This is on a Samsung Note 3.

--
It is dangerous to be right when the government is wrong.
MultiLing by B2382F29 · 2014-05-04 00:36 · Score: 4, Informative

I am using multiling keyboard which allows swype input and doesn't even need network permission nor anything else than the user dictionary. https://play.google.com/store/...

--
Move Sig. For great justice.
1. Re:MultiLing by Anonymous Coward · 2014-05-04 01:39 · Score: 2, Informative
  
  I am using multiling keyboard which allows swype input and doesn't even need network permission nor anything else than the user dictionary.
  https://play.google.com/store/...
  
  I'll second this suggestion. When I found out the keyboard that came with my tablet (FlexT9) was no longer in development because Nuance bought Swype, I went looking for alternatives since I was stuck on a software dead-end otherwise, and MultiLing was the one I ended up liking the most.
  Decent defaults but extremely configurable. In addition to swipe, it has a split keyboard mode for thumb typing, options can differ in portrait and landscape, and it can be resized on-the-fly to use more or less screen space while in use. Plus multiple dictionaries (including a "linux dictionary" with completion for shell commands and more), many keyboard layouts (4- and 5-row qwerty, number only, dvorak, colemak, etc.), easy access to extra keys (function, sysrq, ins/break/del, arrows, esc, tab, math symbols, etc.), and some other things I can't think of or don't use. You can change the colours, key sizes, spacing between keys, even the roundedness of the key corners.
  All this and it's a <1mb download (+700kb with the English dictionary). Plus the dev updates it often with bug fixes and features, so it's constantly improving.
  it's not perfect, but easily one of the best keyboards I've used while still being fast and lean.
Not available for Windows Phone by Aphadon · 2014-05-04 00:45 · Score: 2

Unlike what the summary claims, Swype is not available on Windows Phone. Microsoft will however be rolling out their own, similar keyboard soon as part of 8.1. Hopefully one that doesn't do 4000 location requests per day.
Bad Design? by miller701 · 2014-05-04 00:49 · Score: 2

Why doesn't the OS keep track it it's moving of not (all those wonderful sensors) and then have the app ask the OS for the location? If it's sitting on my desk, it shouldn't need to check it's location every 24 seconds.
Re:It's becoming more and more clear.. by nogginthenog · 2014-05-04 00:53 · Score: 4, Informative

Android can already do this. The Amazon App store and F-Droid (FOSS) are 2 options.
Re:Battery Life by hyades1 · 2014-05-04 02:08 · Score: 2

My buddy rooted his Android phone because of this kind of behaviour. He didn't have Swype, but there were at least seven or eight apps that came installed on his S4 constantly trying to phone home.
Once he rooted the phone and got rid of all the crapware, his battery life increased by something in the 5 to 10 percent range. And that's a conservative estimate.

--
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Re:Battery Life by postglock · 2014-05-04 03:10 · Score: 2

I just went through the Swype settings to see where "Regional Dialects" is configured, and I don't see it.
It's actually called "Living Language". It's under "My Words" in the settings.
Re:Fact Check by postglock · 2014-05-04 03:15 · Score: 2

Yes, sorry, a few people picked up on this. I just got that info from the Wikipedia page. I should have checked the source.
Re:Except Facebook App, garbage Zuck, really... by AuMatar · 2014-05-04 18:49 · Score: 2

Yes. Read this https://www.facebook.com/notes... Realize that they thought this was a good idea. Facebook's development practices don't particularly impress me.

--
I still have more fans than freaks. WTF is wrong with you people?