6 ms·
68.3% of people in China use third-party keyboards – many of them use Signal
- mam2 6y agoIm confused .. people are debating wether it's good to track what keyboard people use but instead of tracking which keyboard peoeple use, would it be not simpler for signal to basically build their own integrated keyboard and deactivate the android default one ?
- toomuchtodo 6y agoThis is likely the result of this discussion. To fix an issue (decide to commit dev resources to develop an integrated keyboard, communicate to users the data leakage risk of using a keyboard not integrated into the app), you must first raise said issue and perform discovery.
- resynth1943 6y agoI think the word 'track' is misleading in this context. The proposal outlines various methods to detect the use of a third-party keyboard, whereas the term 'track' commonly denotes corporate surveillance. They could do that, but it would have a maintenance cost. I do think we need to find a solution to this, however, as these personalised keyboards actually _track_ what people type. That could have real-world implications.
- mam2 6y agoThe word is not from me, read the messages of the issue
- ProAm 6y agoI thought Signal came out with their own keyboard and I was excited.
- xster 6y agoEven if they did, creating a Chinese IME is a really difficult problem space. Since typing is generally done phonetically in mainland/HK/taiwan and the real words being typed are ideographic, there's a lot of inference to translate in between. Considering how quickly the language moves to keep up with internet culture and new newsworthy names, new parlances, new memes, an IME has to do the equivalent of staying up to date with the equivalent of urbandictionary for users to be able to invoke the latest "lit" colloquialism. This is a full-time job on its own.
- novok 6y agoThe side effects of chinese not adopting a phonographic writing system when it could, or having both like japanese does so you don’t need to use such an informal ambiguous layer when actually writing.
- jrockway 6y agoThat doesn't really solve the problem. Homophones exist, and entering the phonetic representation in some native character set would still require an additional conversion step to disambiguate the homophone. (i.e. in Japanese you can type in hiragana, and many phone IMEs work like that, but you still have to convert that input to kanji; nobody wants to read your long stream of hiragana.) The input methods add value based on how frequently they suggest the correct conversion as the first candidate (based on context). Imagine typing English by speaking. You can say "flower", but that might get written out as "flour". Some intelligence has to be implemented that picks the right one based on context, or give you the ability to correct it. That is where the complexity in east asian input methods come from. (Yes, as English-speaking computer users we are very lucky. The exact sort of symbols that readers of English expect map 1:1 to our keyboards. Still kind of a pain on a phone, though!)
- yorwba 6y agoJapanese IMEs operate basically the same way as Chinese ones.
- bigpumpkin 6y agoObviously due to the fact that Chinese input could be better optimized by third parties.
- darkwizard42 6y agoI'm not sure the headline reflects the discussion issue...It is anecdotal on how many Chinese users are using Signal, but the concern is that so many use third-party keyboards it could be compromising the secure nature of Signal (and the discussion is advocating for users to be made aware of the risks of using third party keyboards with Signal)
- resynth1943 6y agoI chose to highlight the Chinese aspect, but you're absolutely right: any keyboard with personalisation puts Signal users at risk.
- yorwba 6y agoThe guidelines exhort us to: > ... please use the original title, unless it is misleading or linkbait; don't editorialize. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html If you can still edit the title, you should change it to the original "Signal should warn users who are likely using insecure IME apps"
- resynth1943 6y agoI'll bear it in mind in future. Thanks.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- NikolaeVarius 6y agoHow does Signal work in the context of the Great Firewall? Can china shut down Signal by banning traffic that seems like Signal communication??
- u678u 6y agoAgreed this was my surprise about the headline. I assumed it'd be blocked.
- kombucha111 6y agoIt works as is usually on Chinese ISPs though I noticed occasional interruptions. Using a VPN got rid of those disruptions.
- upofadown 6y agoIt isn't really suitable for political dissent. I think they would be more unhappy with things like Telegram that can have huge group chats.
- powerapple 6y agoPeople use Twitter, YouTube, Facebook, Telegram with VPN in China. Twitter are mostly for porn, telegram for shady business and porn. I would assume you will probably need to use VPN for Signal.
- chickenpotpie 6y agoI remember a few days ago there was a post on hackernews to stop being mean to the people that worked at signal. The Twitter user linked in that article is railing into signal devs and she calls them assholes that don’t care about what happens outside of western society. https://twitter.com/RealSexyCyborg/status/1197695376200880128?s=20 https://twitter.com/RealSexyCyborg/status/119769537620088012...
- danbolt 6y agoThe thread there is really interesting. Apparently the "OEM" IMEs aren't the ideal standard for Chinese input, so people tend to use a proprietary one like Sogou's. [1] [1] https://en.wikipedia.org/wiki/Sogou https://en.wikipedia.org/wiki/Sogou
- solarkraft 6y agoThe OEM IMEs are also proprietary, which makes me question everyone's points.
- cutitout 6y ago> calls them assholes that don’t care about what happens outside of western society That's hardly her main point: > For Chinese who are used to a specific IME- like Sogou, trying to type on something else is a tiny bit like a QWERTY user suddenly faced with Dvorak- we can make it work, but it's slow enough day to day that 50/50 they just install Sogou because what's the big deal right? > The Signal "fix" is "Incognito Mode" aka for the app to say "Pretty please don't read everything I type" to the virtual keyboard and count on Google/random app makers to listen to the flag, and not be under court order to do otherwise. > Needless to say, Sogou/Baidu dos not respect the IME_FLAG_NO_PERSONALIZED_LEARNING flag. So basically all hardware here is self-compromised 5 minutes out of the box. > so unless journalists tell them otherwise, which they have not been doing- users will install Sogou. This is important.
- durkie 6y agoI understand Naomi's point here, but I'm unclear how it relates to Signal. Isn't this an issue with 3rd party keyboards in any app?
- tracyhenry 6y ago"many of them use Signal" - where is this conclusion come from? They have WeChat. I've never seen any of my Chinese friends using Signal.
- TazeTSchnitzel 6y agoThat's kinda irrelevant to whether Signal should try to help Chinese users?
- tracyhenry 6y agoIdk. I commented because the title is wrong and misleading.
- rejschaap 6y agoTotally irrelevant, but it's there, in the headline and it's not true. They probably tried to say that most of signal users use third party keyboards.
- Aperocky 6y agoThis. Absolutely none of my family and friends in China use Signal. There are a few that uses slack though.
- jackjeff 6y agoWhen Donald Trump threatened to block WeChat in the US expats and Chinese people alike started to download Signal. https://www.nbcnews.com/tech/security/trump-bans-wechat-some-china-turn-encrypted-messaging-app-signal-n1236184 https://www.nbcnews.com/tech/security/trump-bans-wechat-some...
- tracyhenry 6y agoThat's about Chinese people in the US. The headline explicitly says "people in China". Note that even for Chinese people in the US (myself included), Signal was in my experience a pretty minor choice when Trump was trying to ban WeChat. Whatsapp, Line, etc were among the favorite alternatives.
- wffurr 6y agoI wouldn't expect the first party keyboard on a Chinese-manufactured phone to be any safer than a third party IME.
- solarkraft 6y agoI'll file this under "security tips". Signal should probably give its users tips for communicating securely - but that's at least one degree separate from "warn users about insecure IMEs". Additionally, if you're already using a chinese phone, why does it matter whether your IME is compromised? Doesn't the CCP already have its nose in all of the manufacturers' OSes already? Maybe Signal should warn about that as well. I'm all for helping people communicate securely, something Signal should be very interested in, but the hyper focus on IMEs is confusing.
- jstanley 6y ago> Doesn't the CCP already have its nose in all of the manufacturers' OSes already? What specifically are you saying here? Are you suggesting that every Chinese person's phone is sending off their keyboard inputs to the Chinese government even if they don't use a compromised IME? Because if not, then yes it matters whether or not your IME is compromised. Otherwise your position is just "the phone might be compromised in ways I don't know, so I won't even bother fixing the ways I do know".
- beervirus 6y agoI would assume that any phone purchased in China is compromised by the CCP.
- jstanley 6y agoIn what way though? Are you arguing that people should just ignore security vulnerabilities that they are aware of, on the basis that you think there might be some vulnerabilities that they're not aware of?
- esrauch 6y agoThe linked paper literally just says "(assume the default IME app does not have these problems)" in it without justification. This thirdparty IME concern seem really more relevant for e.g. Japan being worried about it's citizens using a compromised Baidu IME instead of a more trustworthy preinstalled Japanese one. All IMEs all can be keyloggers and the Chinese government can necessarily access Baidu data, and any smaller Chinese IMEs will be outside the auditing and enforcement jurisdiction of the Japanese government. If you're inside China using the preinstalled OnePlus IME that "untrustworthy supposition" just already holds to the preinstalled one, and there's little reason to believe at least some of these third party IMEs are more likely to be compromised than the preinstalled one instead of less likely.
- powerapple 6y agoI would say I would be surprised if many>1% of the people. I have yet to know a single Chinese ever mentioned Signal.
- wodenokoto 6y agoSome years ago, the Japanese government send out warnings and restriction on usage of Baidu's IME. It was one of the early ones to sync to the cloud for better predictions. https://www.techrepublic.com/blog/asian-technology/japanese-government-warns-baidu-ime-is-spying-on-users/ https://www.techrepublic.com/blog/asian-technology/japanese-...
- einpoklum 6y agoBut are Microsoft or Google's keyboard apps actually secure? That is, is it certain that they don't log keys or phone home somehow?
- 0xquad 6y agoNet net: what IME is best for a mainland Chinese user of Signal?
- bloody-crow 6y agoWhy a keyboard application code even needs access to the internet? Could the OS just not allow it in the first place? I honestly don't fully understand why it's a Signal's problem in any way.