The not-so-silent type: Vulnerabilities across keyboard apps reveal keystrokes to network eavesdroppers

This report examines cloud-based pinyin IME/keyboard apps from nine major vendors and finds that eight contain transport or cryptographic flaws enabling passive network eavesdroppers to recover users' keystrokes (including passwords and app contexts). The analysis details specific weaknesses (custom AES variants, static/fixed keys, IV reuse, DES/ECB usage, plaintext HTTP/UDP), shows affected platforms and preinstalled OEM builds, estimates up to ~1 billion users potentially impacted, documents vendor disclosure/responses, and offers recommendations to users, developers, OS vendors, and app stores.