Apple

Third-party keyboards make a splash in iOS 8, despite security risks

One of the biggest new features in iOS 8 is the addition of third-party keyboards, something Android has had for a long time. Here's a look at some of the options and the risks behind the keyboards.

Third-party keyboards for iOS 8

In iOS 8, Apple has opened up the keyboard to third-party developers, allowing for much more variety in the look and feel of iOS keyboards, plus innovative (and not-so-new) typing methods like Swype's keyboard drawing method.

However, enterprise users concerned about security should think twice about using third-party keyboards. For some keyboards, "full access" is required, allowing it to transmit typing back to their servers. Typically, this is not a big deal — SwiftKey sends data back to its servers for the optional SwiftKey Cloud service that helps backup and sync typing data to improve its predictions.

But giving any software access to raw typing will likely violate any number of corporate IT policies, even though iOS 8 requires use of the default keyboard when entering passwords.

When activating a keyboard, the iPhone requests permission to give "full access" to the developer of the app, with this ominous warning:

"Full Access allows the developer of this keyboard to transmit anything you type, including things you have previously typed with this keyboard. This could include sensitive information such as your credit card number or street address."

These privacy implications likely play a big role in why it took so long for Apple to decide to implement third-party keyboards in the first place.

In a blog post, SwiftKey explained how its keyboard respects user privacy. Though the keyboard requires full access to work at all, that's largely to optimize speed and responsiveness. Instead of storing its predictions and other components in the keyboard extension itself, the prediction engine is hosted in the SwiftKey app, which only works if full access is allowed.

"Keeping all of this in the container app helps ensure the keyboard extension's memory footprint is manageable for better performance and allows us to offer the full SwiftKey experience that we've become known for."

Though it is possible for the app to send your typing back to the company for analysis, SwiftKey says it only does that if the optional SwiftKey Cloud service is activated. Even then, the app intentionally ignores personal information like credit card and phone numbers.

SwiftKey Keyboard is a free download from the App Store, and it was downloaded more than one million times in the first 24 hours of availability.

Then there's Fleksy, a $1 paid app that claims to be the fastest keyboard in the world. It includes colorful themes, gestures to add punctuation (and more), a resizable keyboard, and multilingual typing.

Swype is a $1 keyboard from Nuance, the voice recognition company, that focuses on a finger-dragging typing ability that's popular with many Android users, similar to the one included in SwiftKey.

Unlike SwiftKey, neither Fleksy nor Swype require full access to work, though Fleksy can improve performance by allowing language data to sync from Facebook, Gmail, or Twitter, with all prediction work done within the keyboard itself rather than routed through a standalone app like SwiftKey.

Swype does not require full access for any functionality, except in limited cases like using the Guided Access accessibility mode.

All these keyboard apps are available from the App Store, along with a number of other keyboards from less well-known companies.

Are you using a third-party keyboard on iOS 8? Let us know how it's working in the comments below.

About Jordan Golson

Jordan Golson is an Apple Columnist for TechRepublic. He also writes about technology and automobiles for WIRED and MacRumors. He has worked for Apple Retail twice and has been writing about technology since 2007.

Editor's Picks

Free Newsletters, In your Inbox