Data-slurping keyboard app makes Mongo mistake with user data

Preemptive Hostility?

"So no one that uses our keyboard cannot be offended in any way and they all can feel safe, the data is completely flat and non-personal."

So everyone who uses their keyboard must be offended?

Sleep-walking to the Data-Apocalypse one leak at a time

'No sensitive data there' - Who are they trying to kid? - Nothing to see here, except the sheer delusion of App-makers and Cloud peddlers everywhere:

"MongoDB database ... found unsecured online containing 577GB of data collected by predictive keyboard app AI.type from its over 31 million users. This included the name, email address and location, along with IMSI and IMEI numbers, IP address, phone spec and OS details, and links to user's social media profiles and photos. It also slurped 373 million names and phone numbers from the contacts of over six million users."

Why do people find the need to use a keyboard with Internet access?

It's pretty obvious what's going to happen.

Lineage OS or something like Hacker's Keyboard or Simple Keyboard will do the job just as well.

"This included the name, email address and location, along with IMSI and IMEI numbers, IP address, phone spec and OS details, and links to user's social media profiles and photos. It also slurped 373 million names and phone numbers from the contacts of over six million users."

“There is no sensitive data there, we are not collecting\storing \sending any password or credit card information,”

if the data mentioned in the first quote isn't sensitive, I don't know what is.

Keyboard Apps?

Being an iOS user, I simply can't imagine why someone would switch out the keyboard that is provided by the developer of their OS, with a widget from the Play store, where you have zero assurance that it isn't up to something nefarious, like what happened here.

Perhaps one of those keyboard users can tell us, when installing this App, did it at any time warn that it would be transmitting every word your name, email, phone number and everything you ever typed in it to their servers?

And we wonder why we don't have security. No matter how secure people make their passwords, its all for nothing if it just winds up in your keyboard loggers, I mean, keyboard app makers, database.

Predictive test app == keylogger?

Surely, if using a "predictive text" keyboard, there would be a history of the words you are typing on your phone in this database? A miscreant could easily sort through through the words and pick out sensitive PII from them.

And yet....

It's STILL on the Google Play Store!

(Sigh)

In the shady developers defense...

Most of the slurp is disclosed in the developers "privacy" policy (that nobody ever reads)

1.2. Data Collection. ai.type Application may collect statistical information (such as Ad-ID, IP address, Location based IP, contacts list, text messages, SSAID, IMEI, USER-ID , list of Apps installed, behavioral information) to ensure proper operation, verify information, tailor the keyboard to your specific preferences and ensure information security. ai.type will NOT publish NOR disclose any of user’s private and confidential information, such private ID numbers, driver’s and other license numbers, non-public contacts, or any other information that is not publicly accessible.