Skip to content

Instantly share code, notes, and snippets.

@ferventcoder

ferventcoder/swype_repro.md

Last active August 29, 2015 14:11
Show Gist options
  • Save ferventcoder/fc89ab2d8909ef9318d7 to your computer and use it in GitHub Desktop.
Save ferventcoder/fc89ab2d8909ef9318d7 to your computer and use it in GitHub Desktop.
Download ZIP
Swype has a privacy breaking issue on iOS.
Raw
swype_repro.md

Okay, I added a contact with a normal keyboard, waited almost one day and it started showing up in Swype as something I could swype to input. Swype has NO place for it to ask for permission to contacts, so there is no way to shut it off.

Okay, here are the screen shots and the repro steps.

  1. Swype settings as accessed from the keyboard img_3864

  2. My personal Swype dictionary (notice that there are no Z words in here) img_3865

  3. Settings -> Privacy -> Contacts - notice that Swype is not listed here img_3866

  4. Settings -> Swype - nothing here really img_3867

  5. Settings -> General -> Keyboards -> Swype Keyboard - Swype - notice I have not allowed full access (nor would I allow it) img_3868

  6. Contacts App -> Add a Contact - Notice I'm adding a Contact with the regular keyboard with the last name ZzNoChanceInDictionary img_3872

  7. Never type this word in swype, but attempt to swype to see if it has access over the next day.

  8. Note that after some amount of time (it took from 7PM last night to almost 4PM today) you will be able to use that word, a name from contacts. img_3878

I think you will agree this is an egregious privacy concern.

@ferventcoder
Copy link
Author

Spotlight search doesn't include contacts either.

@ferventcoder
Copy link
Author

This actually seems more of a CVE worthy issue if Swype has access to contact information and hasn't been granted that access.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment