Request pricing
En


      Secure in-app keyboard

        Technique summary
      Technique Secure keyboard
      Against Screen recording, malicious keyboard, and UI injection attacks
      Limitations None
      Side effects May reduce user's functionality compared to the standard keyboard
      Recommendations Recommended for use on Android API Level ≤ 30 (Android ≤ 11)

      A secure in-app keyboard for Android apps is a specialized keyboard designed to enhance security and privacy when users input sensitive information within a mobile application. Unlike standard keyboards, which might be susceptible to various forms of interception, a secure keyboard app is specifically engineered to mitigate these risks. By using a secure keyboard for Android, developers can prevent unauthorized access, reducing the risk of data breaches or theft. Many in-app secure keyboards also feature encryption and do not store user input, adding another layer of protection.

      Keypress leaks

      screnrec-flag-secure-leak

      Left: Unprotected view. Right: Protected view leaking information through the keyboard.

      In Android ≤11 the standard keyboard may leak information about keypresses.

      The solution would be to use a dedicated keyboard for the application, and setting FLAG_SECURE on the keyboard. As a result, every time the user is typing, the keyboard would appear, and the screen would become black. However, this might not be convenient to happen everywhere in terms of UX.

      A better solution could be to apply FLAG_SECURE only on specific edit text views. This can be done by filtering by a particular field ID, which can be obtained from the symbol list. For example:

      public class MyKeyboard extends InputMethodService { // (...) @Override public void onStartInputView(EditorInfo info, boolean restarting) { // (...) String packageName = info.packageName; int fieldId = info.fieldId; if (packageName.equals("my.protected.app")) { if (fieldId == 0x7f070054) { Objects.requireNonNull( getWindow().getWindow()). addFlags(WindowManager.LayoutParams.FLAG_SECURE); } } // (...)

      Malicious keyboards

      Malicious keyboards can replace the user's default keyboard entirely, leading to continuous keylogging. A dedicated secure in-app keyboard helps mitigate the risk. A secure keyboard on Android gives you greater control over your data and reduced exposure to third-party tracking. Integrating a secure keyboard for Android within financial or personal messaging apps, for example, can significantly enhance privacy and security.

      Guardsquare

      Table of contents