Stories about data breaches have become increasingly common in 2017. The fact that tech companies are hemorrhaging user data is not as newsworthy as it was way back in February or March.

Initially, the news that ai.type, a company which makes virtual keyboards, had lost over 31 million user records was moderately interesting, but not a story in its own right.

However, while the cause of the breach – a badly configured database – points to sloppy security, researchers were stunned at the amount of information the company collected from each user.

User records included:

• phone numbers
• full names
• device name and model
• mobile network
• SMS, IMSI and IMEI numbers
• email addresses
• country of residence
• social media links
• …and location data

For every customer.

Bob Diachenko, the chief communications officer for security research company Kromtech, told Info Security Magazine: “When researchers installed Ai.Type they were shocked to discover that users must allow Full Access to all of their data stored on the testing iPhone, including all keyboard data past and present,” [DIGIT’s emphasis]

“It raises the question of why would a keyboard and emoji application need to gather the entire data of the user’s phone or tablet? Based on the leaked database they appear to collect everything from contacts to keystrokes. This is a shocking amount of information on their users who assume they are getting a simple keyboard application.”

Evaluate Permissions

Mark James, security specialist at ESET, said the company’s gathering such a vast range of data was unacceptable.

“That in itself is a massive horde of data to hold on a well secured server away from harms reach, but sadly that was just not so. The database was not configured correctly and thus enabled full access from the internet to all the data being held, making it essentially free for all access,”

“Always evaluate the permissions before you install any programs or applications, as there are so many choices these days it can sometimes pay dividends to pick and choose your apps wisely.”

In the world of ubiquitous free apps, there’s still a cost involved in using software, which can be surrendering personal data, or indeed allowing a developer to hoover up every piece of information from the most personal device you own.

Even without the data breach, that’s a ridiculous amount of data for a company producing keyboards to demand. In a world full of free apps it can be easy to forget that there’s a cost for using most software, even if it’s not monetary.

If you’re permitting a company to access ALL of the data on your device, make sure there’s a damn good reason for them needing it. Or, look for an alternative which is less intrusive and likely to cause you grief in the future.

Trust us, we’re professionals…