<story><title>Virtual Keyboard Developer Leaked 31M Client Records</title><url>https://mackeepersecurity.com/post/virtual-keyboard-developer-leaked-31-million-of-client-records</url></story><parent_chain><item><author>lamlam</author><text>&amp;gt;When researchers installed Ai.Type they were shocked to discover that users must allow “Full Access” to all of their data stored on the testng iPhone, including all keyboard data past and present. It raises the question of why would a keyboard and emoji application need to gather the entire data of the user’s phone or tablet?&lt;p&gt;I have a suspicion that due to how cheap bulk storage is these days, that companies collect as much information as they can get away with in hopes that _maybe_ it will be useful one day. That mixed with poor security practices is just going to keep leading to these sorts of events happening.</text></item></parent_chain><comment><author>mtgx</author><text>This is why I&amp;#x27;m a believer in this type of regulation - you have two options:&lt;p&gt;1) Collect only the data strictly necessary for the functioning of the service. If you suffer a data breach, you used security best practices, and notified the corresponding authorities and your users in due time, then you shouldn&amp;#x27;t be punished at all, with very few exceptions. If you didn&amp;#x27;t use best security practices, you may see some small to moderate fines, depending on each case.&lt;p&gt;2) Collect whatever you want (while still mentioning it in your Privacy Policy, and the whole thing). But if you suffer a data breach, and that data is exposed, you should need a big fat banking account to survive the fine that will be imposed on you. The fines should be big enough that they should deter even the big players from collecting too much of the data they &lt;i&gt;don&amp;#x27;t need&lt;/i&gt;.</text></comment>
<story><title>Virtual Keyboard Developer Leaked 31M Client Records</title><url>https://mackeepersecurity.com/post/virtual-keyboard-developer-leaked-31-million-of-client-records</url></story><parent_chain><item><author>lamlam</author><text>&amp;gt;When researchers installed Ai.Type they were shocked to discover that users must allow “Full Access” to all of their data stored on the testng iPhone, including all keyboard data past and present. It raises the question of why would a keyboard and emoji application need to gather the entire data of the user’s phone or tablet?&lt;p&gt;I have a suspicion that due to how cheap bulk storage is these days, that companies collect as much information as they can get away with in hopes that _maybe_ it will be useful one day. That mixed with poor security practices is just going to keep leading to these sorts of events happening.</text></item></parent_chain><comment><author>danso</author><text>I thought most keyboards at least ask for Full Access, though may not necessarily mandate it:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;techcrunch.com&amp;#x2F;2014&amp;#x2F;10&amp;#x2F;04&amp;#x2F;everything-you-need-to-know-about-ios-8-keyboard-permissions-but-were-afraid-to-ask&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;techcrunch.com&amp;#x2F;2014&amp;#x2F;10&amp;#x2F;04&amp;#x2F;everything-you-need-to-kno...&lt;/a&gt;&lt;p&gt;I was never sure what &amp;quot;Full Access&amp;quot; meant, other than keyboard data (including keystroke recording if the dev wanted it) going forward. But surely it doesn&amp;#x27;t mean &lt;i&gt;everything&lt;/i&gt;, as in access to keyboard-non-related data (user photos, etc).?</text></comment>