“Our analysis found that eight of the nine apps identified contained vulnerabilities that could be exploited to completely reveal the contents of users’ keystrokes in transit.”
Citizen Lab tested pinyin keyboards from Baidu, Tencent, iFlytek, Samsung, Xiaomi, OPPO, Vivo, Honor and Huawei. Only Huawei passed. Most of the broken ones leak to a purely passive eavesdropper, and up to a billion people use them. The default keyboards on Honor, OPPO and Xiaomi phones were vulnerable out of the box. Every word typed gets shipped to a cloud server, and nobody bothered to encrypt it properly.