> In this report, we analyze Tencent’s Sogou Input Method, the most popular Chinese input method with over 455 million monthly active users and versions of the app for multiple platforms, including Windows, Android, and iOS. Sogou Input Method accounts for 70% of Chinese input method users, with products by iFlytek and Baidu taking second and third place, respectively. This part is surprising to me. Are the Chinese i…
“Please do not make it public” (Tencent’s Sogou Input Method)
31–40 of 43 posts
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#32It seems like this could be in part mitigated by making sure their server is not an oracle (though obviously fixing the primitives is also important, but older/non-updatable clients could exist).
I would guess the traffic all over TLS on iOS due to "App Transport Security" requiring https by default - it's not a huge leap to turn it off, but it's controlled by the App's Info.plist so is trivially indexable. Also probably more work than just adding 's' to the protocol (at least from the PoV of the individual dev working on the code).
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#33> In this report, we analyze Tencent’s Sogou Input Method, the most popular Chinese input method with over 455 million monthly active users and versions of the app for multiple platforms, including Windows, Android, and iOS. Sogou Input Method accounts for 70% of Chinese input method users, with products by iFlytek and Baidu taking second and third place, respectively. This part is surprising to me. Are the Chinese i…
Windows OS pinyin->character input.... I don't know if I've ever seen someone use something other than Sogou lol, so honestly I can't say how good or bad windows native is at this now.
It's a hard problem, because of the 1:many fanout for any given pinyin input. "bao" can mean like 40 different things - bread thing, weak (?), hug, violence (?), treasured-one (think like "my precious", like a pet name for a baby?), etc etc. Sogou had a big leg up for a long time because it figured out the correct words from context much better than other alternatives, requiring fewer manual selections.
(semi-related note, google's voice->text still fails pretty hard for regional mandarin. For example it really doesn't like the hard Rs at the end of words in far northeastern mandarin. It can't seem to figure out that "baoERRRR" is actually just "bao". That problem doesn't exist for pinyin->characters though)
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#34> In this report, we analyze Tencent’s Sogou Input Method, the most popular Chinese input method with over 455 million monthly active users and versions of the app for multiple platforms, including Windows, Android, and iOS. Sogou Input Method accounts for 70% of Chinese input method users, with products by iFlytek and Baidu taking second and third place, respectively. This part is surprising to me. Are the Chinese i…
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#35> In this report, we analyze Tencent’s Sogou Input Method, the most popular Chinese input method with over 455 million monthly active users and versions of the app for multiple platforms, including Windows, Android, and iOS. Sogou Input Method accounts for 70% of Chinese input method users, with products by iFlytek and Baidu taking second and third place, respectively. This part is surprising to me. Are the Chinese i…
American companies man. They really don't care. So much stuff just breaks or does the bare minimum if you're using any kind of IME, or if you're not using UTF8, or even if you're not using ASCII. There seems to just be a general cultural incomprehension that there's any other way of writing on computers. (It's not even limited to companies - there's a whole bunch of Linux stuff with the same problem, e.g. Snap/FlatPak just break everything and don't care)
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#36Earlier quoted context omitted.
> Why do they elect to do this? They could be rightly suspicious of a western TLS implementation but discovered the pitfall of writing their own. Could have also been intentional.
> They could be rightly suspicious of a western TLS implementation but discovered the pitfall of writing their own. Could have also been intentional. They could have deployed TLS with some cipher of Chinese origin, not like Chinese companies haven't done this before [0] [0] https://ciphersuite.info/cs/TLS_SM4_GCM_SM3/
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#37Earlier quoted context omitted.
From TFA > While alphabetic keyboards typically provide autocomplete features for more expedient typing, predictive features in Chinese input methods are more crucial when using input methods such as pinyin where hundreds of characters might match an inputted pinyin syllable. For longer strings of syllables, an IME will commonly reach out over the network to a cloud-based service for suggestions if suitable suggestio…
It's impressive that users are ok with this. This is even beyond the (now generally-accepted) analytics and ad targeting, it's literally "we'll send all your keystrokes to a remote server", a literal keylogger.
On the consumer privacy side, talking about consumer data safety from companies using it for commercial exploitation, that's where there is allowable space to be protective, and the laws reflect that in the PRC. If Tencent was found to be doing something that was seriously exploitative of user privacy in a way that made enough Chinese very angry, it would be almost certain that Tencent would be breaking some law to do so, and depending on the circumstances you could see anything from mandatory "make it right" directives from the government to the execution of Pony Ma as a result. PRC citizenry expect that if they are seriously harmed, en masse, by a company, the government will make it right.
This is a very different environment and culture from what we have in the West. In general, if I was the victim of significant harm (alongside many other people) by a large corporation, I would not expect justice. The CEO or those who made the decisions that harmed me wouldn't be executed, the company wouldn't be forced to push an update making my device safe to use again or pay a full refund to everyone, etc. As a result, if I care about this issue I'm not really thinking about the consequences for big companies of harming me, I'm just thinking about how to protect myself. What software can I individually use to protect my privacy, what companies should I individually avoid because I know I don't like what they're doing, etc. These are philosophically quite different approaches to privacy concerns - we have a lot more individual freedom in the West if we choose to use it, when it comes to individual net privacy, but the general attitude of PRC is that they don't have to worry about the privacy thing because the government will handle it one way or another.
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#38What is the significance of the headline? It seems like the editors are trying to play into popular stereotypes for clicks, because reading through the disclosure log, it seems like a straightforward process marred by some minor email/communication issues. No real attempt at "suppression/censorship", as the headline implies. What am I missing?
Yes, what could be wrong with some keyboard input addon that sends every keypress to Tencent, and on top of that, in a manner trivial for a passive eavesdropper to decode? We used to call these things "keyloggers".
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#39> “Please do not make it public” (Tencent’s Sogou Input Method) (citizenlab.ca) Ok, so they didn't make it public and the development team fixed the bugs. Maybe I am missing some new trend where the headline in these disclosures _has_ to come from the communication with the company. Kind of like vulnerabilities need custom websites with logos and cool made up names? > Even with the reported vulnerabilities now resolv…