Not entirely -- keyboard apps can intercept keystrokes and send them to a remote server.

As far as I can remember, 3rd party keyboards are not allowed for password prompts.

Only when those fields are appropriately annotated, which anecdotally I've run into plenty that are not tagged correctly.

Keyboard apps explicitly have to ask for “full access” and you need to opt-in. Also, apps can block 3rd party keyboards, not sure how many secure / banking apps do that though.

What's stopping an app from imitating the keyboard?

Fundamentally, we're talking about imbuing meaning to patterns of light on a screen. And apps can write on any part of the screen. I suspect the only way to battle this is to have a separate screen which is controllable only from the system.

And even many people will fall for password prompts in the main screen.

> What's stopping an app from imitating the keyboard?

What is the end goal of that? If you have control of the screen (aka are the foreground app), why would you need to emulate the keyboard? If you aren't the foreground app, then you aren't going to be able to render a keyboard on the screen (on iOS anyway).

> why would you need to emulate the keyboard?

to avoid the OS restrictions on which keyboard app is used for passwords.

> you aren't going to be able to render a keyboard on the screen (on iOS anyway).

Are you saying it is impossible to render the pixels and accept screen touches in a way that it acts and looks like a "real" keyboard app?

Dude. Stop and think for a moment. If I am able to render anything on the screen at all, it means I’m the foreground app on iOS. I don’t need to fake being a keyboard, because I can use the real thing Apple provides. So no, I’m not saying it’s impossible if I can render anything at all, what I’m saying is that outside being the foreground app, rendering anything on screen is impossible outside very tightly controlled interfaces (like custom keyboards that this thread was about before you side tracked it).

I am only talking about what the app does when it is the foreground app. I should have addressed that in the previous comment.

It's not a sidetrack, because that's what the actual article is about.

So if you really were talking about the foreground app and not just covering now, then why does one need to make a fake keyboard!? That makes no sense at all.

I was just making a more fundamental point (see my middle para) and decided to hang it off this thread rather than making it top level.

I didn't have a specific scenario in mind.

But to address your question ...

Say a user is reassured because he knows that only approved keyboard apps can accept passwords.

This malware app pops up a password prompt AND some images and input buttons that looks very much like a 'proper' keyboard.

The user enters his password.

Game over.