  End-to-End Encryption (E2EE) aims to make all messages impossible to read by
anyone except you and your intended recipient(s). Many well-known and widely
used Instant-Messaging (IM) applications (such as Signal, WhatsApp, and Apple's
iMessage) claim to provide E2EE. However, a recent technique called client-side
scanning (CSS) makes these E2EE claims grandiose and hollow promises. The CSS
is a technology that scans all sending and receiving messages from one end to
the other. Some in industry and government now advocate this CSS technology to
combat the growth of malicious child pornography, terrorism, and other illicit
communication. Even though combating the spread of illegal and morally
objectionable content is a laudable effort, it may open further backdoors that
impact the user's privacy and security. Therefore, it is not E2EE when there
are censorship mechanisms and backdoors in end-to-end encrypted applications.
In this paper, we introduce an encrypted keyboard that functions as a system
keyboard, enabling users to employ it across all applications on their phones
when entering data. By utilizing this encrypted keyboard, users can locally
encrypt and decrypt messages, effectively bypassing the CSS system. We first
design and implement our encrypted keyboard as a custom keyboard application,
and then we evaluate the effectiveness and security of our encrypted keyboard.
Our study results show that our encrypted keyboard can successfully encrypt and
decrypt all sending and receiving messages through IM applications, and
therefore, it can successfully defeat the CSS technology in end-to-end
encrypted systems. We also show that our encrypted keyboard can be used to add
another layer of E2EE functionality on top of the existing E2EE functionality
implemented by many end-to-end encrypted applications.
