My first thought is, why does a keyboard even need its own software? There's a reason PS/2 and USB HID are standards...<p>I remember purchasing an HP printer a while ago --- it came with a CD full of useless crap, including drivers that took a full 400MB installer containing, among other things, a JVM, Apache Tomcat, and a bunch of other Java-based bloat for the "management UI". I just used the OS generic HP/PCL driver and it's been working that way since. I have heard that even those drivers phone home now, to report how many pages were printed and ink levels etc.<p>Telemetry --- it's in everything now, and this greatly disgusts me. No doubt it's probably buried somewhere deep in the EULA for this keyboard's software, that you agreed to the collection of "aggregate key usage information" or similar. Read the Windows 10 EULA for some similarly creepy wording.<p>Also, if you're paranoid about USB keyboards containing other "hidden devices", a USB-PS/2 adapter would probably work to stop anything else from getting through.
> These days, most products are made in China, but usually some other local company acts as an intermediary to ensure that the product is developed to specification and without other "features" that shouldn't be there. However, this additional protection goes out of the window when people decide to purchase directly from Chinese manufacturers via Chinese marketplaces.<p>Come on, it's not like American manufacturers are a paragon of user privacy, was this jingoistic jab necessary?<p>"Obscure manufacturer screws up" doesn't imply "Chinese engineers are completely worthless".
Not exactly just against cheap gadgets - remember the Connexant keylogger from earlier this year? It seems to be a common thing for driver developers to log keypresses for development purposes yet fail to disable that functionality in release... easiest fix? Don't install closed source drivers for 3rd party hardware.<p><a href="https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogger.txt" rel="nofollow">https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogge...</a>
Read the original posts and saw the package capture screenshot. It seems like it sends stats on how many keypresses there are on a key-by-key basis, not an actual keylogger (ie it doesn't send the content of what you sent).<p>It sends this in cleartext over http, not https. Again, not the content of what you type, so your url+user/pw is not sent (at least not according to what is known now).