4 ms·
The conclusion is there's no problem, that it wasn't the nefarious activity that he originally thought it was. The additional point he's trying to make is that
by RafiqM 8y ago
The conclusion is there's no problem, that it wasn't the nefarious activity that he originally thought it was.
The additional point he's trying to make is that app developers should use FLAG_SECURE if its confidential data - messaging probably should be, and his bitcoin app should almost certainly be.
- brodyprice 8y agoAh, that makes sense, thank you. I think I was thrown off by the link's title, "Unauthorized Screenshots in Android Phones" - I read it as a security issue
- jarfil 8y agoKeepass2Android and Signal have it as an option, Orfox just enables it on webpages but disables it on the settings screen, Netflix enables it on video playback. My banking app doesn't have the option at all, yay banking!
- cpv 8y agoFirefox Focus has this enabled, and some banking/payment apps (the developers knew about the flag).
- izacus 8y agoHow is messaging confidental data? Remember, FLAG_SECURE prevents users from taking screenshots themselves as well and prevents display of content in several other cases (e.g. screen mirroring). Your conversations aren't nearly as sensitive to require such a large breach of usability.
- saagarjha 8y ago> Your conversations aren't nearly as sensitive to require such a large breach of usability. Yours might not be, but this isn’t true for everyone.
- izacus 8y agoI'd be happy to hear about an attack vector that compromises encrypted private OS storage on Android, but does not compromise the apps view hierarchy rendered by the same OS. FLAG_SECURE is just an OS flag though. Because your sentence just sounds like platitude without any thought behind it.
- oliwarner 8y agoI think the broader point is that it stops the user doing something they want to. Something they could still do with a camera. The flag should secure it from other apps but the user screenshot tool should be able to override it. The cap framework should be able to do this, you just need to insulate the app itself to ensure only real people can use it.
- Confiks 8y agoPreventing screenshots and showing up in the active apps list is an option within the Signal preferences. So Signal provides a precautious default, but allows you to turn it off.
- izacus 8y agoThis is the right way to do it in my opinion.
- solarkraft 8y agoI hate apps using FLAG_SECURE with full passion. I want to take a fucking screenshot and you don't allow me to.
- tjoff 8y agoYeah, for some reason web browsers feel the need to do that when browsing in private mode. It is one thing to block automatic screenshots or screen recordings. Another when the user explicitly tries to take a screenshot.
- rhamzeh 8y agoI know some password managers (myki, lastpass and I think 1Password have an option to toggle it off). It's on by default, which should be true for most apps with confidential data. But other apps (like photos and messaging apps, can at least have that as an option defaulted to false, for users who would like the extra privacy)