Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Security Auditing: Investigating Unauthorized Screenshots

tech.michaelaltfield.net

Post reply on HN
Print view View original

1–10 of 43 posts

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#3

Post by brodyprice »

The screenshots were for "recent apps" navigation, they weren't being uploaded anywhere, apps can set "FLAG_SECURE" to prevent it, the device was rooted, and the files were "...inaccessible to most apps, except those to which I grant root access." ?

Can someone explain to me what the problem is? Why are the screenshots considered unauthorized?

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#6

Post by RafiqM »

brodyprice wrote: post #3

The screenshots were for "recent apps" navigation, they weren't being uploaded anywhere, apps can set "FLAG_SECURE" to prevent it, the device was rooted, and the files were "...inaccessible to most apps, except those to which I grant root access." ? Can someone explain to me what the problem is? Why are the screenshots considered unauthorized?

The conclusion is there's no problem, that it wasn't the nefarious activity that he originally thought it was.

The additional point he's trying to make is that app developers should use FLAG_SECURE if its confidential data - messaging probably should be, and his bitcoin app should almost certainly be.

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#7

Post by patrickyeon »

brodyprice wrote: post #3

The screenshots were for "recent apps" navigation, they weren't being uploaded anywhere, apps can set "FLAG_SECURE" to prevent it, the device was rooted, and the files were "...inaccessible to most apps, except those to which I grant root access." ? Can someone explain to me what the problem is? Why are the screenshots considered unauthorized?

I think this is a "the journey is its own reward" type of story. The author is interested in sharing the "how" of sleuthing around.

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#8

Post by brodyprice »

RafiqM wrote: post #6
brodyprice wrote: post #3

The screenshots were for "recent apps" navigation, they weren't being uploaded anywhere, apps can set "FLAG_SECURE" to prevent it, the device was rooted, and the files were "...inaccessible to most apps, except those to which I grant root access." ? Can someone explain to me what the problem is? Why are the screenshots considered unauthorized?

The conclusion is there's no problem, that it wasn't the nefarious activity that he originally thought it was. The additional point he's trying to make is that app developers should use FLAG_SECURE if its confidential data - messaging probably should be, and his bitcoin app should almost certainly be.

Ah, that makes sense, thank you. I think I was thrown off by the link's title, "Unauthorized Screenshots in Android Phones" - I read it as a security issue

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#9

Post by jarfil »

RafiqM wrote: post #6
brodyprice wrote: post #3

The screenshots were for "recent apps" navigation, they weren't being uploaded anywhere, apps can set "FLAG_SECURE" to prevent it, the device was rooted, and the files were "...inaccessible to most apps, except those to which I grant root access." ? Can someone explain to me what the problem is? Why are the screenshots considered unauthorized?

The conclusion is there's no problem, that it wasn't the nefarious activity that he originally thought it was. The additional point he's trying to make is that app developers should use FLAG_SECURE if its confidential data - messaging probably should be, and his bitcoin app should almost certainly be.

Keepass2Android and Signal have it as an option, Orfox just enables it on webpages but disables it on the settings screen, Netflix enables it on video playback. My banking app doesn't have the option at all, yay banking!
Post reply on HN