Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Security Auditing: Investigating Unauthorized Screenshots

tech.michaelaltfield.net

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#11

Post by brodyprice »

patrickyeon wrote: post #7
brodyprice wrote: post #3

The screenshots were for "recent apps" navigation, they weren't being uploaded anywhere, apps can set "FLAG_SECURE" to prevent it, the device was rooted, and the files were "...inaccessible to most apps, except those to which I grant root access." ? Can someone explain to me what the problem is? Why are the screenshots considered unauthorized?

I think this is a "the journey is its own reward" type of story. The author is interested in sharing the "how" of sleuthing around.

That makes sense, thanks! I guess the title just sounded like they were highlighting it as a problem, "Unauthorized Screenshots in Android Phones" sounds concerning

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#12

Post by procinct »

jarfil wrote: post #10
ggm wrote: post #2

I did tell 1password I could see 'en clair' state in the recent apps view some number of versions ago. They said there wasn't much they could do about it.

I'm not a fan of 1password, but their Android app does block screenshots.

Why are you not a fan of 1Password?

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#13

Post by daveFNbuck »

ggm wrote: post #2

I did tell 1password I could see 'en clair' state in the recent apps view some number of versions ago. They said there wasn't much they could do about it.

Maybe follow up and tell them to set FLAG_SECURE. It may help to mention that LastPass already does this.

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#14

Post by jancsika »

FLAG_SECURE:

* overworked, out-of-coffee developer of "secure" messaging app forgets to set FLAG_SECURE. Oops.

vs.

FLAG_CACHE_ARBITRARY_IMAGE_OF_MY_INTERFACE_TO_HELP_ANDROID_APPEAR_MORE_RESPONSIVE:

* overworked developer of "secure" messaging app who is out of coffee forgets to set this flag. App doesn't appear more responsive but also doesn't cache an image of the interface. Yay security!

* But... app devs default to not caching images of interfaces, thus Android appears less responsive overall to the user.

FLAG_SECURE exists.

Therefore Android's appearance of responsiveness trumps secure defaults in this case.

Boo.

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#15

Post by cpv »

jarfil wrote: post #9
RafiqM wrote: post #6

Earlier quoted context omitted.

The conclusion is there's no problem, that it wasn't the nefarious activity that he originally thought it was. The additional point he's trying to make is that app developers should use FLAG_SECURE if its confidential data - messaging probably should be, and his bitcoin app should almost certainly be.

Keepass2Android and Signal have it as an option, Orfox just enables it on webpages but disables it on the settings screen, Netflix enables it on video playback. My banking app doesn't have the option at all, yay banking!

Firefox Focus has this enabled, and some banking/payment apps (the developers knew about the flag).

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#16

Post by Buge »

jancsika wrote: post #14

FLAG_SECURE: * overworked, out-of-coffee developer of "secure" messaging app forgets to set FLAG_SECURE. Oops. vs. FLAG_CACHE_ARBITRARY_IMAGE_OF_MY_INTERFACE_TO_HELP_ANDROID_APPEAR_MORE_RESPONSIVE: * overworked developer of "secure" messaging app who is out of coffee forgets to set this flag. App doesn't appear more responsive but also doesn't cache an image of the interface . Yay security! * But... app devs default…

But will anyone be harmed by these screenshots? They're encrypted.

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#17

Post by clort »

Buge wrote: post #16
jancsika wrote: post #14

FLAG_SECURE: * overworked, out-of-coffee developer of "secure" messaging app forgets to set FLAG_SECURE. Oops. vs. FLAG_CACHE_ARBITRARY_IMAGE_OF_MY_INTERFACE_TO_HELP_ANDROID_APPEAR_MORE_RESPONSIVE: * overworked developer of "secure" messaging app who is out of coffee forgets to set this flag. App doesn't appear more responsive but also doesn't cache an image of the interface . Yay security! * But... app devs default…

But will anyone be harmed by these screenshots? They're encrypted.

How are they encrypted, if a disk scraper can find them and display the contents?

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#19

Post by dmitrygr »

clort wrote: post #17
Buge wrote: post #16

Earlier quoted context omitted.

But will anyone be harmed by these screenshots? They're encrypted.

How are they encrypted, if a disk scraper can find them and display the contents?

all user files are encrypted. no user password -> your disc scraper is useless.

Re: Android Security Auditing: Investigating Unauthorized Screenshots

#20

Post by epse »

clort wrote: post #17
Buge wrote: post #16

Earlier quoted context omitted.

But will anyone be harmed by these screenshots? They're encrypted.

How are they encrypted, if a disk scraper can find them and display the contents?

They are encrypted on disk, but like an encrypted hard drive, decrypted when the user logs in. I'm unsure if they are accessible when the phone is locked, I don't think so. And apps can't access it. The drive scanner found them because they were in unallocated space.
Post reply on HN