3

I am using FLAG_SECURE for our activities to disable screen casting and scren shots.

getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE);

When i am screen casting my app to pc i can see only black screen but if i select any AutoCompleteTextView, i can see AutoCompleteTextView popup. It should not show this popup when I am using FLAG_SECURE/. So is there any way to solve this problem? enter image description here

6
  • That's a separate window. Perhaps FLAG_SECURE does not cascade to child windows, or not all child windows. If you have any dialogs in your app, you might try those as well, as they too represent child windows. I don't see any outstanding bug reports related to this. What device are you testing on, and what version of Android is it running? May 19, 2016 at 19:11
  • I am using Nexus 5 with os version 6.0.1 and for screen casting i am using vysor.
    – Vivart
    May 19, 2016 at 19:14
  • Hmmm... you might try other approaches as well besides Vysor, such as Android Studio's screen and video capture tools, to see what your results are. May 19, 2016 at 19:17
  • android studio's screen capture is showing error "Unexpected error while obtaining screenshot from device" but video capture is behaving same as vysor.
    – Vivart
    May 19, 2016 at 19:31
  • The "unexpected error" is probably a memory issue with Android Studio. I run into those from time to time. I'll try to set aside some time to look into this more tomorrow, assuming that you don't get any solid answers. May 19, 2016 at 19:38

1 Answer 1

4

Unfortunatately, the Android framework sometimes creates its own Window instances, such as the drop-down in an AutoCompleteTextView. Even if you set FLAG_SECURE on the Window for an activity, the Android framework does not pass that flag to any other windows created on behalf of that activity. This affects not just AutoCompleteTextView, but Spinner, the action bar overflow menu, and lots of other things.

Authors of widgets or other UI elements that show their own windows need to:

  • Examine the activity that those elements are a part of and see if that activity is using FLAG_SECURE to protect its contents. If it is, the UI element needs to apply FLAG_SECURE to any windows it opens up on behalf of that activity, such as a popup, so that the entire activity UI is secure.

  • Or, the UI element needs to expose the Window objects via a public API, so that FLAG_SECURE can be applied where needed.

I have more about the scope of the problem, and some workarounds, in my CWAC-Security library.

Thanks for pointing this out!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.