News for hackers. Stuff that matters.
Re:Android Security Auditing: Investigating Unauthorized Scr... by brodyprice on Saturday November 10, 2018 @12:18AM (#18420080)
The screenshots were for "recent apps" navigation, they weren't being uploaded anywhere, apps can set "FLAG_SECURE" to prevent it, the device was rooted, and the files were "...inaccessible to most apps, except those to which I grant root access." ?

Can someone explain to me what the problem is? Why are the screenshots considered unauthorized?

Re:Android Security Auditing: Investigating Unauthorized Scr... by RafiqM on Saturday November 10, 2018 @12:26AM (#18420106)
The conclusion is there's no problem, that it wasn't the nefarious activity that he originally thought it was.

The additional point he's trying to make is that app developers should use FLAG_SECURE if its confidential data - messaging probably should be, and his bitcoin app should almost certainly be.

Re:Android Security Auditing: Investigating Unauthorized Scr... by jarfil on Saturday November 10, 2018 @12:42AM (#18420129)
Keepass2Android and Signal have it as an option, Orfox just enables it on webpages but disables it on the settings screen, Netflix enables it on video playback. My banking app doesn't have the option at all, yay banking!
Re:Android Security Auditing: Investigating Unauthorized Scr... by cpv on Saturday November 10, 2018 @02:01AM (#18420290)
Firefox Focus has this enabled, and some banking/payment apps (the developers knew about the flag).
Re:Android Security Auditing: Investigating Unauthorized Scr... by solarkraft on Saturday November 10, 2018 @05:31AM (#18420750)
I hate apps using FLAG_SECURE with full passion. I want to take a fucking screenshot and you don't allow me to.
Re:Android Security Auditing: Investigating Unauthorized Scr... by rhamzeh on Saturday November 10, 2018 @01:43PM (#18422759)
I know some password managers (myki, lastpass and I think 1Password have an option to toggle it off).

It's on by default, which should be true for most apps with confidential data. But other apps (like photos and messaging apps, can at least have that as an option defaulted to false, for users who would like the extra privacy)

Re:Android Security Auditing: Investigating Unauthorized Scr... by tjoff on Saturday November 10, 2018 @11:50AM (#18422123)
Yeah, for some reason web browsers feel the need to do that when browsing in private mode.

It is one thing to block automatic screenshots or screen recordings. Another when the user explicitly tries to take a screenshot.

Re:Android Security Auditing: Investigating Unauthorized Scr... by kbenson on Saturday November 10, 2018 @12:51PM (#18422445)
I imagine the reasoning is that if you can do it, some other app might be able to trigger it, and at that point, it's all downhill.
Re:Android Security Auditing: Investigating Unauthorized Scr... by tjoff on Saturday November 10, 2018 @03:51PM (#18423430)
It's an OS function triggered by a physical button. If some other app can imitate that then surely it is already game over?
Re:Android Security Auditing: Investigating Unauthorized Scr... by izacus on Saturday November 10, 2018 @04:53AM (#18420654)
How is messaging confidental data? Remember, FLAG_SECURE prevents users from taking screenshots themselves as well and prevents display of content in several other cases (e.g. screen mirroring).

Your conversations aren't nearly as sensitive to require such a large breach of usability.

Re:Android Security Auditing: Investigating Unauthorized Scr... by saagarjha on Saturday November 10, 2018 @05:11AM (#18420700)
> Your conversations aren't nearly as sensitive to require such a large breach of usability.

Yours might not be, but this isn’t true for everyone.

Re:Android Security Auditing: Investigating Unauthorized Scr... by oliwarner on Saturday November 10, 2018 @06:15AM (#18420863)
I think the broader point is that it stops the user doing something they want to. Something they could still do with a camera.

The flag should secure it from other apps but the user screenshot tool should be able to override it. The cap framework should be able to do this, you just need to insulate the app itself to ensure only real people can use it.

Re:Android Security Auditing: Investigating Unauthorized Scr... by izacus on Saturday November 10, 2018 @06:12AM (#18420852)
I'd be happy to hear about an attack vector that compromises encrypted private OS storage on Android, but does not compromise the apps view hierarchy rendered by the same OS. FLAG_SECURE is just an OS flag though.

Because your sentence just sounds like platitude without any thought behind it.

Re:Android Security Auditing: Investigating Unauthorized Scr... by Confiks on Saturday November 10, 2018 @06:59AM (#18420970)
Preventing screenshots and showing up in the active apps list is an option within the Signal preferences. So Signal provides a precautious default, but allows you to turn it off.
Re:Android Security Auditing: Investigating Unauthorized Scr... by izacus on Saturday November 10, 2018 @09:53AM (#18421514)
This is the right way to do it in my opinion.
Re:Android Security Auditing: Investigating Unauthorized Scr... by brodyprice on Saturday November 10, 2018 @12:35AM (#18420117)
Ah, that makes sense, thank you. I think I was thrown off by the link's title, "Unauthorized Screenshots in Android Phones" - I read it as a security issue
Re:Android Security Auditing: Investigating Unauthorized Scr... by patrickyeon on Saturday November 10, 2018 @12:32AM (#18420114)
I think this is a "the journey is its own reward" type of story. The author is interested in sharing the "how" of sleuthing around.
Re:Android Security Auditing: Investigating Unauthorized Scr... by brodyprice on Saturday November 10, 2018 @12:59AM (#18420159)
That makes sense, thanks! I guess the title just sounded like they were highlighting it as a problem, "Unauthorized Screenshots in Android Phones" sounds concerning