Hide private screens from screenshots and the app switcher

How to do it

Both systems save a picture of the last screen when the app goes to the background. Screen sharing apps are also a common tool in phone fraud. On Android, set FLAG_SECURE on the window of each private screen. On iOS, cover the window with a plain view when the scene resigns active, and remove it when it returns. Keep the list of private screens short, since people also take screenshots for good reasons. Values shown in widgets follow give widgets and watch apps only the data they show.

Examples

Kotlin example

class CardDetailsActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        window.setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE)
    }
}

Plain text example

func sceneWillResignActive(_ scene: UIScene) {
    guard router.isShowingPrivateScreen else { return }
    privacyCover.frame = window?.bounds ?? .zero
    window?.addSubview(privacyCover)
}

func sceneDidBecomeActive(_ scene: UIScene) {
    privacyCover.removeFromSuperview()
}

How to check

On a test device, open each private screen, go to the home screen and open the app switcher. The preview shows no private value, and an Android screenshot of the screen comes out blank.

Sources

• OWASP MASVS-PLATFORM-3
• Android, Secure sensitive activities

Related rules

• MOB-39 Give widgets and watch apps only the data they show in Mobile apps