Implement security flags #908
Description
The Cure53 report recommended we implement the following security flags:
FLAG_SECURE
This flag blocks manual screenshots and screen recording of a window. I'm not sure what your opinions are on this. I can imagine users sometimes wanting to screenshot something from an email on their phone, in which case this 'feature' would be annoying. On the other hand, I understand the reasoning behind it.
Ideally we could just use it where we need it, but it operates by window, not by view. So if you want to just use it in one place, that needs to be a separate window.
filterTouchesWhenObscured
The Cure53 report explains this flag very well:
The filterTouchesWhenObscured security flag for views protects against so-called
Tapjacking attacks. A malicious app can overlap the currently active app with a hidden
screen overlay. The latter would need to have the ability to intercept data entered into
the underlying app. Once the flag is set, a view will no longer receive touches when it is
obscured by another window, therefore making this attack infeasible
This one seems like a really good idea. Note that I am totally ignorant about Android development so please let me know if I'm badly misunderstanding anything.