Enforce Android lifecycle, screen-capture, clipboard, and plaintext protections #100

New Issue

hugo · 2026-08-17T19:12:20Z

hugo commented

2026-08-17 19:12:20 +00:00

Goal

Apply Android-specific presentation security consistently across the main app and external credential components.

Scope

Feed foreground/background, explicit user activity, protected-state loss, trim-memory, and process recreation events into storage-owned authentication lifecycle APIs.
Apply FLAG_SECURE to sensitive activities/windows so screenshots, screen recording, casting surfaces, and recent-app thumbnails do not expose protected content; document unavoidable platform/OEM limits.
Mask and clear decrypted Compose state before/when the app backgrounds, the lease expires, or manual lock occurs. Never rely on a later recomposition as the only cleanup.
Implement storage-directed copy with Android ClipboardManager, mark clips sensitive using ClipDescription.EXTRA_IS_SENSITIVE where supported, show explicit feedback, and compare identity/content before timed clearing so newer clipboard data is never erased.
Do not extend the authentication lease for passive TOTP ticks, animations, recomposition, background work, or clipboard cleanup.
Audit logs, crash text, analytics (none by default), notifications, saved state, previews, accessibility text, autofill structures, and memory diagnostics for secrets.
Define behavior for multi-window, picture-in-picture rejection, screen sharing, external displays, process death, and task switching.

Acceptance criteria

Passwords, PIN fields, OTP URIs/codes, key armor, tokens, and passphrases never appear in screenshots/recents/logs/saved state.
Clipboard timeout and race tests preserve unrelated/newer user clipboard content.
Background/expiry/manual lock synchronously masks all protected UI and drops bridge presentation objects.
Passive display work does not renew authentication.
Security behavior is exercised on minimum/current API devices and documented where OEM behavior cannot be guaranteed.

Depends on the Compose shell, biometric authentication, and platform-neutral contract issues. Part of #87.

## Goal Apply Android-specific presentation security consistently across the main app and external credential components. ## Scope - Feed foreground/background, explicit user activity, protected-state loss, trim-memory, and process recreation events into storage-owned authentication lifecycle APIs. - Apply `FLAG_SECURE` to sensitive activities/windows so screenshots, screen recording, casting surfaces, and recent-app thumbnails do not expose protected content; document unavoidable platform/OEM limits. - Mask and clear decrypted Compose state before/when the app backgrounds, the lease expires, or manual lock occurs. Never rely on a later recomposition as the only cleanup. - Implement storage-directed copy with Android `ClipboardManager`, mark clips sensitive using `ClipDescription.EXTRA_IS_SENSITIVE` where supported, show explicit feedback, and compare identity/content before timed clearing so newer clipboard data is never erased. - Do not extend the authentication lease for passive TOTP ticks, animations, recomposition, background work, or clipboard cleanup. - Audit logs, crash text, analytics (none by default), notifications, saved state, previews, accessibility text, autofill structures, and memory diagnostics for secrets. - Define behavior for multi-window, picture-in-picture rejection, screen sharing, external displays, process death, and task switching. ## Acceptance criteria - Passwords, PIN fields, OTP URIs/codes, key armor, tokens, and passphrases never appear in screenshots/recents/logs/saved state. - Clipboard timeout and race tests preserve unrelated/newer user clipboard content. - Background/expiry/manual lock synchronously masks all protected UI and drops bridge presentation objects. - Passive display work does not renew authentication. - Security behavior is exercised on minimum/current API devices and documented where OEM behavior cannot be guaranteed. Depends on the Compose shell, biometric authentication, and platform-neutral contract issues. Part of #87.

hugo added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:12:20 +00:00

hugo added the enhancement label 2026-08-17 19:12:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#100