I have been implementing tapjacking defence in android app, but I found out that flag FLAG_WINDOW_IS_OBSCURED is set on android 7.0, but not on android 10.0 while window is obscured by another application.
Do you have any idea why is happens?
I tested it on both emulators and physical devices. Testing application for overlay was twilight. Official documentation feels useless.
I found this comment:
The FLAG_WINDOW_IS_OBSCURED only works if the overlay relays touch events, AND if the touched coordinates is actually obscured
which could suggest, that in newer android versions it must also obscure touch coordinates, but I could not find any app that obscures touched coordinates to test it.
In order to have centralized detection of overlayed apps I used:
@Override
public boolean dispatchTouchEvent(MotionEvent event) {
final boolean obscuredTouch = (event.getFlags() & MotionEvent.FLAG_WINDOW_IS_OBSCURED) != 0;
if(obscuredTouch) return false;
return super.dispatchTouchEvent(event);
}
in BaseActivity which all other activities extends.
Android tag
android:filterTouchesWhenObscured
for views uses the same flag FLAG_WINDOW_IS_OBSCURED underneath I suppose (correct me if I am wrong):