[null,null,["最后更新时间 (UTC)：2025-07-27。"],[],[],null,["# Secure sensitive activities\n\nThis document details ways to monitor sensitive activities, such as user logins\nand online purchases.\n\nFLAG_SECURE\n-----------\n\n`FLAG_SECURE` is a [Window flag](/reference/android/view/WindowManager.LayoutParams#FLAG_SECURE) that tells Android not to allow screenshots\nor to display the window view on a non-secure display (such as Casting the\nscreen). This is useful for applications that need to protect sensitive\ninformation, like banking apps or password managers. When a window is flagged\nwith `FLAG_SECURE`, Android prevents screenshots from being taken and prevents\nthe window from being displayed on a non-secure display, such as a TV or\nprojector. This helps to protect the information that is being displayed in the\nwindow from being accessed by unauthorized people.\n\n### How this helps mitigate fraud\n\nA malicious app or entity might retrieve background screenshots. When the state\nof your app changes to the background, `FLAG_SECURE` can be used. When the\nscreenshot is taken the resulting image is blank.\n\n`FLAG_SECURE` also helps with remote screen sharing use cases. It isn't always a\nmalicious app that will retrieve screenshots, legitimate screen sharing apps are\nalso commonly found used in fraudulent situations.\n\n### Implementation\n\nFor views with the information you want protected, add the following: \n\n### Kotlin\n\n```kotlin\nwindow?.setFlags(\n WindowManager.LayoutParams.FLAG_SECURE,\n WindowManager.LayoutParams.FLAG_SECURE\n)\n```\n\n### Java\n\n```java\nwindow.setFlags(\n WindowManager.LayoutParams.FLAG_SECURE,\n WindowManager.LayoutParams.FLAG_SECURE\n);\n```\n\n### Best practices\n\nIt is important to note that this approach isn't reliable in preventing overlay\nattacks. In some cases it does not correctly predict if screen recording is\nactive, however it does cover most use cases. To mitigate overlay attacks, read\nthe next section about `HIDE_OVERLAY_WINDOWS` permissions.\n| **Note:** For Android 11 (API 30) and lower `FLAG_SECURE` is able to help around 70% of the devices reliably. This is because on certain devices keyboard taps can be recorded.\n\nHIDE_OVERLAY_WINDOWS\n--------------------\n\n`HIDE_OVERLAY_WINDOWS` is a permission added in Android 12 where your app can\nopt-out of having application overlays drawn over it. In Android 12 we have made\nit harder to acquire the [`SYSTEM_ALERT_WINDOW`](/reference/android/Manifest.permission#SYSTEM_ALERT_WINDOW) permission, essentially\nallowing your app to block overlays from third-party apps.\n\n### How this helps mitigate fraud\n\nWhen you enable the `HIDE_OVERLAY_WINDOWS` permission you are opting out of\nhaving application overlays drawn on top of your app. This permission provides a\nprotection mechanism against [cloak and dagger](https://cloak-and-dagger.org/) attacks.\n\n### Implementation\n\nTo enable this permission, add [`HIDE_OVERLAY_WINDOWS`](/reference/android/Manifest.permission#HIDE_OVERLAY_WINDOWS) to your project's\nmanifest.\n\n### Best practices\n\nAs with any permission, you should trust any overlay app at least as much as you\ntrust any other app on the device. In other words, your app shouldn't allow\nother apps to draw overlays over it unless you know the other app is\ntrustworthy. Allowing an app to draw over other apps can be dangerous because it\ncan steal passwords or read messages."]]
