proomt

Search

Search posts, papers, and topics

All posts

CodeName OneShai Almog3 min readintermediate

Tapjacking Protection: Rejecting Android Touches Behind an Overlay

Read on codenameone.com

Summary

Codename One adds tapjacking protection to its Android runtime. It detects fully or partially obscured MotionEvents, offers four policies (OFF, REPORT, BLOCK, STRICT), can block the entire gesture, and on Android 12+ can request the system hide overlay windows. The API is exposed via `DeviceIntegrity.setTapjackingProtection` and a listener for state changes. iOS has no overlay threat, so the feat…

  • Android marks touches as fully or partially obscured; Codename One surfaces this via `isScreenObscured()`.
  • Four tapjacking policies let you log, block, or strictly drop gestures depending on confidence level.
  • `BLOCK` is the recommended default for sensitive screens; `STRICT` also drops partially obscured touches but may reject legitimate system UI interactions.
  • On Android 12+, you can request the OS to hide overlay windows with `HIDE_OVERLAY_WINDOWS` permission, combined with `setSecureScreen(true)` for screen‑capture protection.

Tapjacking can trick users into confirming financial or permission actions by overlaying UI elements. By detecting and optionally blocking obscured touches, apps can prevent unauthorized actions without relying on user vigilance, raising the security baseline for mobile payments and sensitive flows.

6/10
securityandroidmobilecodenameoneinput

Related reading

  1. Native Drag and Drop Meets Cross-Device Continuity

    Codename One 8.0 adds two user‑experience primitives: **Cross‑Device Continuity** (state checkpointing + Apple Handoff + custom HTTP relay) and **Native Drag‑and‑Drop** (OS‑level drag using the same ClipboardContent model). The post shows the API (StateProvider, Continuity.checkpoint, NativeDragOperation), platform support tables, and practical advice on payload size, security, thread handling, a…

    CodeName Onecodenameone.com7 min

  2. App Hardening: One Obfuscation Pipeline Across Every Port

    Codename One adds a cloud‑side hardening step that runs on the merged JAR before it is split into Android, iOS, JavaScript, and desktop binaries. It can rename symbols, encrypt string literals, and insert opaque‑predicate control‑flow guards at configurable levels (off → standard → aggressive → paranoid). The transforms are selective per platform to avoid breaking optimizers, and a mapping is kep…

    CodeName Onecodenameone.com6 min

  3. App Intents: One Java Declaration for Siri, Spotlight, and Shortcuts

    Codename One adds @AppIntent annotations that let a static Java method be exposed as a Siri, Spotlight, or Android shortcut. The build‑time processor generates native declarations, a reflection‑free dispatch table, and validates the intent metadata. Handlers can be headless, accept typed parameters, return results, and be invoked internally via Intents.invoke(). Entities enable system‑driven disa…

    CodeName Onecodenameone.com5 min

  4. Fill an SMS Verification Code Without Reading the Inbox

    Codename One adds a one‑time‑code autofill component that leverages iOS, Android, and browser autofill APIs, eliminating the need for SMS‑reading permissions. The new `PhoneVerification` component handles phone entry, code entry, resend timing, and server callbacks, while the UI uses a single hidden editor to back six visual boxes, improving typing, paste, and accessibility. The post explains the…

    CodeName Onecodenameone.com3 min

  5. We Stopped Waiting for Platform Changes to Find Us

    Codename One added a daily automated scan of Apple and Google deprecation notices, linking each notice to concrete builder artifacts before work is created. The system caught the Android 16 back‑gesture change and enabled a permission‑free ContactPicker, turning policy shifts into repeatable, evidence‑backed patches.

    CodeName Onecodenameone.com3 min