Article 3: Mitigating Screen Capture: FLAG_SECURE vs SetWindowDisplayAffinity

3.1 The Threat of Visual Exfiltration

Password managers are uniquely vulnerable to visual exfiltration. When a user clicks the “reveal password” icon, the plaintext secret is rendered on the screen. If malware (such as a malicious background process or a compromised screen-sharing application) captures the screen buffers during this window, the cryptographic pipeline is bypassed entirely.

3.2 Android: FLAG_SECURE

Android provides a robust, OS-level mechanism to prevent screen capture via the WindowManager API. In LockRoot’s MainActivity.kt, the application applies the FLAG_SECURE attribute during the onCreate lifecycle method:

window.setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE)

This instructs the Android SurfaceFlinger (the system compositor) to exclude the application’s buffers from any read-back operations. The resulting protection is twofold:

1. Attempting to take a screenshot via hardware buttons results in a system-level block.
2. When the user swipes up to view the Recent Apps task switcher, the OS replaces the LockRoot application snapshot with a blank white screen, preventing sensitive data from persisting in the OS snapshot cache.

3.3 Windows: SetWindowDisplayAffinity

On Windows, the WPF (.NET 8) application achieves a similar result utilizing the native Win32 API SetWindowDisplayAffinity. By passing the window handle (HWND) and the WDA_EXCLUDEFROMCAPTURE constant, the application instructs the Desktop Window Manager (DWM) to redact the window.

To screen-recording software like OBS Studio, or collaboration tools like Microsoft Teams, the LockRoot window appears as a solid black rectangle. The local user sitting at the physical monitor can see the application normally, but the pixel buffers are inaccessible to user-mode capture APIs.

3.4 Platform Limitations

iOS and Linux (X11) do not expose equivalent granular APIs for third-party developers. On these platforms, LockRoot relies on aggressive state management—locking the vault immediately upon backgrounding (scenePhase == .inactive) and clearing the clipboard after 20 seconds—to minimize the window of opportunity for visual exfiltration.

---