When using the native rendering mode, the SDK can record sensitive data in your application.
In order to protect user privacy, you can configure Smartlook to not record sensitive data.
Smartlook attempts to hide selected sensitive UI elements automatically. It can be also instructed to hide or show particular UI components. Alternatively, using one of the wireframe rendering modes records the screen in a schematic way, showing no user data. The last possibility is to stop screen capturing altogether by using no rendering mode.
Locally hidden elements
Sensitive elements are hidden locally on the device. No sensitive data is transferred to or stored in the dashboard.
View sensitivity
You can set sensitivity to any View
instance:
sampleView.isSensitive = true|false|null
Smartlook.getInstance().getSensitivity().setViewInstanceSensitivity(sampleView, true|false|null);
Any View
can be also tagged directly in the XML
layout file:
<View>
<tag android:id="@id/sl_sensitivity" android:value="true|false"/>
</View>
Class sensitivity
You can also set the sensitivity to all instances of a Class
that extends a View
rather than setting the sensitivity on a specific View
:
SampleViewClass::class.isSensitive = true|false|null
Smartlook.getInstance().getSensitivity().setViewInstanceSensitivity(view, true|false|null);
Default sensitive classes
By default, the
EditText
andWebView
classes are set as sensitive. To override the sensitivity on the class or instance level, set the class or instance sensitivity tofalse
ornull
.
Sensitivity prioritization
When determining if the View
instance is sensitive, the resolution process checks the sensitivity in a strict order.
View
instances are not recorded if:
- the
XML
has thesl_sensitivity
tag set totrue
. - the sensitivity is set to
true
. - the
Class
sensitivity is set totrue
.
Class hierarchy and sensitivity
Sensitivity set to a more specific class (deeper in the inheritance tree) has higher priority. We will demonstrate this principle in the example using the inheritance tree:
If TextView
is set to be sensitive and RadioButton
is explicitly set to not be sensitive:
TextView::class.isSensitive = true
RadioButton::class.isSensitive = false
Smartlook.getInstance().getSensitivity().setViewClassSensitivity(TextView.class, true);
Smartlook.getInstance().getSensitivity().setViewClassSensitivity(RadioButton.class, false);
These statements are factual if we assume no View
instance-specific sensitivity is set:
- All instances of
TextView
,Button
,CompoundButton
,RadioButton
,Switch
, andToggleButton
will be sensitive - All instances of
RadioButton
are not sensitive, even thoughRadioButton
inherits from the sensitive classTextView
.
No Rendering
Sometimes, the entire screen is filled with sensitive data. In these cases, it is best not to record any data. To not record any data, use the NO_RENDERING
rendering mode:
Smartlook.instance.preferences.renderingMode = RenderingMode.NO_RENDERING
Smartlook.getInstance().getPreferences().setRenderingMode(RenderingMode.NO_RENDERING)
Rendering modes
The Smartlook SDK provides rendering modes that hide sensitive information by simplifying the rendered screen for recording. This is still useful to you because all user interactions are still recorded, but no sensitive data is rendered. For more information, see Rendering modes.
Automatically-detected touch events
Some screens display sensitive data through automatically detected touch events. Read more about this issue in secure custom keyboard example.
When the application no longer displays sensitive data, you can set screen rendering mode to NATIVE
:
Smartlook.instance.preferences.renderingMode = RenderingMode.NATIVE
Smartlook.getInstance().getPreferences().setRenderingMode(RenderingMode.NATIVE)
Handling WebView sensitivity
If an app uses WebView
and you want record them, you need to enable WebView
recording. You can enable WebView
recording by removing the sensitivity:
WebView::class.isSensitive = null
Smartlook.getInstance().getSensitivity().setViewClassSensitivity(WebView.class, null);
If WebView
is being recorded, all sensitive elements on the displayed website should be marked as sensitive so that they are hidden. You can mark sensitive elements as sensitive using HTML elements with .smartlook-hide
css class:
<div class='smartlook-hide'>
This will be hidden.
</div>
All inputs are hidden by default except button
and submit
. If some hidden inputs should be recorded, they can be marked with .smartlook-show
css class:
<input type="text" class='smartlook-show'>
Recording mask
In cases where areas of the app shouldn't be recorded, but cannot be defined by a view
, you can use RecordingMask
:
val recordingMask = RecordingMask(
listOf(
RecordingMask.Element(
Rect(left, top, right, bottom),
RecordingMask.Element.Type.COVERING|RecordingMask.Element.Type.ERASING
)
)
)
Smartlook.instance.sensitivity.recordingMask = recordingMask
ArrayList<RecordingMask.Element> elements = new ArrayList<>();
elements.add(
new RecordingMask.Element(
new Rect(left, top, right, bottom),
RecordingMask.Element.Type.COVERING|RecordingMask.Element.Type.ERASING
)
);
RecordingMask recordingMask = new RecordingMask(elements);
Smartlook.getInstance().getSensitivity().setRecordingMask(recordingMask);
You can only have one Recording mask
set at a time, but the recording mask can contain a list of RecordingMask.Element
to cover multiple areas at once.
RecordingMask.Element
can be one of two types:
RecordingMask.Element.Type.COVERING
– area defined by the elementRect
will not be recorded.RecordingMask.Element.Type.ERASING
– area defined by the elementRect
will be recorded even if a previouslyRecordingMask.Element
wasCOVERING
this area.