Sensitive data hiding

When using native rendering mode, SDK can record sensitive data in your application.

In order to protect user privacy, Smartlook can be configured so that the sensitive data is not recorded.

Smartlook attempts to hide selected sensitive UI element automatically. It can be also instructed to hide or show particular UI components. Alternatively, using one of the wireframe rendering modes records screen in a schematic way, showing no user data. The last possibility is to stop screen capturing altogether by using no rendering mode.

📘

Sensitive elements are hidden locally on the device; no sensitive data are transferred over the network and stored in the dashboard.

Blacklisted views

Any view can be hidden in the recording by marking it as a blacklisted view. A specific view can be marked as blacklisted by calling:

Smartlook.registerBlacklistedView(view: View)
Smartlook.registerBlacklistedViews(views: List<View>)

Smartlook.registerBlacklistedView(View view);
Smartlook.registerBlacklistedViews(List<View> views);

Or can be tagged directly in an xml layout file:

<View>
    <tag android:id="@id/smartlook_blacklisted_view" android:value=""/>
</View>

If a specific view no longer needs to be blacklisted:

Smartlook.unregisterBlacklistedView(view: View)
Smartlook.unregisterBlacklistedViews(views: List<View>)

Smartlook.unregisterBlacklistedView(View view);
Smartlook.unregisterBlacklistedViews(List<View> views);

A blacklisted view is hidden on recording by a single color rectangle. The color of this rectangle can be configured by calling:

Smartlook.setBlacklistedItemsColor(@ColorInt color: Int)

Smartlook.setBlacklistedItemsColor(@ColorInt int color);

This is applied for all blacklisted objects.

Blacklisted classes

Sometimes it can be beneficial to blacklist all instances of a given Class that extends a View rather than blacklisting a specific View’s instances:

Smartlook.registerBlacklistedClass(class: Class)
Smartlook.registerBlacklistedClasses(classes: List<Class>)

Smartlook.registerBlacklistedClass(Class class);
Smartlook.registerBlacklistedClasses(List<Class> classes);

Any blacklisted classes can be removed:

Smartlook.unregisterBlacklistedClass(class: Class)
Smartlook.unregisterBlacklistedClasses(classes: List<Class>)

Smartlook.unregisterBlacklistedClass(Class class);
Smartlook.unregisterBlacklistedClasses(List<Class> classes);

🚧

Note that EditText and WebView are blacklisted by default and can be removed using Smartlook.unregisterBlacklistedClass().

Whitelisted views

A specific view can be whitelisted so it is recorded even if it is an instance of a blacklisted class:

Smartlook.registerWhitelistedView(view: View)
Smartlook.registerWhitelistedViews(views: List<View>)

Smartlook.registerWhitelistedView(View view);
Smartlook.registerWhitelistedViews(List<View> views);

Or it can be tagged as whitelisted directly in an xml layout file:

<View>
  <tag android:id="@id/smartlook_whitelisted_view" android:value=""/>
</View>

A specific view can be removed from a whitelist by calling:

Smartlook.unregisterWhitelistedView(view: View)
Smartlook.unregisterWhitelistedViews(views: List<View>)

Smartlook.unregisterWhitelistedView(View view);
Smartlook.unregisterWhitelistedViews(List<View> views);

No Rendering

Sometimes the whole screen consists of sensitive data. In these cases it is beneficial to not record any screen data. This can be done by switching to no rendering rendering mode:

Smartlook.setRenderingMode(RenderingMode.NO_RENDERING)

Smartlook.setRenderingMode(RenderingMode.NO_RENDERING);

📘

SDK provides rendering modes that hide sensitive information by simplifying the rendered screen for recording. This can be advantageous because all user interaction is still being recorded, but all sensitive data are not rendered by design. Read more about rendering modes in conceptual documentation.

🚧

Some screens can leak sensitive data even through automatically detected touch events. More about this issue in secure custom keyboard example.

When an application is no longer displaying sensitive data, the screen rendering mode can be set back to the preferred variant:

Smartlook.setRenderingMode(RenderingMode.NATIVE)

Smartlook.setRenderingMode(RenderingMode.NATIVE);

WebView blacklisting/whitelisting

When an application has some parts displayed using WebView and these parts should be recorded, then the WebView recording needs to be enabled by removing WebView from the list of blacklisted classes:

Smartlook.unregisterBlacklistedClass(WebView::class.java)

Smartlook.unregisterBlacklistedClass(WebView.class);

If WebView is being recorded, all sensitive elements on the displayed web page should be marked as sensitive so that they are hidden. This can be done by marking sensitive HTML elements with .smartlook-hide css class:

<div class='smartlook-hide'>
   This will be hidden.
</div>

All inputs are hidden by default except for button and submit types. If some hidden inputs should be recorded they can be marked with .smartlook-show css class:

<input type="text" class='smartlook-show'>