When using native rendering mode, SDK can record sensitive data in your application.
In order to protect user privacy, Smartlook can be configured so that the sensitive data is not recorded.
Smartlook attempts to hide selected sensitive UI element automatically. It can be also instructed to hide or show particular UI components. Alternatively, using one of the wireframe rendering modes records screen in a schematic way, showing no user data. The last possibility is to stop screen capturing altogether by using no rendering mode.
Sensitive elements are hidden locally on the device; no sensitive data are transferred over the network and stored in the dashboard.
Blacklisted views
Any view can be hidden in the recording by marking it as a blacklisted view. A specific view can be marked as blacklisted by calling:
Smartlook.registerBlacklistedView(view: View)
Smartlook.registerBlacklistedViews(views: List<View>)
Smartlook.registerBlacklistedView(View view);
Smartlook.registerBlacklistedViews(List<View> views);
Or can be tagged directly in an xml
layout file:
<View>
<tag android:id="@id/smartlook_blacklisted_view" android:value=""/>
</View>
If a specific view no longer needs to be blacklisted:
Smartlook.unregisterBlacklistedView(view: View)
Smartlook.unregisterBlacklistedViews(views: List<View>)
Smartlook.unregisterBlacklistedView(View view);
Smartlook.unregisterBlacklistedViews(List<View> views);
A blacklisted view is hidden on recording by a single color rectangle. The color of this rectangle can be configured by calling:
Smartlook.setBlacklistedItemsColor(@ColorInt color: Int)
Smartlook.setBlacklistedItemsColor(@ColorInt int color);
This is applied for all blacklisted objects.
Blacklisted classes
Sometimes it can be beneficial to blacklist all instances of a given Class
that extends a View
rather than blacklisting a specific View
’s instances:
Smartlook.registerBlacklistedClass(class: Class)
Smartlook.registerBlacklistedClasses(classes: List<Class>)
Smartlook.registerBlacklistedClass(Class class);
Smartlook.registerBlacklistedClasses(List<Class> classes);
Any blacklisted classes can be removed:
Smartlook.unregisterBlacklistedClass(class: Class)
Smartlook.unregisterBlacklistedClasses(classes: List<Class>)
Smartlook.unregisterBlacklistedClass(Class class);
Smartlook.unregisterBlacklistedClasses(List<Class> classes);
Note that
EditText
andWebView
are blacklisted by default and can be removed usingSmartlook.unregisterBlacklistedClass()
.
Whitelisted views
A specific view can be whitelisted so it is recorded even if it is an instance of a blacklisted class:
Smartlook.registerWhitelistedView(view: View)
Smartlook.registerWhitelistedViews(views: List<View>)
Smartlook.registerWhitelistedView(View view);
Smartlook.registerWhitelistedViews(List<View> views);
Or it can be tagged as whitelisted directly in an xml
layout file:
<View>
<tag android:id="@id/smartlook_whitelisted_view" android:value=""/>
</View>
A specific view can be removed from a whitelist by calling:
Smartlook.unregisterWhitelistedView(view: View)
Smartlook.unregisterWhitelistedViews(views: List<View>)
Smartlook.unregisterWhitelistedView(View view);
Smartlook.unregisterWhitelistedViews(List<View> views);
No Rendering
Sometimes the whole screen consists of sensitive data. In these cases it is beneficial to not record any screen data. This can be done by switching to no rendering
rendering mode:
Smartlook.setRenderingMode(RenderingMode.NO_RENDERING)
Smartlook.setRenderingMode(RenderingMode.NO_RENDERING);
SDK provides rendering modes that hide sensitive information by simplifying the rendered screen for recording. This can be advantageous because all user interaction is still being recorded, but all sensitive data are not rendered by design. Read more about rendering modes in conceptual documentation.
Some screens can leak sensitive data even through automatically detected touch events. More about this issue in secure custom keyboard example.
When an application is no longer displaying sensitive data, the screen rendering mode can be set back to the preferred variant:
Smartlook.setRenderingMode(RenderingMode.NATIVE)
Smartlook.setRenderingMode(RenderingMode.NATIVE);
WebView blacklisting/whitelisting
When an application has some parts displayed using WebView
and these parts should be recorded, then the WebView
recording needs to be enabled by removing WebView
from the list of blacklisted classes:
Smartlook.unregisterBlacklistedClass(WebView::class.java)
Smartlook.unregisterBlacklistedClass(WebView.class);
If WebView
is being recorded, all sensitive elements on the displayed web page should be marked as sensitive so that they are hidden. This can be done by marking sensitive HTML elements with .smartlook-hide
css class:
<div class='smartlook-hide'>
This will be hidden.
</div>
All inputs are hidden by default except for button
and submit
types. If some hidden inputs should be recorded they can be marked with .smartlook-show
css class:
<input type="text" class='smartlook-show'>