Andotp: contents of app visible for a split second with Android Keystore + Device credentials

[mbiebl]

General information

• App version:
  0.6.0
• App source: Google Play / F-Droid / GitHub / ...
  Google Play
• Android Version:
  8.1
• Custom ROM:
  LineageOS

I've setup andOTP to use Android Keystore + Device credentials. My screen lock is set to Pattern.
When I open the app, I see its contents for a split second before the Android screen lock shows up.

If I lock the device and unlock it later on, the same happens: andOTP shows me the contents for a split second, before the unlock screen for the app shows up.

With Password/PIN this problem does not happen.

[mbiebl]

It's an older device (Galaxy S5). I assume this issue is less visible with newer and faster smartphones.

[flocke]

I don't think I can do anything against that. It is handled by the system that way (I have to call an extra Intent to check the device credentials and that only gets called after the main screen is already set up).
In the rewrite this will be handled differently...

[nonsleepr]

I think some of the password managers and banking apps mitigate similar issues by clearing the screen when the focus is lost. It looks like Android is taking a screenshot of the app before it closes it and then would present is on reopening.

[flocke]

@nonsleepr And there already is a PR which does exactly that (#391). I just tested it a bit and it seems to work so I'm gonna merge it for the next release.