Messages from Log.wtf() sound pretty bad

     This is one crazy runtime failure that doesn't really give any straight forward hint to application developers. The stack trace is usually related to android's internal classes with the top of the frame failing in InputChannel. java.lang.RuntimeException: Could not read input channel file descriptors from parcel.        at android.view.InputChannel.nativeReadFromParcel(InputChannel.java)        at android.view.InputChannel.readFromParcel(InputChannel.java:148)        at android.view.InputChannel$1.createFromParcel(InputChannel.java:39)        at android.view.InputChannel$1.createFromParcel(InputChannel.java:36)        at com.android.internal.view.InputBindResult.<init>(InputBindResult.java:62)        at com.android.internal.view.InputBindResult$1.createFromParcel(InputBindResult.java:102)        at com.android.int...

   One of the fascinating features of Marshmallow was Now on Tap. It crawls through the screen content and displays relevant information.     The trigger event is to long press the home button for few seconds. This kind of suggests that some kind of intent is being fired and is being handled by a background application launching the relevant UI. However, an intent design can be hijacked by third party applications and might be confusing for users expecting Now on Tap. In fact, firefox managed to trap the launch intent for Google Now cards in earlier versions of Android. Based on the logs, this seems to be some kind of platform level core changes and surprisingly is coupled with speech and audio inputs. It looks like the touch event is being routed as audio inputs. This feature was either designed with speech input as a trigger event or speech input is further down the line. MicrophoneInputStream: mic_starting com.google.android.apps.gsa.speech.audio.y@4799...

     Android Marshmallow changed the behavior for WifiInfo's getMacAddress() due to privacy concerns. The API wasn't removed or deprecated instead was just updated to return a default address 02:00:00:00:00:00. The intention is to block access to device's hardware identifier using WiFi and Bluetooth APIs. In addition, any background wifi or bluetooth scan is shown as being generated by random mac address starting from Android 6.0. This doesn't let tracking softwares like the ones used in coffee shops, malls do what they used to do, study customer behavior without their knowledge, just because they had their wifi or bluetooth turned on by default. This is similar to what Apple did to iOS8. In Android 6.0, there are still few apps like Settings which continue to have access to the mac address. This is accessed via Settings > About Phone > Status or via Settings > WiFi > Advanced.      Is there any other hidden API that might return the...

   Android has an API FLAG_SECURE to prevent the window contents to be captured. This can be applied to any kind of window controlled by the application and an application could have multiple windows shown simultaneously (each on top of the other). This begs a question as to what happens when FLAG_SECURE is requested only for one of the window and not for dialog windows or vice versa. An application like Netflix might want to enforce security just for playback window and not a dialog showing options etc.    What happens if the dialog window is in focus? The fact that FLAG_SECURE is associated with a window seems that one could probably skip the check when a non secure window (Dialog) is in focus. This is a concern for application developers. Turns out this is not possible and any attempt to capture would fail (irrespective of the security of the focus window). This is because the framework checks for all windows of the current display and bails out when even on...

    Keyline pushing displays a Grid on top of other applications for UI testing. This is really useful for designers working with material design. The approach of displaying content on top of other applications and yet be able to control the actual application (behind the grid) is cool.      Users can notice a notification. This is most likely a result of a foreground service started by the application. This makes sense as the Grid has to stay alive even when the application is backgrounded and other applications are in focus. The actual grid is shown on a separate window most likely using public API, TYPE_SYSTEM_ALERT, TYPE_SYSTEM_OVERLAY, TYPE_SYSTEM_DIALOG or TYPE_SYSTEM_ERROR. This is why the app has a permission request claiming that it can draw on top of other applications. The next question is as to how the touch events are actually relayed to the foreground application underneath the grid? The grid is some kind of custom view or bitmap hosted b...

Android's multiprocess is used to indicate if a component can be hosted in the process space of the application requesting the component. The documentation claims that a request isn't necessarily honored at all times and works only with some permissions.    This is usually requested by application developers willing to have their component execute in other application's process space. This presents a security concern, a third party application without the knowledge of multiprocess could request for a component like starting an activity. The target activity would be created and resumed in the context of the calling process space and ends up having access to memory etc. Android's framework has a permission model to deal with this security concern but sadly isn't well documented. The intention is perhaps to demotivate application developers from using this feature.   The permissions model and this feature is similar to android:process documented here . andro...

   Screen capture of quite a few android applications after updates have started failing. Attempts to use developer tools like ddms, Android Studio too doesn't help. On device screen capture ( power + volume down ) fails claiming either limited storage space or denial by the app or organization. This is noticeable in Netflix. Screen capture works fine in all sections of the app but fails only in the playback view. This kind of rules out limited storage or device specific issues. Netflix has some explicit logic to disable screen capture during playback which makes sense as they probably want to protect their content. This is even more applicable for applications like Snapchat where in the message is destroyed and users shouldn't be able to capture the screen contents.    So how does this work? Turns out, Android has a public API FLAG_SECURE for windows. Application developers can request for the window to be secure upon activity creation. protected void...