6

I wanted to open a picture sent by a friend in the Sketch app in order to highlight something and send it back. The app didn't have permission to access the file system. A popup appeared. I clicked "Allow", then, "Screen overlay detected" appeared and it just wouldn't let me through.

Now, I've read that I can disable screen overlay, add the permissions, and then re-enable it, but I don't feel like going through all my apps to see what permissions they need, neither I feel like disabling & enabling this every time I need to allow something.

Is there any reason why Google did this? I guess there must be a serious security concern, since this is very user unfriendly, but I have no idea what that could be.

See the pictures in the following question for examples of the problem

6

This is to prevent 'Tapjacking'.

It works in a surprisingly simple way – you download an application and open it, which triggers the installation of a second, this time malicious, application. Then, when you press a button on the seemingly innocent application, you are actually clicking a button on the malicious application that is hidden within it. So, as its name suggests, the trap is in the tap.

So, imagine this scenario. You have downloaded an application and on the main screen there is a button that says “Start Game”. You click it to begin but, unbeknownst to you, this has triggered the downloading of the dangerous malware. On the next screen you continue clicking away, oblivious to the dangers, and without realizing you have accepted the terms and conditions of the dangerous malware that has hidden itself on your cellphone.

Source

So when Android detects an app is appearing as an overlay it prevents the user from granting permissions or clicking on install when sideloading an app (and possibly more scenarios).

An app developer can opt into this behaviour if the user is doing something that needs to be secure:

Sometimes it is essential that an application be able to verify that an action is being performed with the full knowledge and consent of the user, such as granting a permission request, making a purchase or clicking on an advertisement. Unfortunately, a malicious application could try to spoof the user into performing these actions, unaware, by concealing the intended purpose of the view. As a remedy, the framework offers a touch filtering mechanism that can be used to improve the security of views that provide access to sensitive functionality.

Source

1

I turned on two debugging tools to show me where the user touches. One or both of these are implemented via Screen Overlays, so I have to turn them off, and stop debugging, until the settings changes are complete...

On Android 6.0.1 Turn off Android Settings/System/Developer Options/Pointer location

And you might need to turn off "Show touches" as well, same location...

0

I'm posting this for the handful of people I've seen experiencing the same issue I had, which seems to be a bug related to initial setup in M. Summary: try a restart.

In trying to give an app permissions, I hit the "screen overlay detected" warning. Switching all screen overlay permissions to off (including system ones) did nothing. To my knowledge I have no overlay that would be causing this issue either--e.g. no screen filter apps. I manually gave the relevant app the permission it wanted, which prevented it from asking for permissions, but even then it hung saying "loading". It seems the screen overlay problem was just a symptom of a deeper issue, in which case it makes sense the standard fixes didn't work.

Anyway, I had just installed the phone and hadn't yet restarted it. After a restart, the screen overlay message didn't show up, I was able to give the app permissions normally, and it started immediately.

[I'd post this on this thread which is obviously more appropriate, but it's protected and I don't have the rep.]

  • Restart did not help me with the warning. Switching all screen overlay permissions to off did not either. – tatmanblue Oct 14 '16 at 16:38

protected by Community Oct 12 '16 at 19:48

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.