[feature/confidential-protection] Confidential Content Protection #1430

hosy · 2024-12-13T09:43:32Z

Description

Confidential View and Screenshot Protection

This update introduces screenshot protection for confidentially marked views in the app and the share sheet extension. When a screenshot is taken, confidential views will not display their content in the screenshot.

To discourage taking photos of confidential views, these views now include a watermark displaying the account’s email and username.

Screenshot protection can be enabled via an MDM parameter.

File or path names displayed in UI elements that are difficult to watermark are redacted after the third character. This ensures the user can identify the file or path name to some extent, but it remains unreadable for security.

Additionally, to prevent sharing confidential data when screenshot protection or confidential view marking is enabled, the following features are disabled:

File Provider access
Shortcuts Intents
System sharing dialog actions
Copying files
Text recognition on images

This behavior can be overridden using an MDM parameter; however, overriding it is not recommended.

MDM Parameter

MDM Parameter	Description
`confidential.allow-screenshots`	Controls whether screenshots are allowed or not. If not allowed confidential views will be marked as sensitive and are not visible in screenshots.
`confidential.mark-confidential-views`	Controls if views which contains sensitive content contains a watermark or not.
`confidential.allow-overwrite-confidential-mdm-settings`	Controls if confidential related MDM settings can be overwritten.

Screenshots

Confidential View

File List	Content View	Spaces	File Provider	Shortcuts

Screenshot Protection

App	Share Extension

Testing

Add at least one of the following MDM parameters to the Branding.plist:

Key	Type	Value
`confidential.allow-screenshots`	`Boolean`	`NO`
`confidential.mark-confidential-views`	`Boolean`	`YES`

If you want to allow File Provider access or Actions set the key confidential.allow-overwrite-confidential-mdm-settings to Boolean YES.

Screenshot protection is only working on a physical device!

What to test:

QA:

Test plan: https://github.com/owncloud/QA/blob/master/Mobile/iOS/Executions/Version%2012.4/Content%20Protection.md

Reports:

(1) Space name not redacted [feature/confidential-protection] Confidential Content Protection #1430 (comment) [FIXED]
(2) Text to be redacted in spaces' names [feature/confidential-protection] Confidential Content Protection #1430 (comment) [WONT FIX ftm]
(3) Not able to open the fp with the proper setup [feature/confidential-protection] Confidential Content Protection #1430 (comment) [FIXED]
(4) problems in markup feature [feature/confidential-protection] Confidential Content Protection #1430 (comment)

Related Issue

Motivation and Context

How Has This Been Tested?

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

My code follows the code style of this project.
My change requires a change to the documentation.
Added an issue with details about all relevant changes in the iOS documentation repository.
I have read the CONTRIBUTING document.
I have added tests to cover my changes.
All new and existing tests passed.
Added changelog files for the fixed issues in folder changelog/unreleased

This update introduces screenshot protection for confidentially marked views in the app and the share sheet extension. When a screenshot is taken, confidential views will not display their content in the screenshot. To discourage taking photos of confidential views, these views now include a watermark displaying the account’s email and username. Screenshot protection can be enabled via an MDM parameter. Additionally, to prevent sharing confidential data when screenshot protection or confidential view marking is enabled, the following features are disabled: - File Provider access - Shortcuts Intents - System sharing dialog actions - Copying files - Text recognition on images This behavior can be overridden using an MDM parameter; however, overriding it is not recommended.

- Adjusted watermark angle for improved alignment - Updated GitHub Action workflow: - Fetch the latest available OS version - Retrieve iPhone simulator device for the selected OS version

DeepDiver1975 · 2024-12-13T16:56:28Z

To fix CI I suggest to use this action https://github.com/marketplace/actions/mxcl-xcodebuild

In a second step let's define different combinations which we want to build and test in the future

- Updated default values for confidential MDM settings - Adjusted rotation angle for confidential text - Added a subtitle to small confidential views and modified text color opacity

- Preserved accessory views by ensuring watermarks are not applied to them - Added missing file from the last commit

jesmrec · 2024-12-19T09:53:27Z

First, preliminary and exploratory testing, with commit 35fa8a981

Assumed: protection only affects to:

Files (name and other parameters)
Folders name in navigation
File contents
Spaces (name and other parameters)

is that right?

1. Screenshot protection:

Using the following set up:

<key>confidential.allow-screenshots</key>
<false/>

Side menu is screen-shooted (shouldn't?). I caught a video, the content is blank due to the protection. I took two screenshots: the first one over the list of files is blank (correct ✅ ), the second one over the side menu shows the info

ScreenRecording_12-18-2024.12-22-30_1.MP4

are the username and the account sensible information?

the issue is even more visible in iPad, where the sidebar menu is always in foreground.

It's not posible to share content with other users or by link. It's posible in the web and in Android app. That causes a regression.

2. Watermarking

no issues detected at this point.

3. confidential.allow-overwrite-confidential-mdm-settings

true: I wasn't able to test the correct access to the FP's because i always get the following error:

false: FP access has been disabled by the administrator ✅

that was just a first preliminary testing, final testing will be done when CR passed. This first step helped to design the feature test plan.

hosy · 2024-12-20T08:43:32Z

@hosy There is a redraw error when switching the collection view layout from list to grid or other formats. This issue needs to be fixed.

ownCloudAppFramework/Confidential/ConfidentalManager.swift

ownCloudAppFramework/Confidential/ConfidentialManager.m

ownCloudAppFramework/Confidential/ConfidentialManager.h

ownCloudAppShared/User Interface/Confidential/SecureTextField.swift

ownCloudAppShared/User Interface/More/MoreViewHeader.swift

ownCloudAppShared/Client/View Controllers/Location Picker/ClientLocationPicker.swift

ownCloudAppShared/Client/Sharing/ShareViewController.swift

ownCloudAppShared/Client/Collection Views/CollectionViewController.swift

…ching this point.

- ConfidentialManager: - implement OCClassSettingsSource to inject settings - remove effectless "action.allow-image-interactions" from .disallowedActions - IntentSettings, ImageScrollView, OCFileProviderSettings: remove ConfidentialManager references (=> equivalent implemented via ConfidentialManager<OCClassSettingsSource>) - Action: use actionIdentifier directly, instead of rawValue - FileProvider: add ConfidentialManager to build target

- ShareViewController: remove redundant screenshot protection code - BrowserNavigationViewController: fully adopt UIView.withScreenshotProtection - ConfidentialContentView, SecureTextField: fix SwiftLint warnings

…n from init/allowedLocationFilter to .provideViewController()

felix-schwarz

I've implemented the remaining open findings and suggestions.

jesmrec · 2025-01-21T07:55:50Z

is that QA-ready? @felix-schwarz @hosy

felix-schwarz · 2025-01-21T07:57:28Z

@jesmrec Yes it is. I was just busy updating the iOS Team project and would've told you in a minute :)

jesmrec · 2025-01-21T14:06:34Z

During QA phase it's assumed that protection only affects to:

Files (name and other parameters)
Folders name in navigation
File contents
Spaces (name and other parameters)

jesmrec · 2025-01-21T14:08:56Z

(1) [FIXED]

<key>confidential.mark-confidential-views</key>
<true/>

with that setup, i notice that the space name is not redacted here:

it should be also redacted as the other red-rounded appearances.

Could you take a look @hosy @felix-schwarz

iPhoneXR iOS18
``d3287bf0d`

jesmrec · 2025-01-21T14:14:14Z

(2) (question)

This is maybe a pretty corner case, or a feature (not a bug)

First three letters of space name are visible and the other letters are redacted. But, if the space name has just three letters (for example, an subject or name abbreviation), it won't be redacted at all.

Should space names to be completely redacted? maybe reducing to two letters of visibilty will avoid more cases of short words or abbreviations that could be infered.

hosy · 2025-01-21T15:18:42Z

@jesmrec (1) is fixed and some additional titles in copy and delete actions
(2) needs to be discussed. At the moment I would leave it as it is. Thank you!

jesmrec · 2025-01-21T16:57:45Z

@hosy, thanks for fixing (1). You gave me the clue to find other visible file names:

The "Move" folder picker shows also the file name:

The "Sharing view", "Create link" and "Invite" shows the file name:

DeepDiver1975 · 2025-01-21T17:03:46Z

conflict on submodulle .... @hosy FYI

jesmrec · 2025-01-21T17:06:42Z

(3) [FIXED]

with the following setup

<key>confidential.allow-screenshots</key>
<false/>
<key>confidential.allow-overwrite-confidential-mdm-settings</key>
<true/>

i get the following error, not being able to open the fp's content:

ScreenRecording_01-21-2025.18-03-10_1.MP4

iPhoneXR iOS18
9df71cfd1

jesmrec · 2025-01-22T09:38:53Z

@hosy @felix-schwarz in one of our meetings we talked about subtitling videos to avoid recording the audio under the mark-confidential-view set up. Was that finally implemented? any detail about it? i could not reproduce that.

DeepDiver1975 · 2025-01-22T11:16:48Z

Was that finally implemented?

Only a POC was implemented but we left this out of this pull request to not overload this feature

jesmrec · 2025-01-22T17:16:39Z

(4)

Open any image or PDF file with the Markup option

Current:

here i found some problems:

files are not opened (seems to be a regression, so, feel free to fix here, it could be delayed to the final release regression test). I can reproduce this in iPhone (iOS18), but not in iPadOS (iOS17) where it works fine.
In iPadOS17, the image is visible in markup view. But, taking a screenshot with confidential.allow-screenshots as false, shows the image in the screenshot (it shouldn't).
Taking an screenshot, the file name on the top is visible when confidential.allow-screenshots is false
With mark-confidential-views enabled, file name on the top is not redacted.
If the image/pdf file is not downloaded, a download dialog appears on the bottom with the file name, that is not redacted either.
With protection features enabled, the open in icon is shown on the top of markup screen. Open in is a banned operation

Could it be a good idea to remove the Markup as well as Copy or Open in ? on the one hand, it prevents all that errors, on the other hand, as payment feature, it's bad for the user to be prevented of a feature that was paid.

iPhoneXR iOS18
iPadAir2 , iOS 17.4
9df71cfd1

- allow redacting item names in Move and Sharing operations (QA finding fix)

felix-schwarz · 2025-01-23T16:54:23Z

@hosy, thanks for fixing (1). You gave me the clue to find other visible file names:

The "Move" folder picker shows also the file name:

* The "Sharing view", "Create link" and "Invite" shows the file name:

@jesmrec I made sure these are also redacted as of 6f41013, but I'm wondering if this is really necessary. To quote the original description for the redact item name feature: "[…] UI elements that are difficult to watermark are redacted after the third character".

But since those areas already are watermarked, should they really also be redacted?

felix-schwarz · 2025-01-23T16:55:58Z

@jesmrec Re (3): assuming this happened on an actual device, I'd think it's a typical memory limit crash & error message that's responsible for this. Please try again with the latest commits, which now include the latest mem-optimizations.

jesmrec · 2025-01-24T08:04:01Z

@jesmrec Re (3): assuming this happened on an actual device, I'd think it's a typical memory limit crash & error message that's responsible for this. Please try again with the latest commits, which now include the latest mem-optimizations.

(3) is fixed 👍

(1) also fixed

(2) is a question, ftm we can keep 3 letters in the redacted names

only (4) is pending.

After that, i will do a second QA round to assure nothing was broken.

- add markup action to list of disallowedActions. The markup action could not be modified to implement protection mechanisms - not even on the CALayer level - without interaction with the system-provided view breaking - ConfidentialContentView: - break up ConfidentialContentView into Watermark (struct) and a CGContext extension to draw watermarks - refactor ConfidentialContentView to call the CGContext extension and use the Watermark struct - implement a CALayer subclass that also draws its content via the CGContext extension using the Watermark struct - extend the UIView extension to allow choosing between watermarking by subview or sublayer - context: these changes were made in an attempt to see if watermarking can be made work with EditDocumentViewController, which eventually failed (see above) - SecureTextField: remove unused code path, eliminating the compiler warning - EditDocumentViewController: change place where the watermark view is injected, allowing it to be sized correctly directly - addresses finding (4) in #1430

felix-schwarz · 2025-01-27T09:18:27Z

Re (4): the markup feature is delivered by the QLPreviewController system component, which is implemented as remote UI (=> kind of like screen sharing the contents from another process, and sending input events to that other process). This can be seen in the view debugger in the view tree:

Unfortunately, all attempts to add the protection features around it eventually failed. I documented it with this code commend:

The markup action could not be modified to implement protection mechanisms -
not even on the CALayer level - without interaction with the system-provided
view breaking and becoming unusable in different ways. A possible reason for
this is that the markup feature is delivered by the OS as Remote UI (visible
as QLRemoteUIHostViewController in the view hierarchy) and that otherwise working
approaches to "passing through" events are not usable with these.

I therefore added the markup action to the list of actions to disallow if protection features are used. It simply doesn't currently seem technically possible to offer that action under the protection umbrella.

From my POV this PR is now ready for a final QA round @jesmrec.

hosy added 3 commits December 13, 2024 10:41

- Fixed metadata values for MDM documentation generation

3c41ebe

- Adjusted watermark angle for improved alignment - Updated GitHub Action workflow: - Fetch the latest available OS version - Retrieve iPhone simulator device for the selected OS version

Added architecture parameter to xcodebuild

7e1b727

hosy added 2 commits December 16, 2024 14:56

feat: update confidential MDM settings and UI enhancements

cadff6c

- Updated default values for confidential MDM settings - Adjusted rotation angle for confidential text - Added a subtitle to small confidential views and modified text color opacity

fix: handle accessory views and include missing file

16b8446

- Preserved accessory views by ensuring watermarks are not applied to them - Added missing file from the last commit

hosy changed the title ~~[feature/confidential-protection] Confidential View and Screenshot Protection~~ [feature/confidential-protection] Confidential Content Protection Dec 16, 2024

hosy added 2 commits December 16, 2024 21:41

Merge branch 'master' into feature/confidential-protection

0f6c3d7

Merge branch 'master' into feature/confidential-protection

35fa8a9

hosy marked this pull request as ready for review December 17, 2024 09:50

hosy requested review from felix-schwarz and jesmrec December 17, 2024 09:56

hosy self-assigned this Dec 17, 2024

hosy added this to the 12.4-Next milestone Dec 17, 2024

felix-schwarz requested changes Dec 28, 2024

View reviewed changes

hosy and others added 7 commits January 16, 2025 14:34

Fixed code review findings

f987304

I have added a force quit feature to prevent the application from rea…

f38f53c

…ching this point.

- remove no longer needed imports and includes

568c49c

- CollectionView, MoreViewHeader: adopt UIView.withScreenshotProtection

c4a4927

- ShareViewController: remove redundant screenshot protection code - BrowserNavigationViewController: fully adopt UIView.withScreenshotProtection - ConfidentialContentView, SecureTextField: fix SwiftLint warnings

- ClientLocationPicker: fix CR finding, moving secureView installatio…

a81867b

…n from init/allowedLocationFilter to .provideViewController()

- UIView+Extension: remove no longer needed ownCloudSDK import

d3287bf

felix-schwarz approved these changes Jan 20, 2025

View reviewed changes

hosy added 2 commits January 21, 2025 16:16

redacte title and subtitle in spaces views

aa86369

redacte title in copy and delete action

9df71cf

felix-schwarz added 2 commits January 23, 2025 17:38

- update ios-sdk

6f41013

- allow redacting item names in Move and Sharing operations (QA finding fix)

Merge branch 'master' into feature/confidential-protection

cb7962d

felix-schwarz mentioned this pull request Jan 23, 2025

[feature/mem-optimizations] Optimize memory usage owncloud/ios-sdk#121

Merged

5 tasks

- update SDK

cda5ccb

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[feature/confidential-protection] Confidential Content Protection #1430

[feature/confidential-protection] Confidential Content Protection #1430

hosy commented Dec 13, 2024 •

edited by jesmrec

Loading

DeepDiver1975 commented Dec 13, 2024

jesmrec commented Dec 19, 2024 •

edited

Loading

hosy commented Dec 20, 2024

felix-schwarz left a comment

jesmrec commented Jan 21, 2025

felix-schwarz commented Jan 21, 2025

jesmrec commented Jan 21, 2025

jesmrec commented Jan 21, 2025 •

edited

Loading

jesmrec commented Jan 21, 2025

hosy commented Jan 21, 2025

jesmrec commented Jan 21, 2025

DeepDiver1975 commented Jan 21, 2025

jesmrec commented Jan 21, 2025 •

edited

Loading

jesmrec commented Jan 22, 2025

DeepDiver1975 commented Jan 22, 2025

jesmrec commented Jan 22, 2025

felix-schwarz commented Jan 23, 2025 •

edited

Loading

felix-schwarz commented Jan 23, 2025 •

edited

Loading

jesmrec commented Jan 24, 2025

felix-schwarz commented Jan 27, 2025

[feature/confidential-protection] Confidential Content Protection #1430

Are you sure you want to change the base?

[feature/confidential-protection] Confidential Content Protection #1430

Conversation

hosy commented Dec 13, 2024 • edited by jesmrec Loading

Description

MDM Parameter

Screenshots

Confidential View

Screenshot Protection

Testing

Related Issue

Motivation and Context

How Has This Been Tested?

Types of changes

Checklist:

DeepDiver1975 commented Dec 13, 2024

jesmrec commented Dec 19, 2024 • edited Loading

1. Screenshot protection:

2. Watermarking

3. confidential.allow-overwrite-confidential-mdm-settings

hosy commented Dec 20, 2024

felix-schwarz left a comment

Choose a reason for hiding this comment

jesmrec commented Jan 21, 2025

felix-schwarz commented Jan 21, 2025

jesmrec commented Jan 21, 2025

jesmrec commented Jan 21, 2025 • edited Loading

(1) [FIXED]

jesmrec commented Jan 21, 2025

(2) (question)

hosy commented Jan 21, 2025

jesmrec commented Jan 21, 2025

DeepDiver1975 commented Jan 21, 2025

jesmrec commented Jan 21, 2025 • edited Loading

(3) [FIXED]

jesmrec commented Jan 22, 2025

DeepDiver1975 commented Jan 22, 2025

jesmrec commented Jan 22, 2025

(4)

felix-schwarz commented Jan 23, 2025 • edited Loading

felix-schwarz commented Jan 23, 2025 • edited Loading

jesmrec commented Jan 24, 2025

felix-schwarz commented Jan 27, 2025

hosy commented Dec 13, 2024 •

edited by jesmrec

Loading

jesmrec commented Dec 19, 2024 •

edited

Loading

jesmrec commented Jan 21, 2025 •

edited

Loading

jesmrec commented Jan 21, 2025 •

edited

Loading

felix-schwarz commented Jan 23, 2025 •

edited

Loading

felix-schwarz commented Jan 23, 2025 •

edited

Loading