No longer mitigates Tap Jacking - (should use setHideOverlayWindows)

[dtarnawsky]

As this plugin hasn't been updated in a while it does not adhere to the Android Developer documentation on mitigating Tap Jacking:
https://developer.android.com/privacy-and-security/risks/tapjacking

For Android 12 and above the better mitigation is to use Window.setHideOverlayWindows call.

If you are using a Capacitor project then this plugin provides this mitigation.

[randshell]

For Android 12 and above, the Tap Jacking mitigation is implemented by default at the Android level, as per the documentation you've linked:

Android S (12, SDK 31) and higher prevent full occlusion attacks by default, by blocking touch events from non-trusted overlays from another UID.
However, there is a caveat: for System Alert Window (SAW) and window animations, only touches from layers with opacity >= 0.8 are blocked ...

This means that even with no changes in this plugin, an user of Android 12 would need a few conditions to be affected. First, the user would need to grant the SYSTEM_ALERT_WINDOW permission to a malicious app, which is a protection implemented from Android 6. Second, even with the first condition met, the user would notice the application underneath the malicious overlay, since this is forced to have no more than 0.8 opacity for the attack to work. This is the protection implemented by default on Android 12 and later.

What the suggested mitigation of using Window.setHideOverlayWindows() does is to further reduce user error, as an additional layer of defense. The main remediation was already taken care of by the Android core developers.