Passwords should be invisible to the accessibility services

[mohammadnaseri]

Due to recent attacks, malicious apps that are using the accessibility service can capture all user inputs. In this case, the passwords should be ignored for the accessibility service, so such attacks cannot happen. This is done by our research project in CISPA, Saarland University, Germany.

[sorz]

Hi, can you give more information about this issue?

Is it considered a defect in the Android framework/system itself? Since the system should know well that the input field may contain password. (It already has android:inputType="textPassword")

Does this fix affect any normal usage of the accessibility service, such as a screen reader?

Thanks.

[mohammadnaseri]

The problem is as follows when there are enabled accessibility services on the device. Then all those apps can actually receive whatever user enters including the password.
This fix affects screen readers if they are used for the passwords.