FLAG_SECURE and Android O Autofill

Android O���s autofill feature offers some interesting potential. However, as with
Android 6.0���s Assist API (the power behind Now-on-Tap/Assistant) and accessibility
services, we are granting third-party apps the ability to examine the contents
of our UI. That may be fine for many apps and many users, but not for all
apps and all users. I expect that Google Play ecosystem devices running
Android O will ship with an autofill service automatically enabled, just as
such devices ship with the Assistant enabled. And so developers of secure
apps, or targeting at-risk users, need to think through how to protect some
or all of their UI from being snooped on by autofill services, since everybody
most likely will have such a service enabled ���out of the box���.

FLAG_SECURE is a typical thing to turn to here, despite
its limitations.
After all, FLAG_SECURE does block information from being delivered to the
Assist API��� or at least it used to (I have not tested it recently).

However, FLAG_SECURE has no impact on autofill services, which can read
and modify secure activities with impunity. Officially, this is
working as intended. That link
is to the security issue that I filed; perhaps one day it will be opened up for
you to be able to read it.

So, secure apps need to not only use FLAG_SECURE but also take other steps
to block autofill services from gaining access to the UI.

At the moment, this NoAssistFrameLayout works.
Wrap that around the secure UI elements, and the autofill service will not
have access to them, based on my testing to date. This also blocks
the Assist API���s access to those UI elements, which is
where this technique originated.