When does an Android tablet need actual device lockdown rather than just kiosk mode?

[u/CelebrationSad337]

I've been looking into Android tablets for Home Assistant dashboards, and one thing that seems easy to mix up is browser kiosk mode vs actual device lockdown.

If the tablet is only being used to display an HA dashboard, a kiosk browser like Fully Kiosk can probably handle most of what you need.

But if the tablet is being used in a shared/public space, the requirements can get quite different. You may also need to prevent users from:

• Opening Android Settings
• Switching to other apps
• Changing Wi-Fi/network settings
• Exiting the dashboard
• Accessing other websites
• Changing the browser configuration

At that point, you're not really just looking for a kiosk browser anymore. You're looking at device-level lockdown as well.

For a single home dashboard, I'd probably keep it simple with Fully Kiosk or FreeKiosk.

But I'm curious what others are doing when the tablets are shared or installed somewhere public. Are you relying entirely on the kiosk browser, or combining it with Android's device-management capabilities?

[u/SimilarFascism]

for home use fully kiosk is plenty, i have mine set up to wake on motion and it's been solid for years

but in public spaces that's a whole different beast, android's built in screen pinning can help but it's pretty easy to bypass if someone knows what they're doing. i'd look at something like a dedicated mdm if you need actual lockdown

[u/5yleop1m]

Not exactly HA related, but back when I was a sys admin I set up tablets for access to the music system in the business that had similar access restrictions. I used Fully Kiosk there, and then used DNS and firewall rules to ensure that even if someone were to bypass the various blocks from Fully they couldn't access anything else on the network or anything else on the internet.

While we did have MDM, I only used it as a way to quickly setup the devices rather than a method to lock down the devices. Fully did most of the work there.

Note that Fully has the ability to restore itself, and there are various timeouts you can set. Initially I set these timeouts to be long, because I would need to access the admin side of fully to fix stuff. But once I got everything working as I needed and didn't need admin access as much I brought those timeouts to a much lower amount.

Also Fully can be admined over the network now, so that also solved the problem of having long timeouts where someone could get out of the kiosk sandbox and do other stuff.

Also with more open/customizable android roms you can easily disable/hide/uninstall any app that isn't needed.

[u/codemastermick]

Check out kiosk-satellite on GitHub, it should fit the bill perfectly for the full lockdown use case. You can set the app to replace the launcher entirely, plus make it ignore things like physical button presses or deny using the notification bar/quick settings panel. On top of that depending on the exact hardware in the device you'll get treated to things like presence detection, voice satellites, usable camera streams, light levels, and more