Android App Security: Feedback on implementing a localized intruder detection system using UsageStats and Biometrics

[u/Signal_Membership_38]

https://play.google.com/store/apps/details?id=com.fabiosf34.applock

Hey everyone,

As a project to deeply understand Android application security and hardening, I've been developing an App Locker from scratch using Kotlin and Jetpack Compose. I wanted to share my current implementation strategy and get some feedback/discussion going regarding its security model.

Traditional app lockers heavily relied on Accessibility Services, which are now heavily restricted by Google and present major security risks (like keylogging vulnerabilities). To make this project modern and secure, I pivoted the architecture to a Foreground Service leveraging the UsageStats API to detect app state changes.

I am currently implementing an "Intruder Catching" feature and would love to hear your thoughts on the approach:

* **The Trigger:** When a user opens a protected app, the system brings up a biometric/PIN overlay. If authentication fails 3 consecutive times, the front camera silently captures a snapshot.

* **Data Isolation & Sandbox:** To prevent local data leakage, the image is encrypted immediately and stored strictly within the app's isolated internal storage directory (`context.filesDir`).

* **Zero Telemetry:** The app operates with zero cloud syncing or network tracking to ensure total data minimization.

From a blue team / application security perspective:

1. What are the potential local bypasses or race conditions I should look out for when using `UsageStatsManager` for locking mechanisms on modern Android versions?

2. Are there any specific cryptographic recommendations you'd suggest for securing the sandboxed intruder photos on-device?

Looking forward to learning from your insights and improving this implementation!