r/Android • u/sourasishbiswas • 3d ago
Major Privacy Loophole: Realme's "File Dock" bypasses view-once and ephemeral media protections on Instagram
Hey everyone,
I recently stumbled upon a pretty glaring privacy/security oversight on Realme devices involving the File Dock feature, and I wanted to see if anyone else has noticed this.
What happens:
While viewing a "view-once" (ephemeral) image on apps like WhatsApp or Instagram, if you accidentally or intentionally press and hold down on the image, you can drag and drop it directly into the system's File Dock panel on the side of the screen.
Instead of capturing a temporary block or failing due to screen security flags, the system overlay intercepts the rendered image data and lets you drop it as a permanent, raw copy into the dock. From there, you can paste or move it anywhere outside the app, completely defeating the purpose of view-once media.
Why this is an issue:
System-level multitasking features like File Dock or Smart Sidebar seem to sit at a compositor layer that captures screen elements before the app's internal security flags (FLAG_SECURE) and deletion timers can wipe them.
Device tested: Realme P4 (Realme UI)
Status: The copied asset persists indefinitely in the dock until manually deleted.
Has anyone else experienced this on Realme UI, or similar sidebars on Oppo/OnePlus (ColorOS/OxygenOS) devices? Thought it was worth bringing to light so people are aware of how system overlays interact with app-level privacy protections
8
u/zaphodikus 3d ago
Surely, if it is effectively using media projection, so all privacy bets are off, and that's entirely by design. While content is still on a small screen, it's private, but once you project, it's public? At least that's how I understand it, you don't have to be thinking criminally here, because you have to "allow projection" first.
-1
u/sourasishbiswas 3d ago
That's an interesting point! I hadn't considered media projection as a possible explanation. I haven't verified the underlying mechanism yet, so I don't want to assume that's exactly what's happening.
What I can confirm from my testing is that on my Realme P4, I was able to drag an Instagram View Once image into File Dock and then paste the actual image elsewhere. The copied image also remained available in the dock afterward.
Do you know whether Realme's File Dock actually uses media projection, or could it be retrieving the image through Android's drag-and-drop content-sharing mechanism?
3
u/zaphodikus 2d ago
Why or what are you testing for, who cares and what is their stake?
It helps to also compare to other totally different devices from the fruit-based OS and their projector interfaces too.
1
u/sourasishbiswas 2d ago
Honestly, I wasn't testing it for anyone in particular. I discovered it accidentally while viewing an Instagram View Once image on my Realme P4, and I was surprised that File Dock let me retain the original image. I tried it again and reproduced the same behaviour, so I posted here to see whether others had experienced it and to understand how it works.
I'm not claiming to know the underlying mechanism yet. Comparing it with iOS could be interesting too, although I'd first like to establish exactly what's happening on Android. Do you have any particular projector interface or iOS behaviour in mind that would make a useful comparison?
2
u/zaphodikus 2d ago
I used to test mobile apps, but that was 2 years ago. It's fascinating when you discover all these weird technology hacks, and it gives a interesting insight into how technology is actually designed or built.
It is often a sandcastle of things built on top of other things.
1
u/sourasishbiswas 2d ago
That sandcastle analogy is actually a great way to describe it! It's interesting how individual features can work as intended but still produce unexpected behaviour when they interact. That's exactly why I wanted to understand what's happening here rather than assume I already know the cause.
3
u/zaphodikus 2d ago
As a mobile app tester at the time I often had a lot of this kind of "Why in heck did they make it do that" moments. And often all you have done is found what in the Quality arena we call an edge case. Something unusual that either was accidental or something that the maker decided customers will not or should never do.
And that is why testing stuff is hard, because the expectation for a product to behave one way often changes when a competitor or similar product later comes out and shifts user expectations about how kit should usually behave. Sometimes it's a social or cultural shift, sometimes it's a technical shift. And those are more interesting because they can quickly obsolete your equipment. And in this case, it's a bit social, because the "expectations" of privacy have slightly shifted over time since this kit was designed. So yeah, we build on top of components, but we also build on top of a "timeline" as well. Happy hacking :-)
2
7
u/mrandr01d 2d ago
Additional fun fact, Snapchat got famous for their view once pictures, but they didn't even delete them afterwards, they just turned it into a hidden dot file. You could just go in with your file explorer and see the snaps again since they were just... stored locally like any other file. Idk if they changed that since I stopped using Snapchat years ago, but that was an interesting little hack for a while.
6
u/mrandr01d 2d ago
This isn't a flaw with the os, it's a flaw of the paradigm meta uses. View once media is constantly discussed in r/signal with a reminder that it's not secure or private if that's required. Someone can just take a screenshot or a picture of the screen with an external camera. That's largely why screenshot protections are security theater, and that feature of your os isn't really doing anything sneaky, it's just making it slightly easier to do what can always be done another way.
0
u/sourasishbiswas 2d ago
That's a fair point! I agree that View Once can't prevent every possible way of capturing an image, especially with an external camera. My concern is specifically that File Dock appeared to let me retain the original image through a normal system interaction, rather than using an external capture method.
I'm not certain yet whether the issue lies with Instagram, Realme UI, or how the two interact. Another Realme user reported that similar behaviour stopped on a newer software build, so I'm trying to establish whether this is version-specific and reproducible. The Snapchat example is interesting too — it highlights the difference between hiding media and actually protecting or deleting it.
•
u/SupremeLisper Realme Narzo 60 pro 12GB/1TB 2h ago
I cannot replicate this on my realme android smartphone. What phone and realme OS is it?
12
u/k-mcm 2d ago
Are you sure that Android actually supports what Meta claims it can do? Meta is not your honest friend.
There may be some support for DRM media rendered in hardware, but not all phones have that. Anything that goes through software rendering can be captured.