spirit
d1a637e8e4
Security improvement: PINs are now stored as salted SHA-256 hashes instead of plain text. - PinSecurity.kt: Hash/verify utilities with salt - AdminActivity: Uses hashed PINs for storage and verification - Backward compatible: verifies against legacy plain text PINs - PIN field shows placeholder when hashed (enter new to change) - PinSecurityTest.kt: Unit tests for hashing logic Format: 'base64salt:base64hash' stored in DataStore
Android Kiosk Browser
A customizable locked-down browser for Android kiosk and digital signage deployments.
Features (MVP)
- Fullscreen WebView - Immersive mode, no address bar or browser chrome
- URL Whitelist - Only allow configured domains
- Lock Task Mode - Disables home/back/recent buttons
- Admin PIN Exit - PIN-protected escape from kiosk mode
- Auto-launch on Boot - Starts automatically when device powers on
- Idle Timeout - Returns to homepage after inactivity
- Admin Settings - Configure whitelist, homepage, timeout, PIN
Tech Stack
- Kotlin
- Android WebView
- Lock Task Mode (API 21+)
- DataStore Preferences
- Material Design 3
Requirements
- Android 5.0+ (API 21)
- For Lock Task Mode: Device Owner provisioning
Building
./gradlew assembleDebug
Device Setup
To enable Lock Task Mode (full kiosk lockdown):
adb shell dpm set-device-owner farm.hobbs.kioskbrowser/.KioskDeviceAdminReceiver
Admin Access
Triple-tap the top-left corner of the screen to access admin settings.
Default PIN: 1234
Configuration
Settings available in Admin panel:
- Homepage URL
- Allowed domains (comma-separated)
- Idle timeout (seconds)
- Admin PIN
Future Enhancements
- Remote configuration
- Multiple profiles
- Usage analytics
- Digital signage mode (URL rotation)
- Session data clearing on idle
License
MIT License - hobbs.farm
Project managed in Vikunja | Docs on Wiki