Screen sharing and casting need dedicated redaction for sensitive content
Aliases: presentation mode · screen share privacy · casting privacy
What it is
Casting and screen sharing turn "my screen" into "everyone's screen," but operating systems and apps design their surfaces for a private viewer: notification banners, message bubbles, and password-manager autofill all appear on the assumption that only I am looking. Screen-sharing redaction is the mechanism that systematically shields such content while the screen is shared — not the user manually covering things, but the system knowing it is being watched.
Why it happens
The risk comes from shared and private states sharing one rendering path: whatever is on the screen is what the audience sees, and the only variable is audience size. Sharing begins with a context switch, but the interface doesn't switch with it — a design gap, not a technical limit, since sharing APIs know the shared window's extent and state. Redaction therefore works as "share-aware rendering": when sharing starts, notifications go silent and off-screen, password autofill renders as masked or pauses, desktop badges hide; a step further is share-scope selection (share one window rather than the whole screen), narrowing the exposure at the source. The classic leak is a combination: a meeting app's default "share entire screen" layered with a messenger's global pop-ups — each product reasonable alone, leaking together.
Where it stops holding
Redaction is effective per sharing channel: system-level casting perceives the shared state; in-app sharing (a browser tab share) cannot see system notifications — the exposure surface shifts with sharing granularity. "Presentation mode" only silences notifications; it does nothing about sensitive windows the user opens deliberately. Remote recording makes leaks irrevocable: screenshots and recording need no consent from the sharer, so no redaction reaches what the audience has already captured — the mechanism prevents live leaks, not archived ones.
Applying it
- On share start, show a one-time "redaction checklist": notifications will silence, password fields will mask, these windows are outside the share scope — let the user see the exposure surface before being exposed.
- Apps respond to the system's sharing-state API: entering shared state pauses autofill and demotes message previews to count badges.
- Default the share scope to a single window; when full-screen is required, warn about unredacted content.
- Verification: run a real meeting-share drill and have collaborators log every irrelevant sensitive item they saw; start from zero and turn each finding into a new redaction rule.