If you run an old Android phone as a security camera, one thing stands between "a camera running in the background" and "a hidden camera": the notification the system makes it post. That notification is weaker than almost anyone assumes. The user can deny it, dismiss it, or simply not see it for the first ten seconds — three documented mechanisms, added in three separate releases. Meanwhile two other signals exist that an app has no documented way to touch at all, and almost nobody looks at t...