Passwords suck.
But passwords on mobile are even more painful.
Hello.
My name is Maya Ben Ari, and I'm a product manager
on the Android platform.
Let me start with a quick story.
I recently landed at the San Francisco Airport
after an exhausting 12-hour flight.
At the baggage claim, I had an idea.
I can order food with my phone so it would be
waiting for me when I got home.
I quickly downloaded an app and found
the perfect Chinese noodle dish.
I was about to submit an order, but then I
couldn't remember my password.
I knew there would be no food for me when I got home.
I wish it would just be easier.
And with the new Fingerprint Support,
we're going to change that.
With Android M, we're adding native fingerprint support
for enrollment and device unlock.
We believe that your device should stay secure
but would like to provide you the best user experience
without getting in your way.
In addition, we're introducing new APIs
for Fingerprint and Confirm Credential
to accelerate payments and sign-in operations.
These APIs will allow you to utilize your fingerprint sensor
if one exists on the device.
In the Google Play Store, if a user
has a registered finger on her device,
she can choose to use it to confirm her purchases.
When she wants to buy a song, she
can simply tap her finger on the sensor
to complete the purchase.
This is all made possible with the new FingerprintManager
class.
This simple API allows the app to authenticate the user using
his or her fingerprint.
The app perceives an authentication callback
from the sensor once the finger has been detected.
The API will authenticate the user each time the app requests
an authentication call.
The API utilizes KeyStore to create and use
cryptographic keys.
FingerprintManager gives full control of the UI
to app developers.
It allows apps to natively integrate fingerprint
into their flow.
In this example, the target app is using the fingerprint APIs
to confirm users' online purchases.
A user can add items to his cart.
And when he's ready to check out,
he can confirm using his finger.
For consistency across app, we recommend using the Android
Fingerprint Icon.
To summarize, our Fingerprint APIs
can be used to accelerate online payments
and sign-in operations.
It authenticates the user each time the app requests to do so,
while providing the app developer
full control over the UI.
FingerprintManager is great for authenticating per transaction.
But what if you want to know how recently the user has unlocked
his phone?
With our new Confirm Credential API,
you can leverage the user's lock screen
for authenticating the user.
Here I have a phone which has been modified
to add a fingerprint sensor.
To pay in-store with Android Pay, the next generation
of mobile payments, I'll tap my phone on the terminal.
[BEEPS]
The app then checks when I last unlocked my phone.
If I unlocked in the last five minutes,
my payment is considered secure, and I
can continue with my purchase.
However, if more than five minutes
passed since I last unlocked, the app
is not sure whether I'm still around my device
and will prompt to authenticate.
Only after I solve my lock screen challenge,
I can complete my purchase.
What is great is that Confirm Credential, integrated
with Android Pay, authenticates me only when it needs to.
Confirm Credential can be further extended
from device unlocking to application locking.
By leveraging the user's lock screen
combined with the timeout policy since user last unlocked,
the app can protect the user's sensitive information,
such as bank details or credit information.
For example, Credit Karma, a credit and financial management
app, provides the user a choice to protect
the app with her lock screen.
Next time she opens the app after solving her lock screen
challenge, she can quickly log into the app.
To use Confirm Credential, call ConfirmDeviceCredentialIntent
in KeyguardManager.
With Confirm Credential, an app can create a cryptographic key
and tie it to the device lock screen with a timeout policy.
For example, "Did the user unlock the device
in the last 10 minutes?"
Note that developers can choose what
timeout they wish to require.
When the app wants to authenticate the user,
it should first try to use the cryptographic key.
If that fails, the app should prompt the user
to authenticate using the Confirm Credential API.
This will automatically unlock the cryptographic key.
The key access timeouts are synced across the system.
This ensures that different apps prompt to authenticate
only when needed.
To summarize, Confirm Credential allows an app
to create cryptographic keys and tie those to lock screen.
It allows the developer to specify
a timeout policy for key access while syncing timeouts
across the system.
Our new APIs provide apps both convenience and security.
It is up to the app developer to decide which
solution fits him or her best.
For example, while the Fingerprint APIs
might be better for in-app purchases,
the Confirm Credential might be better
for in-store purchases or app-specific login.
To try out the APIs, please check out
these resources which will walk you through getting set up.
And for the next time, I hope someone
can make it easier for me to order food
without entering any password.
Thank you for watching.
[MUSIC PLAYING]