[MUSIC PLAYING]
LAURENCE MORONEY: Today I'm having coffee with Adam Dawes
to talk about user identity on the Google platform
and what's new in our Sign In with Google APIs.
Tell us what is it that you do and what are you working with.
ADAM DAWES: I lead Google's Federated Identity team.
And what I do is I try to build seamless experiences for users
off of Google.
So going to any third-party app, users
that have a Google account, but also
just to really help developers in the ecosystem
build extremely simple identity experiences.
LAURENCE MORONEY: Now starting with Google Play Services 8.3,
I can really see how you've simplified the API.
Can you tell us a little bit about that?
ADAM DAWES: Google Sign In, we've
gone through and kind of basically
redone the whole API, the whole service from top
to bottom over the last year.
Some of the things that we've really focused on is trying
to decouple from the Google+ Sign In,
that launch from a few years ago,
and to make it radically simpler for both users and developers
as they build their sign in experiences.
LAURENCE MORONEY: Users had a lot of interim screens
that they had to go through to be able to sign in.
And now that's been cut drastically.
ADAM DAWES: Yeah, I think the landscape's changed a lot
over the last couple of years.
And users are a lot more sensitive
to privacy and the information that they give.
So we're trying to lead towards a model
where the user just gives the bare bones information
to the app and has a super low friction experience signing
into to the app.
And so we've recentered Google Sign In around that.
Can I show you what we're talking about here?
LAURENCE MORONEY: Sure.
ADAM DAWES: So let me show you the Runkeeper app here
that has implemented the latest Google Sign In API.
So the experience now, once the user taps that,
they get this new UI, which includes what
we call account chips here.
Now before, with the Google+ sign in, they got this really
big consent screen with tons of words on it,
lots of cognitive overload.
It had switches and controls about which circles
they wanted to share with--
LAURENCE MORONEY: I love the phrase cognitive overload.
ADAM DAWES: Yes, it was complicated for the end user.
So what we have here with the account
chips is what we call a "what you see is what you give"
consent flow.
So all the user needs to do is tap on the profile
that they want to log in as, and they're done.
LAURENCE MORONEY: Now those are the profiles
that are already on the phone?
ADAM DAWES: That's right.
The user signs into the phone with their Google account.
And then that provides which accounts
they can log into on the app.
LAURENCE MORONEY: Good thing you've made
it so much easier for users.
How about developers?
I know there's new APIs out there
and they're supposed to make it easier and that kind of stuff.
So how does a developer get started
and how does a developer take advantage of all of this?
ADAM DAWES: We've totally transformed the APIs from top
to bottom.
And we've centered them around OpenID Connect.
So this is the new authentication standard.
It came out a couple of years ago.
And it's really where the industry
is moving to have a very common language for doing identity
from one IDP to another.
And so every app doesn't have to reinvent, oh, I
have to talk to this IDP this way, this IDP that way.
It's all just consistent.
LAURENCE MORONEY: And needing all that interoperability
can lead to potential security holes, right?
ADAM DAWES: Exactly-- exactly.
LAURENCE MORONEY: So that consistency
makes you more secure.
ADAM DAWES: Yeah, exactly.
But the real innovation behind OpenID Connect
is this thing called the identity token.
It's a blob of JSON that is signed.
So when you go through that experience
and you tap on the account you want
to log in as, that signal goes back to Google.
And then Google sends out an identity token back to the app.
And that identity token, this blob of JSON
basically has the user's email address, their name,
a couple of other-- their Google ID,
their Google identifier, not user facing,
but is a unique identifier for that user.
LAURENCE MORONEY: Because they can change their email address
but keep the same identities.
ADAM DAWES: Exactly.
So that will tie them together with that carbon life form
as it goes through those different manifestations.
And then it's stamped by Google.
It's signed by Google.
And so that's super important because then the app
knows for sure that that Google user was really
there on that device.
And the ID tokens are super portable.
So the app itself can pull out all the information of the user
and personalize the app and show the profile photo
and the user's name in the app.
And then it can send that ID token back to its server.
And it can do that with its API calls,
which you outlined really well in your blog post.
LAURENCE MORONEY: Thank you.
ADAM DAWES: Then on the server side,
it can verify that, again, Google signed this,
and that that Google user was really there on that device.
And so it makes security a lot simpler for developers.
And again, they don't have to reinvent the wheel again.
LAURENCE MORONEY: And it's really important
that it's effectively the same API infrastructure
on both the mobile device and on the server,
using the same thing.
Because the more things that you use,
the greater the potential attacks are for this, right?
And having this consistency is really cool.
ADAM DAWES: Exactly.
So we've rebuilt the client SDKs around OpenID Connect.
And it's super simple to pull out
that ID to hook in so you can send it to your server,
or you can just talk to the SDKs to get out the JSON
so you can personalize your app right then
and there in context.
And just a much simpler experience, not, again,
tied in with all of the social stuff as much.
So if all you want to do with sign in
is just sign the user in, then we've
made that path much more straightforward
for the developer.
LAURENCE MORONEY: One question-- change of course for a second--
but one question we've heard a lot
and we've seen on Stack Overflow is with iOS and the problems
with using this technology, using Google Sign In technology
with iOS.
But that's a thing of the past now.
ADAM DAWES: Yes, very thankfully that is a thing of the past.
So some apps had had some trouble
with Apple, apps that had been using Google Sign In, Apple
didn't like the fact that we were popping out
to Safari to do the sign in event,
which we feel very strongly about from a security
perspective because that's where the user actually understands
where they're putting their credentials,
because they can see in the URL that they're going to Google.
But it seems like they agreed that that
was an important thing for the user to be able to do.
So they invented Safari View Controller in iOS 9.
And so iOS 9 has much better navigation characteristics.
It is much more in line with the application.
It just comes in on the side.
And the user can't get lost.
The user can't go elsewhere.
Once they have a web browser open,
it's much more tied to the app.
But it has all the benefits of Safari
where the user sign in state, if they've already
logged into safari, you actually get a true single sign
in experience.
If that user's already logged into Google,
then all it is is a single tap, just like I showed you,
where the user doesn't have to sign in to Google
all over again.
LAURENCE MORONEY: A great hidden benefit to all this of course
is that you don't have to build all the security infrastructure
yourself and manage and maintain security infrastructure, given
the environment that we live in today.
But if I'm a developer and I want to get started on this,
where should I get started?
What's the best site to go to?
Other than my blogs, of course.
ADAM DAWES: Well, that is a great place to start.
But you want to go to developers.google.com/identity.
And that outlines how you do Google Sign In and Smart
Lock for Passwords, as well as Google Identity Toolkit, which
all this auth stuff is still probably more complicated
and requires more time than many developers want to spend.
And so Google Identity Toolkit is like your log
in system in a box.
LAURENCE MORONEY: Absolutely.
It's your best friend.
ADAM DAWES: Right.
LAURENCE MORONEY: Cool.
And any folks watching this video,
if you have any questions for me or any questions for you,
leave them in comments below and we'll be sure to answer them.