[MUSIC PLAYING]
DIEGO ZAVALA: Hi, I'm Diego, a product manager in Android.
JAY CIVELLI: And I'm Jay, a tech lead manager also in Android.
We're going to show you how Android
has a solution for seamless and secure login experiences
across devices.
Let's get started.
DIEGO ZAVALA: Every day, we are interacting
with more and more devices--
phones, smartwatches, tablets, TVs, smart displays.
And the list keeps growing.
A typical household in the US had 25 connected devices
in 2021, up from 11 in 2019.
But setting up a new device is often
time-consuming and frustrating.
When we get a new device or tablet,
we are eager to start using it right away.
But first, we need to open apps and sign in one by one, even
if we are signed in and using those apps elsewhere.
So today, we'll be talking about solutions to make this better.
You will see how Block Store enables a zero-touch setup,
where users don't need to go through a sign-in flow
in new devices if they have previously signed into your app
on an Android device, with none or minimal changes
to your existing authentication infrastructure.
We believe that most developers could benefit from integrating
with Block Store.
Now, Block Store won't solve how users create an account to get
started with your app.
So for developers looking to streamline
their sign-up and sign-in workflows,
we will talk about how OneTap provides
a unified experience that's integrated with a user's Google
account.
Finally, we'll show Passkeys, our sign-in solution
with advanced security, built using the FIDO standard that
allows for passwordless, cross-platform sign-in
experiences.
Let's start with Block Store.
For a seamless cross-device sign-in experience,
last year, we launched Block Store, a secure and simple API
that allows apps to store and transfer tokens and other data
across devices.
This API enables zero-touch setup,
which removes the need for users to go through a sign-in process
altogether.
Users can just launch your app and continue
where they left off--
reply back in a conversation, finish watching a movie,
order food for dinner, or any of the great experiences
that your app enables.
Block Store offers an encrypted storage solution.
And Google takes care of verifying the user's identity
by confirming that the device is signing with their Google
account.
The user experience is seamless.
They will be already signed in when
launching your app for the first time on the device,
with no system consent dialogs or need to manage passwords,
allowing users to focus on interacting with your app.
And it's very easy to implement.
You can integrate with it with fewer than 30 lines of code.
And app developers are in control of the format of data
that they store and the user experience.
Block Store supports device-to-device and cloud
restore for phones and tablets.
In the future, we'll provide the ability
to restore across other form factors.
So for instance, it will be possible to automatically sign
users into apps when setting up a Google TV with an Android
phone.
So what does a user journey look like with Block Store?
First, the user signs into your app on their device.
Then your app saves the user authentication
token to Block Store.
The token is encrypted and stored locally.
If the user has cloud backup enabled,
your app can optionally store the token in the cloud.
When the user has a new device, they
can choose to restore apps on their Block Store data.
Then your app requests the Block Store data.
The token is encrypted and returned to your app.
And your app can use it to authenticate the user.
The user is then able to access your app without any login
screens.
JAY CIVELLI: So how can app developers
integrate with Block Store?
Let me walk you through a simple implementation.
I have created this app to order delicious gelato online.
I don't want my users to have to log in again
once they get a new phone, so I'm
going to integrate with Block Store
to be able to reauthenticate them.
To set up my project, I had a dependency
to the Block Store API.
Then once a user logs in, I'll add code
to store an authentication token that
can be used to log in the user to my backend.
I did it in less than 10 lines of code.
I created a StoreBytes data instance
on which I set my token, then store
that data instance with a call to Block Store client
stored data.
I can optionally register calls back
to know if the operation was successful.
That's it for storing data.
At this point, my token is encrypted and stored
locally on my phone which Block Store.
And it's only accessible by my app.
Now, let's look at how I can retrieve the data when
my app is open on a new device.
I simply need to call retrieveBytes
on the Block Store client.
And if data is available, the success callback
is invoked and passed the token I store on the other device.
I can use that token to authenticate to my backend
without the need to show login page to the user.
Note that in this example, the data
I store with Block Store was transferred
when the user set up their new device by restoring
from their old device.
I can also extend that support to accounts
restored from a cloud backup.
To do that, I need to specify that
by setting the ShouldBackupToCloud
property to true.
It's false by default. When enabling backup to cloud,
the data set for the app is backed up on Google servers.
It is end-to-end encrypted for phones running Android 8
or later and that have a screen lock set--
PIN, pattern, or password, which means, in that case,
the data cannot be read by Google.
You can check whether end-to-end encryption is
available with the isEndToEndEncryptionAvailable
call and decide whether or not to only store data with cloud
support when encryption is available.
DIEGO ZAVALA: To learn more about Block Store, read
the developer documentation.
We'd love for you to try it out and give us your feedback.
Block Store provides a seamless experience
for signing in across Android devices.
But what if users don't have an account yet?
Google makes it easier for users to create and sign in
to existing accounts with OneTap.
OneTap makes secure sign-up and sign-in simple.
It provides a cohesive, cross-platform experience,
supporting several types of credentials.
OneTap is available on web and Android,
so users can seamlessly authenticate anywhere.
Here's what it looks like.
A user that is already signed into Google
and opens your app for the first time
can create an account with your app with a single tap.
They can then also sign back into your app's account
with just one tap.
OneTap's simple user experience has
doubled our partners' new user acquisition and conversion
rates.
To get into some of the details, being a part of sign-in
with Google, OneTap is an interface
that helps your app create a secure, token-based,
passwordless account that's associated with a Google
account.
OneTap can eliminate the dependency on passwords,
reducing the security risks associated with storing
and maintaining them.
But if a user does want to create an account
with a password, they can still use
OneTap to save their credentials,
and sync them into the Google Password Manager,
and use it with Android or Chrome autofill.
OneTap is easy to implement and is part of our Google Identity
Service Library.
You will find much more information about OneTap
in the documentation.
JAY CIVELLI: Finally, we're excited to show you
Passkeys, which we believe will evolve the way people sign in
so that they don't even have to think about passwords at all.
It doesn't matter which device they're on.
Signing in with Passkeys is easy for the user, while also being
significantly more secure.
And best of all, Passkeys work across most devices
and operating systems.
Passkeys provides strong protection
against phishing and hijacking attempts following
data breaches, two of the biggest security threats
that passwords fail to prevent.
They're an important step toward a more secure and passwordless
future.
And because Passkeys are based on FIDO standards,
they work not only on Android and Chrome,
but across popular platforms and browsers,
such as Microsoft Windows, Microsoft Edge, MacOS, iOS,
and Safari.
DIEGO ZAVALA: Using a password is like sharing a secret.
And that secret can be stolen.
Fraudsters are very good at tricking people
into accidentally sharing their passwords
with the wrong websites.
Unlike passwords, Passkeys aren't easily
leaked, thanks to the use of public key cryptography.
Passkeys created on Android are backed up
and synced with Android devices that
are signed into a same Google account in the same way
as passwords are backed up to the Password Manager.
That means your user's Passkeys go with them when
they replace their devices.
To sign in to apps on a new phone,
all users need to do is unlock their phone.
Let's see it in action.
I want to check the balance in my account
with TriBank on my phone.
I open Chrome and go to their website to sign in.
First, I enter my account name, my password, and then
I click Sign In.
The website detects that I'm using a platform that supports
Passkeys and offers the option to create
a Passkey for signing in.
Once I accept, Android guides me through the process
of creating a Passkey for TriBank
and stores the Passkey safely in my Google account.
Once I'm done viewing my balance, I sign out.
The next time I go to TriBank, I don't
need my username or password.
I select the Passkey option, select
the Passkey I want to use, touch the fingerprint sensor,
and I'm instantly signed in.
Because Passkeys require both having the phone
and knowing how to unlock it, they effectively
provide two-factor authentication
in a single step.
My Passkey will get me into my account on different devices
and platforms, including those provided
by Apple and Microsoft, because it's built on FIDO Alliance
standards.
I have to make several payments and prefer
to use my laptop for this.
So I open Chrome on my MacBook, go to TriBank,
and choose Sign In with Passkey.
This is my first time using Passkeys
from my phone on my laptop.
So my laptop first needs to connect with my phone
to use the Passkey.
I open my camera on my phone, point at the QR code
on my MacBook, select Sign In with Passkey,
and allow the two devices to connect
to each other using Bluetooth.
My available Passkeys for these websites
are now displayed on my phone.
So I simply select the one I want to use,
touch my fingerprint, and I'm instantly
signed in to my TriBank account on my MacBook.
And because my Passkeys are stored safely
in my Google account, I can easily
fetch them to use with a new phone or laptop.
When I get a new phone or laptop,
I still have all my Passkeys ready to use.
We just saw a login on the web.
But my Passkey also makes it easy to sign in to native apps
too.
When I download the new TriBank app from Google Play
and open it on my phone, I can use the exact same Passkey
to sign in.
JAY CIVELLI: For a closer look at how you'll
be able to create Passkey experiences in your products,
check out Eiji Kitamura's Google I/O session A Path to a World
Without Passwords.
We expect to have this technology available
for developers to start testing with later this year.
Stay tuned and check developers.googl
e.com/identity/fido for updates.
To wrap up, we demonstrated how to provide a seamless secure
sign-in experience across Android devices using Block
Store, OneTap and Passkeys.
Block Store enables zero-touch sign-in experiences
across devices if the user has already
signed into your app on a previous Android device.
And it can be done using your existing authentication
infrastructure.
For account creation and first-time sign-in
on an Android device, OneTap provides a unified experience
that's integrated with the Google account.
Finally, we reviewed how Passkeys
unlock sign-in experiences with advanced security using
authentication infrastructure that
supports the FIDO standard.
We hope that these APIs make it easier
for you to provide a seamless and secure sign-up
and sign-in experience for your users.
Read the developer documentation and give us feedback.
Thanks for listening and happy coding.
[MUSIC PLAYING]