[MUSIC PLAYING]
LAURENCE MORONEY: Smart Lock for Passwords
is a great technology that lets you
sign in only once across all of your devices.
Today I'm meeting with Steven Soneff of the Google Identity
Platform to learn more about it.
And Stephen, you're the product manager for the Google Identity
Platform, right?
Sounds like you work on some pretty cool technologies.
STEVEN SONEFF: Yeah that's right.
So I'm product manager for all of our APIs and services
that we provide to third parties around security
and authentication, basically knowing who their users are
and helping them get signed in and signed up
as easily as possible.
LAURENCE MORONEY: Important job.
STEVEN SONEFF: Yeah, exactly.
LAURENCE MORONEY: So I know you wrote this blog post recently
about Smart Lock for Passwords.
Could you tell us a little bit about that, and what it is,
and what's so great about it?
STEVEN SONEFF: Sure.
So Smart Lock is one of our recent additions
to the set of APIs we offer.
It came out last year at Google I/O,
basically functionality to save and retrieve
information about how people sign in to a third-party app.
So if you use an app like Netflix,
you can save your log in information either from Chrome,
if you've saved your password there,
or next time you sign into the app.
And then retrieve it when you come
back so that if you have a new phone,
you don't have to remember that username or password anywhere.
LAURENCE MORONEY: Oh, cool.
And so if I've signed in in Chrome,
it will remember it when I sign in on my phone?
STEVEN SONEFF: Exactly.
So any information you save with Google
can help you sign in as easily as possible.
LAURENCE MORONEY: Cool.
Now I see you have a demo lined up there.
STEVEN SONEFF: Yeah, so let's actually see how it works.
So typically, when you're trying to log
into an app like Netflix, you'll see a username and password
field like that.
You have to enter your username, your password.
You have to remember what those are,
which can be pretty tricky if you signed up a year ago.
But now the idea is that if you're
using one of the Smart Lock APIs, you can restart the app.
Pretend this is a brand-new install now.
And instead of having to reenter that information,
you see this screen, which is basically
explaining to the user their saved information has been used
to help log them in, even automatically,
without ever having to remember what that username
and password is.
And with that, you're in.
LAURENCE MORONEY: That's really neat.
Like you can see kids out there.
So if I'm sharing an account with my kids,
I can do that also?
STEVEN SONEFF: Exactly.
So yeah, it will work for anyone who has
access to that Google account.
So that if you've got even a shared device,
it will be a completely seamless experience.
LAURENCE MORONEY: Cool.
And now I heard you're also working on tokenizing this
so that it's your actual Google Account on the devices used.
STEVEN SONEFF: Yeah, so you mentioned the blog post
that we had recently.
And so the blog post talks about not just saving and retrieving
things like passwords, but actually going beyond passwords
and going over to token-based authentication.
That if you basically use something like the Gmail
address on your device as the account
for your third-party apps or your sites,
that we can retrieve information about that
when you're signed in on this device with that account.
And if you're already signed in, then there's
no need to enter passwords manually
to your third-party apps.
They can check that it's actually you
and save the password entry, and maybe even sign you up
with just one tap.
LAURENCE MORONEY: That's really cool.
Now if I'm a developer, if I'm building an app like this one
that you just showed me, what kind of things
do I need to do to take advantage of the Smart Lock
for Passwords?
STEVEN SONEFF: So starting point is just checking out
developers.google.com/identity and going into the Smart Lock
section there.
And what you'll see is that it's a pretty simple interface.
You can save information and you can retrieve information.
There's an additional API method to show
a picker, like an email picker that can help fill a sign up
form really easily.
With one tap you'll get name and picture and email
address all filled in.
And then if you can save that information,
even use the token to skip things like email verification
or password entry.
It could make it a very smooth experience in your app.
LAURENCE MORONEY: And not just smooth, right?
It can also help make it more secure?
Because I know when I've gone on to various sites
or various apps and I need to sign up, and sometimes
there's a lot of information that I need to put in.
But if they were implementing something like this,
they can get the best of knowing that I
am who I say that I am when I sign up,
but I'm also more secure and not giving out
personal information to a third-party when
I don't need to.
Is that right?
STEVEN SONEFF: Yeah, exactly.
So we're really moving toward this model of basically only
providing the essential information at the time
that someone is signing up, and trying
to ask for more information later, kind of in context
when it's most relevant, so the user has the most
control over what they're providing
to the third-party apps.
When it is provided, we're hoping
to provide it in the form of these tokens, which
can be verified and authenticated,
and ensuring that it's only that person and not just somebody
who knows the password who's trying to access the account.
LAURENCE MORONEY: And then also if the particular app
needs to do things that require incremental authorization,
like I don't know, accessing my Drive
or Calendar, that's something that the API also offers,
right?
STEVEN SONEFF: Yeah, so that's actually
offered as part of a broader set of APIs
around logging in with Google Services.
In the same place, developers.google.com/identity,
check out how you can integrate all the Google APIs that are
out there into your app or services.
LAURENCE MORONEY: And we found-- I don't remember
the exact figures right now.
Maybe you do.
But we found that when people implement auth
like this instead of rolling their own auth,
that the actual user retention is much greater, right?
STEVEN SONEFF: Yeah.
So typically what we found in some of the studies
we've done is that if someone sees a sign in screen,
in the order of half of people will not complete it or not
complete it correctly, anything from a forgotten password
to creating a duplicate account.
And by saving this information so that when they come back,
you can really reduce those errors
and make it much more impactful, that all the downloads that you
get on your app can be made to good use.
LAURENCE MORONEY: Right.
So by implementing this properly, for users
it's more secure and it's more convenient.
And then for developers it also helps
you retain your users, right?
STEVEN SONEFF: Yeah, exactly.
The Netflix example, we did a case study
with them recently saying that in the order
of 20% of their cost for support about password
recoveries and account recoveries has been--
LAURENCE MORONEY: Wow.
Just wiped out.
STEVEN SONEFF: Yeah, exactly, reduced by using these APIs.
And looks promising for the future,
that it could be even better with things like tokens.
LAURENCE MORONEY: Pretty cool.
So to get started, developers.google.com/identity.
STEVEN SONEFF: Yep.
That's right.
LAURENCE MORONEY: OK, awesome.
Well, thank you, Steven.
STEVEN SONEFF: Well, thank you, Lawrence.
And I have something for you.
LAURENCE MORONEY: Oh, swag.
I always love swag.
STEVEN SONEFF: You've been doing all of this great work
recently with the Identity team, we have here a hoodie for you
from the Google Authentication and Security team.
LAURENCE MORONEY: Google Authentication, nice.
Well, thank you, Steven.
I'll be sure to wear this at my next Google [? Hangout. ?]
So thanks a lot, Steven.
I really appreciate the time that you spent with us.
And if you've got any questions for us,
just please leave them below and check out
the links in the description.