Slashdot Mirror
Google's Open YOLO Project Will Remove the Need For Passwords On Android (thenextweb.com)
An anonymous reader writes via a report on The Next Web: Google is partnering with password management service Dashlane to build what they're calling Open YOLO (You Only Login Once), a new API that will allow Android apps to securely access your login credentials to sign you in without any fuss. The project is open source, which means anyone can scrutinize the code used to build it and find bugs, or even contribute and improve the API. That also means that it'll be available for other password management services to implement in their tools. Dashlane will be the first to integrate it; the company noted in a blog post that other services are also collaborating on this project and will likely to follow soon. It also hopes that Open YOLO will eventually launch on other operating systems as well.
It's be stupid to use this with your bank account. But I do have a dozen or so forums I occasionally post on and other sites which really shouldn't require an account, but they force you to make one to get access (e.g. they only let you read 3 forum posts a day anonymously). Those are basically throwaway accounts so I use the same password with them anyway. Something like this would be handy for that. Though as it's been pointed out, OpenID already tries to do that.
It's actually safer than re-using the same password on multiple sites as I've been doing. If you use the same password, if one site gets hacked, they have your password to all the other sites. With YOLO or OpenID, since the login confirmation is between the site and YOLO/OpenID, the damage is limited to the site which got hacked. They only get access to all your accounts if they hack YOLO/OpenID or your computer.
Or security when someone runs off with your phone. But it's all good because YOLO.
This is why you need to password-protect your phone.
On a recent Android device, one launched with Marshmallow, password authentication is usually implemented in the Trusted Execution Environment (TEE), including doing brute force mitigation (exponentially-increasing delays after failed authentication attempts) in the TEE. On such a device, even a four-digit PIN is pretty strong, as long as you don't get shoulder-surfed. I say "usually" because this TEE-based password authentication feature was not made mandatory in Marshmallow (which should be rectified for Nougat... though only for devices that initially launch with Nougat). However, the vast majority of devices launched with Marshmallow do have it.
If your phone is well-protected, then YOLO makes a lot of sense.
(Disclosure/Disclaimer: I'm a Google Android engineer. I work on the TEE-based authentication component, but not on YOLO.)
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.