Google's Open YOLO Project Will Remove the Need For Passwords On Android (thenextweb.com) 91
An anonymous reader writes via a report on The Next Web: Google is partnering with password management service Dashlane to build what they're calling Open YOLO (You Only Login Once), a new API that will allow Android apps to securely access your login credentials to sign you in without any fuss. The project is open source, which means anyone can scrutinize the code used to build it and find bugs, or even contribute and improve the API. That also means that it'll be available for other password management services to implement in their tools. Dashlane will be the first to integrate it; the company noted in a blog post that other services are also collaborating on this project and will likely to follow soon. It also hopes that Open YOLO will eventually launch on other operating systems as well.
God Help Us All (Score:1, Insightful)
It's like, how about we just let everybody look at our shit, and fuck privacy already, right?\
Let's just try it and see what happens. Why not?
What could possibly go wrong?
Re: (Score:1)
That's brand recognition!
Re: (Score:3, Funny)
To be fair, almost everything makes you think of gaping assholes.
Login Once P0wn3d Everywhere (Score:4, Funny)
Re: Login Once P0wn3d Everywhere (Score:1)
Re:God Help Us All (Score:4)
What could possibly go wrong?
Aside from, as you allude to, everyone rummaging through our collective underwear drawers when we're not home? How about 'one-stop shopping' for hackers looking to score metric assloads of access and personal data?
Re: (Score:2)
If only someone could come up with a single sign-on solution in the mobile space that a thief couldn't use, like if it scanned your thumbprint or something.
Re: (Score:3)
you failed at "single sign-on"
Re: (Score:2)
2016:
Still using single-factor authentication
Pretending your data and accounts are 'secure'
{click for reaction visual} [kym-cdn.com]
I have Bad News for you, sir: You don't understand what 'secure' means.
"... sign you in without any fuss." (Score:3, Funny)
Or security when someone runs off with your phone. But it's all good because YOLO.
Re:"... sign you in without any fuss." (Score:5, Informative)
Or security when someone runs off with your phone. But it's all good because YOLO.
This is why you need to password-protect your phone.
On a recent Android device, one launched with Marshmallow, password authentication is usually implemented in the Trusted Execution Environment (TEE), including doing brute force mitigation (exponentially-increasing delays after failed authentication attempts) in the TEE. On such a device, even a four-digit PIN is pretty strong, as long as you don't get shoulder-surfed. I say "usually" because this TEE-based password authentication feature was not made mandatory in Marshmallow (which should be rectified for Nougat... though only for devices that initially launch with Nougat). However, the vast majority of devices launched with Marshmallow do have it.
If your phone is well-protected, then YOLO makes a lot of sense.
(Disclosure/Disclaimer: I'm a Google Android engineer. I work on the TEE-based authentication component, but not on YOLO.)
Re: (Score:2)
Before you guys work on authentication try making a mobile OS that doesn't need GHz+ processing speeds and 4GB+ RAM to be fucking useful. We had videos and games and shit on 533MHz Pentium 3 with 256-512MB RAM and if lucky a 64-128MB GPU, and a responsive and fast operating system. You seem to able to achieve almost none of this, and that technology is from the late 90s.
Tell your Google overlords to get the fuck back to basics. MenuetOS could eat your lunch if they hit the mobile space.
Re: (Score:2)
Actually, even a beefy Amiga could be snappy as hell.
But bad programmers gotta bad program.
Re: (Score:2)
Before you guys work on authentication try making a mobile OS that doesn't need GHz+ processing speeds and 4GB+ RAM
That sort of mobile OS is apparently not what people want, because no one is making one of those (ignoring your exaggeration about RAM requirements).
MenuetOS could eat your lunch if they hit the mobile space.
Sounds good to me. Someone should do it.
Another terrible idea (Score:2, Flamebait)
Another terrible idea thought up by some bored ding-dong at Google.
Re: (Score:2)
Re: (Score:1)
It's because passwords look too outdated. Lets substitute something lean and brand-new that will last no more than a decade.
I can't believe I'm saying this, but I almost hope that systems that implement this get hacked to death in order to shorten that window of pain and stupidity.
OH, good (Score:2, Insightful)
Now all my online accounts can have one point of hacking failure.
GREAT idea.
Re: (Score:2)
Re: (Score:2)
nothing new, if you use login with google/facebook/twitter everywhere. Even Slashdot let's you use your openid stuff.
HHGTTG (Score:2)
Because I WANT to share the same password with all (Score:4, Interesting)
You don't use the same password for your email as you use for your bank account because you want to make sure that when one is compromised, the other is not.
Using a single login is just a slightly easier version of using the same password for all your accounts.
It is JUST as stupid as using the same password for your every account.
The only difference is that the people with your password are promising not to steal money from you outright.
They don't promise to respect your privacy in any way, because they are planning on abusing the crap out of it.
Trusting someone that's outright plan is to abuse your trust is not a smart thing to do.
Re:Because I WANT to share the same password with (Score:4, Interesting)
Yeah I'll probably never use that app, but I find the idea of an open API super useful, because I'm sure someone will implement an open source app that I can trust, and thanks to the API, it will be supported everywhere.
Re:Because I WANT to share the same password with (Score:5, Informative)
It's actually safer than re-using the same password on multiple sites as I've been doing. If you use the same password, if one site gets hacked, they have your password to all the other sites. With YOLO or OpenID, since the login confirmation is between the site and YOLO/OpenID, the damage is limited to the site which got hacked. They only get access to all your accounts if they hack YOLO/OpenID or your computer.
Re: (Score:2)
Trusting someone that's outright plan is to abuse your trust is not a smart thing to do.
(Suppressing my inner grammar-nazi) So, who do you think is not going to abuse your trust? Of course, they'll be the next takeover target...
Re: (Score:2)
Clearly, this is a slippery slope to mandating that you use the same password for everything. /sarcasm
Obviously, it isn't .. for a bunch of low-importance websites, since normal people have dozens of logins at this point, you can at least share login details among similarly-ranked importance levels. And as somebody else pointed out, at least now when you regain control of a single login, you simultaneously regain control of all associated accounts rather than trusting that you're organized and have the time
Re: (Score:2)
You don't use the same password for your email as you use for your bank account because you want to make sure that when one is compromised, the other is not.
If a thief has your email, then most likely they can use that to reset your bank account password.
Re: (Score:2)
It's better and worse.
if somebody controls your googleaccount he controls everything and probably even knows where the login works. Okay. But you can choose a strong password and 2FA. You will probably be secure and if there is a hack, it has a large impact and everyone will react.
If you use the same password everywhere, people do not know where else you used it (but can guess with your e-mail and password combo), but you have a lot of different hashes, some insecure and sometimes maybe not hashed at all. S
Track you everywhere with one password ! (Score:1)
Now they'll be able to track you all over the web from one convenient login. No thanks. Not using it.
People *really* need to start kicking back against all this crap now. It's almost too late. Soon the internet will be single log, in total tracking, no anonymity, no freedom of information etc. etc.
What could possibly go wrong? (Score:1)
Better, Faster, Stronger. (Score:4, Funny)
Re: (Score:2)
I hate SSO. (Score:3)
I hate single sign on there is no reason I shouldn't be able to login to a separate account for email and for youtube. Leave the apps separate please!
Re: (Score:3)
Hell, half the internet already accepts SSO via Google, Facebook, or Twitter; I do not use any of those to log in anywhere except Google, Facebook, or Twitter.
Re: (Score:2)
This goes back to a previous complaint I have with android phones. On android (maybe even on newer ios versions) if you sign into any amazon app you are automaticly signed in on every other amazon app so I can't be signed into an account with books and an account with movies at the same time.
They are seprate apps why can't I have seprate logins?
Re: (Score:2)
Because Amazon's programmers simply aren't that fucking smart and it's about time people realize it. The people that write game console emulators are smarter.
I mean, Amazon used to have FurAffinity's fucking DRAGONEER working for them. That should tell you just how fucking stupid the company is.
Re: (Score:2)
Uh, yea, when did you see the website code? Lying sack of shit. :D
Like corporate SSO? (Score:3)
Re: (Score:2)
Re: Like corporate SSO? (Score:2)
Re: Like corporate SSO? (Score:2)
Wow! Google is getting creepier and more stupid! (Score:3)
Re: (Score:1)
Because people don't log into ads, and advertisers want you to log in to view ads. Now shut up and accept what Google is going to do with their phone that they let you use.
multi-level preveleges everywhere (Score:2)
The SSO/YOLO will be here, we're lazy humans. So I need:
First level with a day use password, easy to "read", some "write" ability.
Second level an "elevated" privileges of the account etc. must have high barrier of entry, different password, call-me-in-person back to verify (not automated though like 2-step verification), single use codes etc. Some execute this when logging from a new device. That's good but not enough.
E.g. I want to check my bank account - "daily use". I want to conduct transfers or chang
can we start with common password rules first? (Score:2)
It would be easier for me (a human) to remember and/or generate passwords if the rules where consistent across all web sites.
SQRL (Score:2)
YOLO SWAG (Score:2)
Yolo, indeed (Score:2)
Authorization? Why authorization? Fuck it, we have your data anyway.