Tip Us

Android Police
Prev
Posts in the last
24 Hours
sorted by
Hottest
Next
...

Dashlane and Google introduce the 'Open YOLO' password manager API

Ryan Whitwam
Follow

Passwords are lame, but they're currently the best way we have to secure online accounts. There's plenty of advice out there about how to make passwords more secure like not reusing them across sites, choosing longer passwords, using special characters, and so on. Of course, that makes passwords more annoying. Now, Dashlane and Google have teamed up to create a new password management API called Open YOLO—that's You Only Login Once, not the other YOLO. The intention is to make passwords easier and faster.

As the name implies, Open YOLO will be an open source project. It will provide a way for the apps on your phone to instantly and securely access your login credentials without any janky auto-fill input or copying/pasting. It's reminiscent of Google Smart Lock passwords, but it's not meant as a replacement. Smart Lock is really cool when apps support it, but if you don't have a login saved in Google, you have to type it in anyway. Open YOLO provides a way for apps to access other password managers on the device in the same way.

Dashlane will be the first to support Open YOLO, but other leading password managers are apparently actively involved in the project or at least very interested in it. Open YOLO will be used first on Android, but it will eventually expand to other platforms. We expect more information on how developers can make use of the new API when Google gets around to releasing details. We'll update when that happens.

subscribe
...

Previous Story

Perchang is a neat Rube Goldberg machine puzzler, now available free on Android
...

Next Story

Some Nexus 6 owners report data outages on T-Mobile

Comments

  • David Hyman

    Here's hoping that 1password supports it!

  • Locked In a Box

    Chrome should support fingerprint scanning as a choice of password

    • F4LL0U7

      They should work on some sort of back-end magic that allows any app of your choice to authenticate your login with fingerprint scanning, regardless of if the app itself supports it.

      • Nicholas Conrad

        Oh, like some sort of password API?

        • F4LL0U7

          A fingerprint API. Like I just said. The article is about a password API, not a fingerprint API.

          • Nicholas Conrad

            There *is* a fingerprint API. You said you wanted them to allow fingerprints for apps that don't use it. What do those apps use? Passwords. Linked to a PW manager that uses fingerprints... How do you say? Oh, "boom".

      • http://www.bordersweather.co.uk/ Andy J

        So there are 2 options here. The app HAS to support something - if it requires a login, it can't be magically replaced with a fingerprint unless the app is expecting that - otherwise how do you link the fingerprint to a previous username and password? Well.... you can either use the existing Fingerprint API or you can use Google SmartLock for Passwords (like Netflix do). In short - there are already existing solutions, but they all require the app developer to do some of the work.

      • JeanClaude

        LastPass kinds of does that. You authenticate to LastPass with your fingerprint, and it auto-fills your password in the text fields for you.

    • Suyash

      But fingerprint isn't really a password, it's more like a username. What if your fingerprint gets compromised? Can you replace it?

      • jgarrido

        Great points, but I still agree with Locked In a Box. If it's good enough to authenticate me into my banking application, it's good enough to log me into Discus, or whatever.

        And theoretically, you *can* replace it by either using a different finger/bodypart (*ehem* like an elbow, or something), or by disabling that method from your phone/device altogether. Another option is to do some kind of multifactor authentication, by combining fingerprint with a pin or pattern, or something trivial like that.

      • F4LL0U7

        You have 9 more chances after the first one gets compromised. After that, you need to start using toes.

        • roberto.elena

          That assumes only one fingerprint is compromised each time.

          • Locked In a Box

            Yeah nothing is hack-proof, but having it as a separate option to text password would be convenient to many users. Having a 4 digit pin after a scan would allow it be even more secure while still faster than most unsaved passwords. Like jgarrido, my banking app also allows this so the security of it doesn't seem to be an issue for most. More options are nice and most flagships are fingerprint scan ready these days.

        • http://www.bordersweather.co.uk/ Andy J

          Some people...... have apparently..... used uhm..... *other* bodily appendages successfully.... (Source: Reddit)

      • Mike b

        I always thought of this, what about fingerprint with combination of short pass word. For instance, the Nexux has the fingerprint on the back, app opens up, i hold on the fingerprint and insert a short pin for authentication.

      • Jacob Fulbright

        Yeah, like that hacker that used pictures to recreate the thumbprint of some PM in order to get into his phone. Biometrics as a password is just... it isn't a good idea. It might be good enough for unlocking your phone, but I'll never use it to login to my bank account or even my primary email address.

        • Nicholas Conrad

          Hackers have also compromised passwords, that doesn't invalidate them as a security method. You're missing the whole point of multi-factor authentication.

          • Jacob Fulbright

            I think we're arguing semantics mostly. The "biometrics as a password" vs. "biometrics as a username" debate. Not saying it's an invalid method of identification, but it just doesn't work as a password. Passwords need to be able to change. Your biometrics don't change, or at least they're quite difficult to change on demand.

      • Nicholas Conrad

        Well, at least 9 times without taking your shoes and socks off...

      • Brandon Parmenter

        Thank you. I was hoping at least one person would write this comment.

    • JeanClaude

      You really want websites to start storing your fingerprint? Once a fingerprint leaks, there's no resetting it or changing it.

      • Locked In a Box

        No not websites, it should be done through Google chrome like when chrome ask if you want to save your username and password, it saves to your Google account, not with the website.

  • senor_heisenberg

    Nice. I hope SafeInCloud jumps on this with the quickness.

  • Derik Taylor

    The name of this just crushed my day. Just...no. They should all be ashamed of themselves for this.

    Otherwise it seems pretty cool.

    But still, they should be ashamed for that name.

    • F4LL0U7

      I felt the same way when they announced that their new messaging app was named "Allo." Come on, just name it "Hello" so I don't have to feel like an asshole when saying it.

      • Derik Taylor

        I never even thought of that. :| I always thought of it in my head as "aloe".

      • Avisshek

        they can't name it hello because Google use to had a messenger named "Hello". check the link http://googlesystem.blogspot.in/2008/05/picasas-hello-discontinued.html

        • Godspoken

          Google Hello reboot. :)

        • LJ

          That didn't stop 'em with 'Daydream'.

        • F4LL0U7

          Despite the fact that they've used up a lot of names at this point, there's no reason they need to devolve into lame pop culture acronyms and localized slang.

          Google Maps, Google Docs, Google Fit: yes please
          Google YOLO, Google Allo: no thanks

        • http://www.bordersweather.co.uk/ Andy J

          I'd imagine Microsoft using "Hello" as a biometric platform for Windows 10 would cause more confusion for users, than a previous app.

      • mark

        I'd rather they don't trademark common words.

    • LethalLunatic

      New app names, coming soon!

      Phone app -> yoyo
      Hangouts -> Hangover
      Chrome -> Broids (browser on steroids)
      Google+ -> TIM (ThisIsMe)
      Maps -> Location Location Location
      Google Drive -> Air disk
      Calendar -> TWA (The When App)
      Google Play Music -> Lalala

  • https://www.youtube.com/user/MAT0R0 -Matoro Zeliph-

    Doesn't it defeat the purpose of having multiple passwords if you services such as this? The best location to safely keep multiple passwords is writing it down on paper and keep it a safe place.

    • Benjamin Walburn

      Think of password managers as a more secure version of writing down the password. Imagine your paper having its own password. You can use one password for multiple pieces of paper, so you don't have to memorize passwords or be tempted to use one multiple times. Your master password is not exposed to various services, so if they're hacked you only have to change one password. Your master password is secured with two factor authentication or other additional security, and more difficult to access.

      • jgarrido

        Yeah, the upswing to using a password manager is enhanced security without sacrificing convenience. The downside is that it makes password management services *very* enticing to hackers... and once they're in, all ur bases are belong to them.

        • Benjamin Walburn

          Right, but stored passwords are very well protected. The passwords themselves are encrypted and hashed, so the only reasonable way to get the password is through your master password and two factor authentication. The level of security that LastPass and similar services use is extreme. The chance of someone getting into your password manager is ridiculously small compared to the likelihood of them getting the password for a single web service.

          • Sir_Brizz

            LastPass has had many vulnerabilities. Also, their handling of Heartbleed was shady and pathetic. Out of all the password managers, I think I trust them least.

          • Benjamin Walburn

            Hmm, haven't heard about that. I haven't looked much into password managers since I got a laptop that could handle Chrome, several year back. Can't beat the convenience of Chrome's password saving, especially as more apps support Google's Smart Lock.

          • Sir_Brizz

            Same.

          • Nicholas Conrad

            ? I thought they handled Heartbleed fine. I'm not a fan of log me in, but they haven't messed with last pass yet.

          • Sir_Brizz

            If by fine you mean lying about how they were notified, creating a tool that was essentially nonfunctional and lied about whether people were vulnerable, and smirking in the face of the scads of people that told them it worked wrong... I guess.

        • mark

          How would Keepass being hacked mean they have access to my encrypted file? Even for online services like Lastpass, they'd still have to decrypte the file.

          True they could distribute a hacked version, but someone could do that with any application, if you download malware you're at risk of keyloggers etc.

          • Jared K

            The threat is if they hacked YOU not the service (its hard/nearly impossible to prevent targeted attacks).
            Or, some "other" exploit that allowed them to get at unencrypted data (unlikely)

          • jgarrido

            Agreed, without knowing too much about how all of the various password managers handle encryption, hacking at the individual level is probably the most likely scenario; though software is not without bugs and vulnerabilities, so anything is possible.

      • Jared K

        Banks for passwords. Hopefully know that they are they focus a little more security than everyone else.
        The weakest point in the chain is some ransom site you signed up on for some reason, oops they weren't hashing passwords and the DB got leaked there goes that ONE password you use for everything. Or was it the one password that was generated specifically for that site?

    • Jared K

      I have a yubikey attached to my lastpass for this reason. can't get in without the physical hardware.... or JavaScript exploit :|

      • phineasjw

        You can also enable 2-pass authentication for Lastpass, which requires someone to get your mobile phone.

        • PhantomGamers

          Yubikey IS 2 factor authentication lol

          • IcratoX

            You probably know very well he's probably aiming at the other tools like Google Authenticator/Authy/Lastpass Authenticator etc.

          • PhantomGamers

            I probably know very well? Uh...

      • Sir_Brizz

        You can lock your Google account with a yubikey as well.

    • demarcmj

      "Best" is subjective

      I could make passwords that look like this... "7e5mH*!$CK#yUhd#" for 100 sites, write them all down, and stick it in a safety deposit box. It would be very secure, but essentially unusable. You'd have to run to the bank every time you want to log into anything.

    • phineasjw

      Where's your safe place? Your wallet? Your desk drawer?

      There is no safe place, and if you have no protection on your piece of paper then whoever finds your wallet now has both your address and every password you own.

    • mark

      "The best location to safely keep multiple passwords is writing it down on paper and keep it a safe place."

      But that's what a password manager does - except rather than paper, it's an encrypted file. That's a safe place.

      Using the same password has the problem that has soon as one website with ropey security is hacked, they have access to all my accounts. True, they'll have that if they gain access to the encrypted file *and* the strong password it's protected with, but it's not unreasonable to suggest that's a lot harder to do.

    • Nicholas Conrad

      Lol, can't tell you the number of users I've seen with their password on a post it note within 3 feet of their computer. Worst security idea EVER. If you can't remember your passwords when you need them than you may as well not have them, and if you can remember any of 2 or 3 dozen passwords any time you need them than those are terrible passwords. Password managers allow you to have unique passwords with high entropy for each site or service available for recall instantly. Since you only need to remember one password, it can be long and strong. Edward Snowden recommends you use: "MargaretThatcherIs110%Sexy".

  • phineasjw

    Another vote for fingerprint scanning on mobile to be the preferred method.

    This solution would seem to push everyone to store their passwords in Chrome, and not a 3rd party password manager. Hopefully I'm mistaken.

    • Adam Margeson

      Here, I'll clean up your dishes for you. :grabs fingerprint kit and sets off to 3d print a copy:

      • vyktorjonas

        watching as someone types the password would be cheaper and easier
        also, if it was an option I'd be fingerprinting the hell out of everything, passwords needs to go

        • Adam Margeson

          I think you missed my point. Fingerprints are getting to be easy to get around. They aren't overly secure. They're a bit better than passwords, but not by much, and unlike passwords, generally cannot be changed.

          • Sir_Brizz

            There are some aspects of them that are better than passwords, but there is one way they are clearly inferior: you can't change your fingerprint.

          • Adam Margeson

            Isn't that what I said?

          • Sir_Brizz

            LOL. I don't think there are very any ways in which a fingerprint is better but it is way more convenient. It's only really better than short/easily remembered passwords.

          • Nicholas Conrad

            They're better than *bad* passwords (& pins, patterns, etc), worse than *good* passwords, but most importantly, they're infinitely better than *no* password, which is how about 50% of users were securing their phones before FP scanners where mainstream.

        • Jacob Fulbright

          A member of the Chaos Computer Club (CCC) hacker network claims to have cloned a thumbprint of a German politician by using commercial software and images taken at a news conference.

          http://www.bbc.com/news/technology-30623611

          • vyktorjonas

            that'd be way too much hassle to be doing that to regular users (ie myself)

          • Jacob Fulbright

            Sure, I agree that the average user probably doesn't have to worry about it. Just pointing out that someone doesn't even need to interact with you to hack your fingerprint password, they just need to find some high resolution photos of you (which probably gets easier and easier to find the more public you live your life/prominent you are).

    • Adam Margeson

      And, no, this isn't storing passwords in Chrome. That's what Google's "Smart Lock" function is. This is allowing an app to pull username/password credentials from other password managers, such as Dashlane.

  • Internet Guardian

    So, is it already working or will be introduced in the future?

  • salc

    Enpass pls!

    • http://www.bordersweather.co.uk/ Andy J

      They are already on Android Wear and with TOTP quicker than most of the other password managers.... I reckon a quick comment in the G+ community will get them interested

  • TechGuy22

    your password only leak once ? that's a lie ;p;

  • AtomicBananaFruitHatMan

    Currently enjoying the Samsung Browser's fingerprint login, and I find it weird that Chrome doesn't have it yet. It's just so much easier and better than to type those god damn usernames and passwords over and over again.

  • NinoBr0wn

    -______________-

  • Toxoplasma

    I hope Keepass implements it

  • yoloswag

    You only login once? Nice!

  • SeaWolf

    I'm wondering if this will allow you to use password managers like Dashlane and Lastpass in mobile Chrome. It's not just the apps that are a pain to log into, the same hassle applies to mobile Chrome if you're using a password manager.

  • http://twitter.com/trwnh trwnh

    Ooh, can't wait for this to become more standard. I'd love to see Enpass adopt this...

  • JeanClaude

    Can't wait for it to come to LastPass

  • http://wii4everybody.com/ Ozl

    Lastpass has a lower price

What's Hot

Follow Lee on X/Twitter - Father, Husband, Serial builder creating AI, crypto, games & web tools. We are friends :) AI Will Come To Life!

Check out: eBank.nz (Art Generator) | Netwrck.com (AI Tools) | Text-Generator.io (AI API) | BitBank.nz (Crypto AI) | ReadingTime (Kids Reading) | RewordGame | BigMultiplayerChess | WebFiddle | How.nz | Helix AI Assistant