Chat with Adam Dawes about Identity and Security - Coffee with a Googler Video Lecture | Coffee with a Googler - IT & Software

today I'm having coffee with Adam Dawes
to talk about user identity on the
Google platform and what's new in our
sign in with Google api's tell us what
is it that you do and what are you
working with yeah I lead Google's
federated identity team and what I do is
I try to build seamless experiences for
users off of Google so going to any
third party app users that have a Google
account but also just to really help
developers in the ecosystem build the
extremely simple identity experiences
now starting with Google Play services
8.3 I can really see how you've
simplified the API can can you tell us a
little bit about that Google sign-in
we've gone through and kind of basically
redone the whole API the whole service
from top to bottom over the last year
some of the things that we've really
focused on is trying to decouple from
the Google+ sign-in having that launched
from a few years ago and to make it
radically simpler for both users and
developers as they build their sign-in
experiences users had a lot of interim
screens that they had to go through to
be able to sign in and now that's been
cut drastically and yeah i think the the
landscapes changed a lot over the last
couple years and users a lot more
sensitive to privacy and the information
that they give so we're trying to lead
towards a model where the user just
gives the bare-bones information to the
app and has a super low friction
experience signing into to the absence
of we've recenter do ghal sign-in around
that can I show you what what we're
talking about here sure so let me show
you the runkeeper app here that it's
implemented the latest Google sign and
API so the experience now once a user
taps that they get this new UI which
includes what we call account chips here
okay now before with the Google+ sign-in
they got this really big consent screen
with tons of words on it lots of
cognitive overload it had switches and
controls about which circles they wanted
to share with and goes for illicit of
overload yes it was a complicated for
the end user so what we have here with
the account chips is what we call a what
you see is what you give consent flow so
all the user needs to do is
tap on the profile that they want to
login as and they're done now those are
the profiles that are already on the
phone that's right the user signs into
the phone with their Google account and
then that provides which accounts they
can log into on the app so we've seen
you've made it so much easier for users
and I how about developers I know
there's new API is out there and they
are supposed to make it easier and
they're kind of stuff so how does the
developer get start and how does
developer take advantage of all that
right we've totally transformed the
api's from top to bottom and we've
centered them around open ID connect so
this is the the new authentication
standard it came out a couple years ago
and it's really where the the industry
is moving to have a very common language
for doing identity from one IDP to
another and so every app doesn't have to
reinvent oh I have to talk to this IDP
this way this IDP that way it's all just
consistent needing all that
interoperability can lead to potential
security holes right exactly exactly
makes you more secure yeah exactly but
the real innovation behind the open ID
Connect is this thing called the
identity token right it's a blob of JSON
that is signed so when you go through
that experience and you tap on the
account that you want to log in as that
signal goes back to Google and then
Google sends out an identity token back
to the app okay and that identity token
this blob of JSON basically has the
user's email address their name a couple
of other you know they're there google
ID their google identifier that not user
facing but it's a unique identifier for
that user because they can change their
email address but keep the same
identities exactly so that will that
will tie them together with that carbon
life-form and as as it goes through
those different manifestations and then
it's stamped by Google it's signed by
Google and so that's super important
because then the app knows for sure that
that google user was really there on
that device right and the ID tokens are
super portable so the app itself can
pull out all the information of the user
and personalize the app and show the
profile photo and the user's name in the
app and then it can send that ID token
back to its server and it can do that
with its API calls which you outlined
really well
your blog post then on the server side
it can verify that again Google sign
this and that that google user was
really there on that device and so it
makes security a lot simpler for
developers and again they don't have to
reinvent the wheel again and it's really
important that it's effectively the same
API infrastructure on both the mobile
device and on the server writing the
same thing because the more things that
you use the greater the potential attack
surface Ryan having this consistency is
really cool exactly so we've rebuilt the
the client SDKs around open ID connect
and it's super simple to pull out that
ID token so you can send it to your
server or you can just you know talk to
the SDKs to get out the the JSON so you
can personalize your app your app right
then and there in context and just a
much simpler experience not again tied
in with all the social stuff as much so
you off all you want to do with sign-in
is just sign the user and then we've
made that path much more straightforward
for your helper one question change a
course for a second but one question
we've heard a lot and we've seen on
Stack Overflow is like with iOS and the
right problems with using this
technology and using Google sign-in
technology with iOS but that's a thing
of the past now yes very thankfully that
is the thing of the past so some apps
had had some trouble with Apple apps
that had been using Google sign-in Apple
didn't like the fact that we were
popping out to Safari to do the sign-in
event which so we felt very strongly
about from a security perspective
because that's where the user actually
understands where they're putting their
credentials because they can see that in
the URL that they're going to Google but
it seems like they agreed that that was
an important thing for the user to be
able to do so they invented Safari view
controller in iOS 9 Iceland so I OS 9
has much better navigation
characteristics it is much more in line
with the application it just comes in on
the side and the user can't get lost the
user can't go elsewhere okay once they
have a web browser open it's much more
tied to the app but it has all the
benefits of Safari where the users sign
in state if they've already logged into
sorry you actually get a true single
sign-on experience if that users already
logged into Google then all it is is a
single tap just just showed you exactly
where the user doesn't have to sign into
google all over again a great hidden
benefit all this of course is that you
don't have to build all the security
infrastructure yourself and manage and
maintain security infrastructure given
the environment that we live in today so
but if I'm a developer and I want to get
started in this where should I get
started what's the best site to go to
other than my plugs of course well I
that is a great place to scarred but you
want to go to developers.googl com I
dent Atene ok and that outlines how you
do Google sign-in and smart lock for
passwords as well as Google identity
toolkit which all of this off stuff is
still you know probably more complicated
and requires more time than many
developers want to spend and so Google
identity toolkit is like your login
system in a box absolutely it's your
best friend right right cool and any
folks watching this video if you have
any questions for me or any questions
for you the criticism in the comments
below or near the short answer