By the end of the year, Android devs will be able to use a trust API from Google’s Project Abacus in their apps, Google ATAP Director Dan Kaufman suggested at last week’s I/O conference.
The API, which will run in the background continually, is aimed at doing away with passwords.
It will use a smartphone’s sensors to check users’ current locations, typing patterns and voice patterns, as well as for facial recognition. It will create a cumulative trust score that will authenticate users so they can unlock their devices or sign into applications.
“We’ll go out to several very large financial institutions for initial testing” this June, Kaufman told developers. If the tests go well, Google plans to release the API to Android devs worldwide by year end.
“I think the issue is Google isn’t trusted itself and has a horrid history of losing interest in initiatives once they’re launched,” remarked Rob Enderle, principal analyst at the Enderle Group.
“The potential for aggravation with both the customer and the financial institution is impressive and likely will stand as a huge barrier to adoption,” he told TechNewsWorld. “Generally, a failure would lock users out of their accounts.”
Trust API Issues
“The problem has always been that a really good biometric — such as a retinal scan or fingerprint — typically is hard to collect,” observed Michael Jude, a program manager at Stratecast/Frost & Sullivan.
“Less than reliable biometrics are easy to collect but require validation, usually by collecting several — but the more you collect, the more chances for authentication failure,” he told TechNewsWorld.
If biometrics fail, a standby such as a password or some form of support infrastructure to do a reset is required, and “this could be complex for both the user and the service provider,” Jude pointed out.
On the positive side, “when [the trust API] works, it could provide a faster, more secure, consistent method of gaining access to secure sites,” Enderle suggested.
However, “Google’s reputation of being unsecure, of not following through, of not listening to partners, and the complexity of the solution stand against this effort,” he said.
Potential Privacy Problems
An API-based security protocol will put personal information in the cloud to some extent, Jude noted, so “the question will be, do you trust your service provider with that kind of information?”
Further, the trust API will be always on, running continually in the background, and that could be a concern — especially because many Android apps send back users’ information to devs, often without the knowledge of the device’s owner.
That always-on feature means users it will be easy to track users — and with Americans being concerned about surveillance without warrants by the NSA, the FBI and various police agencies, there might be a backlash.
On the other hand, the feature could make it easier to track terrorist or criminal suspects.
There has been at least one legal ruling requiring a suspect to unlock a cellphone protected by fingerprint authentication, and with user information more readily available, law enforcement might push harder to seize data.
“This is a problem,” Jude said. “This approach to security potentially opens a lot of personal information up to coercive disclosure. I’m just waiting for someone to build a countermeasure that lets users clear a mobile data device with a voice command.”
Other Possible Issues
The trust API may not be quite as accurate as Google asserts.
@chrismessina @pmarca very cool until I break my leg or hand & can't auth to any services to get healthcare info since my behavior is diff
— Shaun Cooley (@shauncooley) January 10, 2016
What happens if a user’s biometrics change because of outside factors? If, for example, the user’s facial features or typing patterns or voice or speaking patterns are altered because of an accident or due to an injury or illness?
That question has yet to be answered.
Loading ...
