With Trust API, Google is planning to replace the traditional passwords as we know them. At least for all apps running on the Android platform. This is one innovation I would be happy to embrace. And I know many people feel the same way too. I have a note book beside my workstation filled with passwords of sites I registered myself to. Some of the password belong to apps I hardly ever use. Google, using Trust API, is promising a person like me that by the end of this year, I can throw away that notebook. Bring it on I say.
The Trust API initiative was announced at the just concluded Google I/O conference in California. Last week was all about Google’s I/O conference. The coming days will definitely be about the fall outs from the event. Especially, reviews of the new products Google have in store for us now or in the future. One such service announced at the conference was the Trust API. The announcement wasn’t part of the biggest news at the conference. It was a very low key affair handled by Daniel Kaufman, head of Google’s ATAP.
From Project Abacus to Trust API
ATAP is the division in charge of several of Google’s advanced projects. It was here the code for the Trust API was developed under a Google project code named Project Abacus. Project Abacus was first introduced last year. It initial aim was to eliminate the use of passwords through a very secure one step authentication method. However, the secure replacement for passwords would be a cocktail of several small and weak security checks. These smaller security checks are then bundled together to form the very secure mode of accessing our apps. That is how Project Abacus morphed into what is now known as Trust API.
How Trust API Works
What are these small security checks that make up Trust API? Google is talking biometric data or indicators like the shape of your face and the sound of your voice. Others to be included are how you walk, the unique way you type on your Android device and the way you swipe your Android device. Taken together, they form a very secure and almost unhackable one step authentication. Additionally, since the service is always running in the background of your Android device, the Trust API can continuously monitor your device to make sure you are who you say you are. Basically implying that if your phone is snatched while using it, Trust API automatically detects that a different person is holding your phone. At the least, it would then shut down important apps in the device. At the extreme end, it would render the phone useless. That should be the ultimate aim of Trust API: making phone theft unattractive.
One can see the logic in combining all these biometrics to secure Android apps. Because using them individually would not be very secure. Facial recognition, which is already found in several Android phones is not even as secure as the fingerprint scanner. However combining them makes it far more secure than anything we are presently using right now.
For now Trust API is at the trial stage. The service is available to some developers and third party users like banks to try it out on their customers. In the beginning of the trial phase, banks should be able to use it to verify customers who want to log into their accounts using their android devices. Towards the end of the year, all developers should have a crack at what Trust API is all about. Hopefully, if no discernible bugs or glitches rear up, the general public should expect to see the the initial roll out of the service soon after
The final word should go to Kaufman, head of ATAP, “We have a phone, and these phones have all these sensors in them. Why couldn’t it just know who I was, so I don’t need a password? I should just be able to work,”
photo credit: phandroid.com; techpp.com