Posted by Shawn Willden, Staff Software Engineer
Our smart devices, such as mobile phones and tablets, contain a wealth of personal information that needs to be kept safe. Google is constantly trying to find new and better ways to protect that valuable information on Android devices. From partnering with external researchers to find and fix vulnerabilities, to adding new features to the Android platform, we work to make each release and new device safer than the last. This post talks about Google's strategy for making the encryption on Google Pixel 2 devices resistant to various levels of attack—from platform, to hardware, all the way to the people who create the signing keys for Pixel devices.
We encrypt all user data on Google Pixel devices and protect the encryption keys in secure hardware. The secure hardware runs highly secure firmware that is responsible for checking the user's password. If the password is entered incorrectly, the firmware refuses to decrypt the device. This firmware also limits the rate at which passwords can be checked, making it harder for attackers to use a brute force attack.
To prevent attackers from replacing our firmware with a malicious version, we apply digital signatures. There are two ways for an attacker to defeat the signature checks and install a malicious replacement for firmware: find and exploit vulnerabilities in the signature-checking process or gain access to the signing key and get their malicious version signed so the device will accept it as a legitimate update. The signature-checking software is tiny, isolated, and vetted with extreme thoroughness. Defeating it is hard. The signing keys, however, must exist somewhere, and there must be people who have access to them.
In the past, device makers have focused on safeguarding these keys by storing the keys in secure locations and severely restricting the number of people who have access to them. That's good, but it leaves those people open to attack by coercion or social engineering. That's risky for the employees personally, and we believe it creates too much risk for user data.
To mitigate these risks, Google Pixel 2 devices implement insider attack resistance in the tamper-resistant hardware security module that guards the encryption keys for user data. This helps prevent an attacker who manages to produce properly signed malicious firmware from installing it on the security module in a lost or stolen device without the user's cooperation. Specifically, it is not possible to upgrade the firmware that checks the user's password unless you present the correct user password. There is a way to "force" an upgrade, for example when a returned device is refurbished for resale, but forcing it wipes the secrets used to decrypt the user's data, effectively destroying it.
The Android security team believes that insider attack resistance is an important element of a complete strategy for protecting user data. The Google Pixel 2 demonstrated that it's possible to protect users even against the most highly-privileged insiders. We recommend that all mobile device makers do the same. For help, device makers working to implement insider attack resistance can reach out to the Android security team through their Google contact.
Acknowledgements: This post was developed in joint collaboration with Paul Crowley, Senior Software Engineer
Android Things enables you to build and maintain IoT devices at scale. We recently released Android Things 1.0 with long-term support for production devices, so you can easily take an IoT device from prototype to commercial product.
We packed Google I/O this year with Android Things content to inspire and empower the developer community, from talks and codelabs to interactive demos and a scavenger hunt. Here's a closer look at the fun stuff we had on display that you won't see on the shelves of retail stores.
We introduced a handful of new interactive Android Things demos across I/O, showcasing the AI and ML capabilities of the platform, so if you didn't get an opportunity to attend this year, here's a few of our favorites-- perfect for exploring from wherever you are in the world!
Smart Flowers: Flos Mobilis
What do you get when you combine machine learning, Android Things and robotics? Flos Mobilis, a continuum robot where each flower is backed by an i.MX7D development board and a camera to run an embedded neural net model that controls the motion of the flower. This is all done offline with no data stored or transmitted.
Smart Flowers: Flos Affectus
What if a robot could respond to the way you feel? Flos Affectus is a cluster of robotic flowers that "bloom" and "un-bloom" depending on the expression detected on the user's face. The 4 broad expressions Flos Affectus is trained to detect are: happy, sad, angry, surprised. Using a camera embedded in the head of the alpha flower, the flower cluster is able to detect the user's face and infer the facial emotion. The flower cluster runs offline with no data stored or transmitted and demonstrates movement capabilities and on-device machine learning models.
Rosie the Android
Initially designed by a team of Google engineers for the annual Grace Hopper conference, Rosie the Android is a 5 foot selfie-taking Android, complete with machine-learning capabilities. Inspired by Rosie the Riveter, she's a fully controllable robot that can take photos, respond to commands, wheel around and interact with those around her.
Did you take a selfie with Rosie at I/O? Redeem your unique access code at g.co/rosie
Smart Projector
Smart Projector is built on Lantern, an Android Things project exploring the relationship between surfaces and content — augmenting real-world objects and environments with glanceable, meaningful data. It leverages the Google Experiments project known as Quick Draw, using the world's largest doodling data set that has been shared publicly to help with machine learning research.
To learn more about Lantern or to start building your own, start here.
3D Printer
This modified Printrbot Smalls 3D Printer uses a real-time subsystem that showcases the flexibility of Android Things-- a microcontroller does the low-latency motor control, while Android Things handles OpenGL rendering. By keeping most of the logic on a high-level platform like Android you make development and debugging much easier, thanks to Android's great tooling.
The future of 3D printing? Making real-time control as easy and portable as the rest of Android Things.
Phew! That was just the tip of the demo iceberg. With so many demos and so many ways to use Android Things, it's easy to start imagining all the things you can build! At I/O, we helped a lot of developers get started building their first Android Things device using the Android Things Starter Kit. We're making these codelabs available, so you can get to them whenever you need, or build your own.
Missed the I/O talks? Catch the recordings of each Android Things talk, so you can start, pause, and rewind at your own leisure. Or, just lean back and watch them all.
What's new in Android Things
Build effective OEM-level apps on Android Things
Build real consumer devices with Android Things
Electronic design for Android Things System on Modules
Women Techmakers panel: experiences developing on Android Things
Product design: how to build better products with Android Things
Device provisioning and authentication with Android Things
Update production devices in the field with the Android Things Console
On top of all the resources we just mentioned, we have a corpus of information on our developer documentation, and our new community website where you can see more inspiring projects and even submit your own. So, what are you waiting for? Pick up an Android Things Starter Kit and start building something today!
Posted by Sai Deep Tetali, Software Engineer, Google Play Protect
At Google I/O 2017, we introduced Google Play Protect, our comprehensive set of security services for Android. While the name is new, the smarts powering Play Protect have protected Android users for years.
Google Play Protect's suite of mobile threat protections are built into more than 2 billion Android devices, automatically taking action in the background. We're constantly updating these protections so you don't have to think about security: it just happens. Our protections have been made even smarter by adding machine learning elements to Google Play Protect.
Google Play Protect provides in-the-moment protection from potentially harmful apps (PHAs), but Google's protections start earlier.
Before they're published in Google Play, all apps are rigorously analyzed by our security systems and Android security experts. Thanks to this process, Android devices that only download apps from Google Play are 9 times less likely to get a PHA than devices that download apps from other sources.
After you install an app, Google Play Protect continues its quest to keep your device safe by regularly scanning your device to make sure all apps are behaving properly. If it finds an app that is misbehaving, Google Play Protect either notifies you, or simply removes the harmful app to keep your device safe.
Our systems scan over 50 billion apps every day. To keep on the cutting edge of security, we look for new risks in a variety of ways, such as identifying specific code paths that signify bad behavior, investigating behavior patterns to correlate bad apps, and reviewing possible PHAs with our security experts.
In 2016, we added machine learning as a new detection mechanism and it soon became a critical part of our systems and tools.
In the most basic terms, machine learning means training a computer algorithm to recognize a behavior. To train the algorithm, we give it hundreds of thousands of examples of that behavior.
In the case of Google Play Protect, we are developing algorithms that learn which apps are "potentially harmful" and which are "safe." To learn about PHAs, the machine learning algorithms analyze our entire catalog of applications. Then our algorithms look at hundreds of signals combined with anonymized data to compare app behavior across the Android ecosystem to find PHAs. They look for behavior common to PHAs, such as apps that attempt to interact with other apps on the device, access or share your personal data, download something without your knowledge, connect to phishing websites, or bypass built-in security features.
When we find apps exhibit similar malicious behavior, we group them into families. Visualizing these PHA families helps us uncover apps that share similarities to known bad apps, but have yet remained under our radar.
After we identify a new PHA, we confirm our findings with expert security reviews. If the app in question is a PHA, Google Play Protect takes action on the app and then we feed information about that PHA back into our algorithms to help find more PHAs.
So far, our machine learning systems have successfully detected 60.3% of the malware identified by Google Play Protect in 2017.
In 2018, we're devoting a massive amount of computing power and talent to create, maintain and improve these machine learning algorithms. We're constantly leveraging artificial intelligence and our highly skilled researchers and engineers from all across Google to find new ways to keep Android devices safe and secure. In addition to our talented team, we work with the foremost security experts and researchers from around the world. These researchers contribute even more data and insights to keep Google Play Protect on the cutting edge of mobile security.
To check out Google Play Protect, open the Google Play app and tap Play Protect in the left panel.
Acknowledgements: This work was developed in joint collaboration with Google Play Protect, Safe Browsing and Play Abuse teams with contributions from Andrew Ahn, Hrishikesh Aradhye, Daniel Bali, Hongji Bao, Yajie Hu, Arthur Kaiser, Elena Kovakina, Salvador Mandujano, Melinda Miller, Rahul Mishra, Damien Octeau, Sebastian Porst, Chuangang Ren, Monirul Sharif, Sri Somanchi, Sai Deep Tetali, Zhikun Wang, and Mo Yu.
Posted by Aleks Haecky, Training Developer & Word Artist, Google+, LinkedIn, Medium
The Kotlin Bootcamp Udacity course is a free, self-paced online course that teaches you the basics of the Kotlin programming language. This introduction to Kotlin was created by Google experts in collaboration with Udacity and is for people who already know how to program.
The Kotlin language lets you create apps in less time, writing less code, and with fewer errors.
This modern object-oriented language offers a strong type system, type inference, null safety, properties, lambdas, extensions, coroutines, higher-order functions, and many other features. Kotlin is so concise that you can create complete data classes with a single line of code.
Kotlin is officially supported for building Android apps, fully interoperates with the Java programming language and libraries, and is included with IntelliJ and Android Studio.
In this course you will learn everything you need to program in Kotlin, including:
You'll learn how to use extension functions to add helpful functionality to existing classes.
Extend built-in types:
fun Int.print() = println(this) 5.print() // prints 5
Extend Android classes:
fun Context.toast(text: CharSequence, duration: Int = Toast.LENGTH_SHORT): Toast { return Toast.makeText(this, text, duration).apply { show() } } toast("Hello Toast")
Extend your own classes:
class AquariumPlant( val color: String) fun AquariumPlant.print() = println("Pretty Aquarium Plant") val plant = AquariumPlant("green") plant.print() // prints -> Pretty Aquarium Plant
When you've completed the course, you will be able to create programs in Kotlin, taking advantage of the features and capabilities that make Kotlin unique.
The course is available free, online at Udacity; take it in your own time at your own pace.
Go learn how to build apps with less code at https://www.udacity.com/course/ud9011.
Posted by Gerardo Capiel and Varouj Chitilian, Google Pay
Today's customers want to get things done faster than ever, whether they're ordering groceries or shopping for a new pair of shoes. With Google Pay, we want to ensure checkout doesn't slow them (or your conversions) down, while enhancing the customer experience at every step of the way.
Last week at Google I/O, we announced some exciting new features that do just that. We also shared the latest ways developers can use Google Pay to offer the best experiences at checkout and beyond—all available for free with our APIs. Here are some of the highlights and how you can make the most of them.
We've started rolling out support for checking out with Google Pay regardless of your browser or device. This means customers can pay with Google Pay on most major browsers from any device.
Enabling this functionality within your apps and sites is simple. Watch Google Pay software engineer Tony Chen do a website integration live on stage, then try it yourself using our developer docs.
But making checkout easier for your customers doesn't just apply to how they pay. Chrome Autofill helps customers fill in forms automatically, so they can speed through the entire checkout process without getting bogged down by typing. To ensure your shoppers are getting the fastest checkout experience with Chrome Autofill, we recommend you check out our new best practices guide.
We'll also be making it easier for customers to manage their payment methods in Google Pay by adding this functionality to our iOS and desktop experiences as well. The new functionality will allow people to add cards and see transactions whenever and wherever it's most convenient for them, giving you access to a new group of customers who will be able to use Google Pay within your apps and sites. It also means that customers who add cards from a laptop can use those cards with Google Pay on an iOS device. (Try it for yourself at g.co/pay/demo.)
This new functionality will be launching soon, and you can learn more about it in our Build with Google Pay session.
Building off our newly-launched support for prepaid transit passes, we're now also supporting a new way for you to save and manage passes through our Google Pay API for Passes. This lets you create mobile event tickets and boarding passes that your customers can save to the Google Pay Android app. We've piloted this feature with Southwest, Fortress GB, and Ticketmaster, with more partners coming soon. Want to get on board? Sign up for more information.
Actions on Google lets developers engage billions of users across the Google Assistant and soon Google Search, Android, and other surfaces by developing Actions and linking them with our ever-growing intents catalog. One of our sessions shows you how you can enable Google Pay in your Actions so your customers can make purchases with their Assistant across multiple surfaces, including mobile devices, Google Home, and soon, Smart Displays. Transactions are now available in Australia, Canada, Japan, France, Germany, the United States, and the United Kingdom. (We'll be bringing them to Brazil, India, Italy, and Spain soon.)
Plus, we're starting a developer preview where you can now enable transactions to sell digital content on the Google Assistant. That includes in-app purchases, subscriptions, games, experiences, and premium content.
We can't wait to see all of the creative ways you use Google Pay to amplify your business and build better checkout experiences for your customers. Be sure to check out all of our I/O sessions for more ideas, tools, and tips. In the meantime, we'll be hard at work on new features to keep making Google Pay the best experience possible—for you and your customers.
Posted by Iliyan Malchev, Project Treble Architect
Android P Beta available at android.com/beta
As Android continues to evolve, each new release of the OS brings new features, new user experiences, and better security. It is important that these new releases find their way to mobile devices as fast as possible.
Yesterday, we announced that the following devices, in addition to Pixel and Pixel 2, now support Android P Beta: Sony Xperia XZ2, Xiaomi Mi Mix 2S, Nokia 7 Plus, Oppo R15 Pro, Vivo X21, OnePlus 6 and Essential PH‑1. Android P Beta provides an opportunity for developers and early adopters around the world to try the latest Android release, test their apps, and provide feedback.
In this post, we provide an update to Project Treble and the technology that allowed us to bring Android Beta to more phones this year.
Bringing the new Android release quickly to the hands of users takes a combined effort between Google, silicon manufacturers (SM), device manufacturers (OEMs), and carriers. This process is technically challenging and requires aligning the schedules between our industry partners.
To reduce the technical difficulties, we launched Project Treble as part of Android Oreo.
Next, to capitalize on the foundation we built, we collaborated closely with the silicon manufacturers, where the journey of making an Android device always begins.
Any device with the latest version of Android must be based on an SoC with the proper software support for it. This software, commonly referred to as the Board Support Package (BSP), contains not only the chip-specific vendor implementation, but also all of the Android Open Source Project (AOSP) and pieces of the framework that are missing from AOSP itself (e.g., carrier-specific telephony functionality).
These BSPs are the starting point for all device launches. OEMs adapt the vendor implementation to their hardware and add their own custom framework components.
While silicon manufacturers always want the latest version of Android in their BSPs, the costs have been prohibitive. By making it possible for newer AOSP frameworks to run on older, already-released vendor implementations, Project Treble dramatically reduces the need for continuous investment in older silicon to support each Android release. Silicon manufacturers have to do all this work just once, rather than every time there is a new release of Android.
However, that first time still has to happen. Below is a chart, which illustrates the effort the various actors expend over time as they go through each release. You can think of it as code churn or bug count over time.
The chart shows how there is very little time in the year for Google, silicon manufacturers, and the OEMs to all this work. Any overlap between phases causes code churn and introduces significant schedule risk. For OEMs who target the holiday season, it is often safer to launch on an older BSP with a year-old or even older Android version. This dynamic has been at the heart of the slow uptake of the latest Android release, even on flagship devices.
To solve this, we've worked closely with Qualcomm, MediaTek and Samsung Electronics’ System LSI Business to co-develop their BSPs, starting with Android P. Their BSPs are now ready for Android P on a much-accelerated schedule, reducing the overall effort significantly. These silicon manufacturers are now able to provide a stable and high-quality release much earlier than before, allowing OEMs to bring the latest innovations of Android to their customers across the globe.
This is an important step in accelerating the adoption of Android releases that bring numerous benefits to our partners, users, and Android developers. We look forward to seeing many more partners launch or upgrade devices to Android P.
setAllowGeneratedReplies
NotificationCompat.Action action = new NotificationCompat.Action.Builder(R.drawable.ic_reply_white_24dp, replyLabel, replyPendingIntent) .addRemoteInput(remoteInput) .setAllowGeneratedReplies(true) // <--- true to enable smart replies // Wear OS requires a hint to display the reply action inline. .extend(new NotificationCompat.Action.WearableExtender() .setHintDisplayActionInline(true)) .build();
MessagingStyle
Google Play connects a thriving ecosystem of developers to people using more than 2 billion active Android devices around the world. In fact, more than 94 billion apps were installed from Google Play in the last year alone. We’re continuing to empower Android developers with new features in the Play Console to help you improve your app’s performance and grow your business. And, at Google I/O 2018, we’re introducing our vision for a new Android app model that is modular and dynamic.
The Android App Bundle is Android's new publishing format, with which you can more easily deliver a great experience in a smaller app size, and optimize for the wide variety of Android devices and form factors available. The app bundle includes all your app's compiled code and resources, but defers APK generation and signing to Google Play. You no longer have to build, sign, and manage multiple APKs.
Google Play's new app serving model, called Dynamic Delivery, uses your app bundle to generate and serve optimized APKs for each user's device configuration. This means people download only the code and resources they need to run your app. People see a smaller install size on the Play Store, can install your app more quickly, and save space on their devices.
(Left) An example of all resources being delivered to a device via a legacy APK. (Right) An example of Dynamic Delivery serving just what’s needed to a device.
With the Android App Bundle, you're also able to add dynamic feature modules to your app. Through Dynamic Delivery, your users can download your app's dynamic features on-demand, instead of during the initial install, further reducing your app's download size. To publish apps with dynamic feature modules, apply to join the beta.
Start using the Android App Bundle in the latest Android Studio canary release. Test your release using the testing tracks in the Play Console before pushing to production. Watch these I/O sessions to hear from the team as they introduce the new app model:
An internal study Google ran last year found that over 40% of one-star reviews on the Play Store mentioned app stability as an issue. Conversely, people consistently reward the best performing apps with better ratings and reviews, leading to better rankings on Google Play and more installs. Not only that, but people tend to be more engaged and willing to spend more time and money in those apps. To help you understand and fix quality issues we're improving a number of features in the Google Play Console.
Watch these I/O sessions where we introduce the new features and share examples of how developers are using them successfully:
The Play Console has tools and reports to help your whole team understand and improve your app's store performance and business metrics. The Play Console's access management controls were recently improved so you can more easily grant access to your whole team while having granular control over which data and tools they can see and use.
Subscriptions continue to see huge growth, with subscribers on Google Play growing over 80% year over year. Google Play Billing offers developers useful features to acquire, engage, and retain subscribers, and gives users a consistent and familiar purchase flow. We're making improvements to help you prepare your subscriptions business for the future and to give users more information on their subscriptions.
Watch our I/O session where we explain the new features:
As we have announced, Google Play will require new apps (from August 2018) and app updates (from November 2018) to target API level 26 or higher. For more information and practical guidance on preparing for the new requirement, watch the I/O session, Migrating your existing app to target Android Oreo and above, and review our migration guide. If you develop an SDK or library that's used by developers, make sure it's ready to target Oreo too and sign up to receive news and updates for SDK providers.
To find out more about all these new features, learn best practices, understand how other developers are finding success, and hear from the teams building these features, watch the Android & Play sessions at I/O 2018. For more developer resources about how to improve your app's performance on Google Play, read this guide to the Google Play Console and visit the Android developers website. Finally, to stay up to date, sign up to our newsletter and follow us on Twitter, LinkedIn, and Medium where we post regularly.
How useful do you find this blogpost?
★ ★ ★ ★ ★
Today at Google I/O 2018 we announced the latest preview of Android Studio 3.2 which includes an exciting set of features that support the Android P Developer Preview, the new Android App Bundle, and Android Jetpack. Download Android Studio 3.2 from our canary release channel today to explore one of the most feature rich releases of the year.
Android Jetpack is a set of libraries, developer tools and architectural guidance to help make it quick and easy to build great Android apps. It provides common infrastructure code so you can focus on what makes your app unique. Android Studio 3.2 includes a wide set of tools that support Jetpack from a visual Navigation Editor that uses the Navigation API, templates for Android Slices APIs, to refactoring tools to migrate to the new Android support libraries in Jetpack — AndroidX.
The canary 14 release of Android Studio 3.2 also supports the new Android app model that is the evolution of the APK format, the Android App Bundle. With no code changes, Android Studio 3.2 will help you create a new Android App Bundle and have it ready for publishing on Google Play.
There are 20 major features in this release of Android Studio spanning from ultra fast Android Emulator Snapshots, Sample Data in the Layout Editor, to a brand new Energy Profiler to measure battery impact of your app. If any of these features sound interesting, download the preview of Android Studio 3.2 today.
To see these features demoed in action and to get a sneak peak at other features we are working on, check out the Google I/O 2018 session - What's new in Android Development Tools.
What’s new in Android Development Tools - Google I/O 2018
Below is a full list of new features in Android Studio 3.2, organized by key developer flows.
Navigation Editor
android.enableJetifier = true
gradle.properties
AndroidX Refactoring Support
Design Time Sample Data
New Material Design Components
Slices Provider Template
CMakeList Code Completion
What's New Assistant
com.android.tools.build:gradle:3.2.0-alpha14
Build Android App Bundle
android.enableR8=true
Enable R8 in Android Studio
./adb emu avd snapshot load snap_2018-04-29_00-01-12
Android Emulator Snapshots
./adb emu screenrecord start --time-limit 10 /sample_video.webm
Screen record in Android Emulator
Virtual Scene Camera in Android Emulator
ADB Connection Assistant
Energy Profiler
System Trace
Profiler Sessions
startMethodTracing(String tracePath)
stopMethodTracing()
JNI Reference Tracking
To recap, the latest canary of Android Studio 3.2 includes these new major features:
Build
Optimize
Check out the preview release notes for more details.
Download the latest version of Android Studio 3.2 from the canary channel download page. If you are using a previous canary release of Android Studio, make sure you update to Android Studio Canary 14 or higher. If you want to maintain a stable version of Android Studio, you can run the stable release version and canary release versions of Android Studio at the same time. Learn more.
To use the mentioned Android Emulator features make sure you are running at least Android Emulator v27.3+ downloaded via the Android Studio SDK Manager.
We appreciate any early feedback on things you like, and issues or features you would like to see. Please note, to ensure we maintain product quality, the features you see in the canary channel may not be available in the next stable release channel until they are ready for stable usage. If you find a bug or issue, feel free to file an issue. Connect with us -- the Android Studio development team ‐ on our Google+ page or on Twitter.
Platform
Android Studio
Google Play
Jetpack
Kotlin
Docs
News
