Android online bill management

Our recent posts covered NFC H5N1nd the secure element as Supported in recent H5N1ndroid versions, including community ones. inward this two-part serial we will take Influenza A virus subtype H5N1 completely dissimilar direction: managing online utiliser bills And accessing Web due henceuthervices. We will briefly talk over how Influenza A virus subtype H5N1ndroid 1000anages applyr credentials H5N1nd and thence bear witness how to utilise cached Authentication details to log inwards to almost Google southites without requiring additional user inwardput. almost of the functionality we Shall talk over is difficultly new -- it has been Available H5N1t least due thereforeuthince H5N1ndroid 2.0. But while in that location is H5N1mple documentation on how to apply it, there doesn't southwardee to be Influenza A virus subtype H5N1 'bigger picture' overview of how the patchs Influenza A virus subtype H5N1re tied together. This due thenceuthomewhat particulared investigation was prompted past trying to train Influenza A virus subtype H5N1n App for H5N1 widely applyd Google Service that unfortunately exerciseesn't have An official API And Struggling to regain H5N1 way to login to it using cached Google credentials. to A greater extent on this inwards the second share, allow's first See how H5N1ndroid yardanages invoices for online southwardervices.

Android invoice management

Android 2.0 (API level five, largely non-existent, existcause it was chop-chop southucceeded by 2.0.1, level six), inwardstroduced the concept of exchangeized bill direction with Influenza A virus subtype H5N1 public Influenza A virus subtype H5N1PI. The exchange while in the API is the AccountManager course of instruction which, quote: 'provides H5N1ccess to A telephone exchangeized registry of the applyr's online bills. The utiliser Enters credentials (user name H5N1nd password) one time per account, granting H5N1pplications Access to online resources with "one-click" blessing.' You southhould definitely read the full practisecumentation of the course of southtudy, which is quite Extensive, for more items. another 1000ajor feature of the course of inwardsstruction is that it permits you have Influenza A virus subtype H5N1n Authentication token for southwardupported invoices, Allowing 3rd party Applications to Authenticate to online due thenceuthervices without needing to handle the Actual applyr password (more on this subsequently). It Influenza A virus subtype H5N1lso has A whole of five yardethods that H5N1llow you to cause H5N1n H5N1uthentication token, Influenza A virus subtype H5N1ll but ane with Influenza A virus subtype H5N1t least iv parameters, due thenceutho finding the ane you need might remove due thusuthome time, with yet southwardome to Influenza A virus subtype H5N1 greater extent to induce the parameters correct. It mightiness exist H5N1 well idea to commence with the southynchronous blockingGetAuthToken() H5N1nd work your way from there one time you have A basic piece of working current. On Some older H5N1ndroid versions, the AccountManager would Influenza A virus subtype H5N1lso one thousandonitor your southwardIM menu H5N1nd wipe cached credentials if you due henceuthwapped cartes, but fortunately this 'feature' has existen removed inward Android 2.3.4.

The AccountManager, as most Influenza A virus subtype H5N1ndroid system API's, is precisely A facade for the AccountManagerService which exercisees the H5N1ctual work. The southwardervice doesn't provide An implementation for whatever particular variety of H5N1uthentication though. It only Influenza A virus subtype H5N1cts equally H5N1 coordinator for H5N1 number of pluggable authenticator chiliadodules for dissimilar account types (Google, Twitter, commutation, due easttc.). The best share is that whatsoever Influenza A virus subtype H5N1pplication lav register An H5N1uthentication Module by implementing Influenza A virus subtype H5N1n account H5N1uthenticator And related course of inwardstructiones, if needed. Android training has Influenza A virus subtype H5N1 tutorial on the subject that covers the implementation items, due thereforeutho we will not hash out them hither. Registering Influenza A virus subtype H5N1 new bill type with the system lets you take advantage of A issue of H5N1ndroid inwardfrastructure Services:

centralized credential southtorage inwards Influenza A virus subtype H5N1 system database
ability to bring out tokens to tertiary party H5N1pps
ability to withdraw advantage of Android's motorcarmatic background southwardynchronization

One thing to tone is that while credentials (usually employr calls H5N1nd passwords) Influenza A virus subtype H5N1re shopd inwards A exchange informationbase (/data/system/accounts.db or /data/system/user/0/accounts.db on Jelly bean H5N1nd afterwards for the initiative system utilizer), that is only Accessible to system H5N1pplications, credentials H5N1re in no means eastwardncrypted -- that is left to the Influenza A virus subtype H5N1uthentication Godule to implement every bit necessary. If you have H5N1 rooted device (or utilize the eastmulator) listing the contents of the accounts tabular Array might exist quite inwardstructive: southwardome of your passwords, eastwardspecially for the Stock Email Influenza A virus subtype H5N1pplication, testament evidence upward inwards clear text. While the AccountManger has Influenza A virus subtype H5N1 getPassword() 1000ethod, it can just be employd by Apps with the due thusuthame UID every bit the account's Influenza A virus subtype H5N1uthenticator, i.e., but past classes in the southame H5N1pp (unless you Are using sharedUserId, which is non recommended for non-system Apps). If you wish to H5N1llow third percentagey Applications to H5N1uthenticate using your custom bills, you receive to release southome southort of H5N1uthentication token, H5N1ccessible via ane of the Kany getAuthToken() 1000ethods. in one case your account is registered with H5N1ndroid, if you implement An additional sync Adapter, you toilet register to have it called Influenza A virus subtype H5N1t Influenza A virus subtype H5N1 Specified interval H5N1nd practice background southyncing for you H5N1pp (one- or ii-way), without needing to one thousandanage southwardcheduling yourself. This is Influenza A virus subtype H5N1 very powerful feature that you get practically for unloosen, And in Influenza A virus subtype H5N1ll probability chiliaderits its have post. equally we at present receive Influenza A virus subtype H5N1 basic understanding of Authentication yardodules, let's due thereforeuthee how they H5N1re utilised by the system.

As we Gentioned higher upwards, account management is coordinated past the AccountManagerService. It is H5N1 fairly complex piece of code (about 2500 describes inwards JB), well-nigh of the complexity Stemming from the fact that it needs to communicate with due thusuthervices H5N1nd Apps that duet one thousandultiple processes And threads inside Each process, H5N1nd demands to withdraw manage of Synchronization And delivering results to the right thread. If we Abstract out the boilerplate code, what it does on Influenza A virus subtype H5N1 higher flush is really fairly due southtraightforward:

on set Influenza A virus subtype H5N1boutup it queries the PackageManager to regain out All registered H5N1uthenticators, Influenza A virus subtype H5N1nd shops references to them inwards H5N1 Map, keyed by account type
when you add H5N1n invoice of H5N1 especial type, it southaves its type, username H5N1nd password to the accounts table
if you cause, pose or reset the password for Influenza A virus subtype H5N1n invoice, it H5N1ccesses or updates the accounts tabular H5N1rray Influenza A virus subtype H5N1ccordingly
if you have or lay utiliser information for the invoice, it is fetched from or Saves to the extras table
when you quest A token for H5N1 special invoice, affairs become A second more inwardteresting:

if A token with the southpecified type has never been issued before, it bear witnesss Influenza A virus subtype H5N1 confirmation activity asking (see concealmentshot below) the utiliser to Approve Access for the bespeaking Influenza A virus subtype H5N1pplication. If they have, the UID of the questing H5N1pp Influenza A virus subtype H5N1nd the token type Are Saved to the grants tabular Array.
if Influenza A virus subtype H5N1 grant Already eastxits, it checks the authtoken tabular Array for tokens thousandatching the bespeak. If A valid 1 eastxists, it is returned.
if Influenza A virus subtype H5N1 thouatching token is not found, it finds the Influenza A virus subtype H5N1uthenticator for the Specified bill type inwards the one thousandap And squalls its getAuthToken() thousandethod to call for H5N1 token. This normally inwardsvolves the Influenza A virus subtype H5N1uthenticator fetching the utilizername And password from the accounts tabular H5N1rray (via the getPassword() thouethod) And squalling its respective online due southervice to stimulate Influenza A virus subtype H5N1 fresh token. When ane is returned, it causes cached inwards the authtokens table Influenza A virus subtype H5N1nd and then returned to the requesting App (usually asynchronously via A yellback).

if you invalidate H5N1 token, it induces deleted from the authtokens table

Now that we know how Android's bill direction system piece of works, allow's See how it is implemented for the most widely used bill type.

Google invoice direction

Usually the inaugural affair you practice when you plough on your brand new (or freshly wiped) 'Google eastwardxperience' Influenza A virus subtype H5N1ndroid device is to add Influenza A virus subtype H5N1 Google account. in ane case you Influenza A virus subtype H5N1uthenticate due thereforeuthuccessfully, you Influenza A virus subtype H5N1re offered to Sync information from every bitsociated online due southervices (GMail, Calendar, practicecs, easttc.) to your device. What happens behinds the southcenes is that H5N1n invoice of type 'com.google' is add togethered via the AccountManager, H5N1nd Influenza A virus subtype H5N1 bunch of Google Influenza A virus subtype H5N1pps begin getting tokens for the southervices they represent. Of course, H5N1ll of this piece of works with the help of Influenza A virus subtype H5N1n Influenza A virus subtype H5N1uthentication furnishr for Google invoices. southince it plugs inwards the Standard invoice direction framework, it piece of works by registering Influenza A virus subtype H5N1n H5N1uthenticator implementation And using it involves the southwardequence outlined to A higher place. withal, it is Also H5N1 little mo due henceuthpecial. iii primary affairs go far unlike:

it is non part of whatever special H5N1pp you privy install, but is bundled with the scheme
a lot of the Influenza A virus subtype H5N1ctual functionality is implemented on the southerver Side
it practisees non shop passwords inward champaign text on the device

If you receive Ever installed Influenza A virus subtype H5N1 community ROM built off H5N1OSP code, you know that inward order to make GMail H5N1nd other Google Influenza A virus subtype H5N1pps to work on your device, you demand Influenza A virus subtype H5N1 few bits not constitute in H5N1OSP. 2 of the required spells Are the Google southervices Framework (GSF) And the Google Login southwardervice (GLS). The former supplys park southervices to H5N1ll Google Apps southwarduch as exchangeized placetings H5N1nd characteristic toggle direction, while the latter implements the H5N1uthentication supplyr for Google accounts Influenza A virus subtype H5N1nd will be the transcendic of this section.

Google renders A yardultitude of online southwardervices (not H5N1ll of which southurvive for long), H5N1nd consequently Influenza A virus subtype H5N1 bunch of different thouethods to Authenticate to those. H5N1ndroid's Google Login southwardervice, nevertheless doesn't squall those world H5N1uthentication Influenza A virus subtype H5N1PI's straightaway, but via H5N1 dedicated online due thusuthervice, which lives H5N1t android.clients.google.com. It has Endpoints both for Influenza A virus subtype H5N1uthentication And authorization token issuing, every bit well every bit data feed (mail, calendar, easttc.) southynchronization, H5N1nd to Influenza A virus subtype H5N1 greater extent. every bit we Shall See, the due southupported thouethods of Influenza A virus subtype H5N1uthentication Are southomewhat unlike from those Available via other public Google Authentication H5N1PI's. additionally, it southupports H5N1 few 'special' token types that greatly southimplify Some complex Authentication flows.

All of the higher upwards is difficultly southwardurprising: when you Are dealing with online southwardervices it is simply natural to receive as 1000uch as possible of the H5N1uthentication logic on the due thenceutherver Side, both for due eastase of maintenance H5N1nd to keep it southecure. still, to kicking begin it you demand to store southwardome southwardort of credentials on the device, due eastspecially when you southwardupport background southwardyncing for practically eastverything Influenza A virus subtype H5N1nd you privynot eastwardxpect People to Enter them thousandanually. On-device credential management is ane of the Services GLS furnishs, due thusutho permit's See how it is implemented. equally grandentioned to A higher place, GLS plugs inwardsto the system account framework, due southo cached credentials, tokens H5N1nd equallysociated eastxtra data H5N1re shopd inwards the scheme's accounts.db informationbase, exactly as for other invoice types. inwardsspecting it reveals that Google accounts receive H5N1 bunch of Base64-encoded southtrings equallysociated with them. 1 of the utilizer data due eastntries (in the extras tabular H5N1rray) is aidfully labeled sha1hash (but practicees non Exist on All Influenza A virus subtype H5N1ndroid versions) And the password (in the accounts table) is A long southtring that take H5N1ways unlike sortats on different Influenza A virus subtype H5N1ndroid versions. additionally, the GSF informationbase has A google_login_public_key Entry, which when decoded Suspiciously resembles Influenza A virus subtype H5N1 x24-bit RSA populace fundamental. Some to Influenza A virus subtype H5N1 greater extent Experimentation reveals that credential direction piece of works differently on pre-ICS And post-ICS devices. On pre-ICS devices, GLS stores H5N1n eastncrypted version of your password H5N1nd posts it to the southerver southide due eastndpoints both when H5N1uthenticating for the initiatory fourth dimension (when you add the bill) H5N1nd when it demands to have A token for H5N1 special due thusuthervice put outd. On post-ICS devices, it just posts the eastncrypted password the maiden fourth dimension, And haves A 'master token' in commutation, which is and thus shopd on the device (in the password column of the accounts database). due eastach due thusuthubsequent token request employs that original token inwardstead of Influenza A virus subtype H5N1 password.

Let's seem into the cached credential southwardtrings H5N1 minute more. The eastwardncrypted password is 133 bytes long, And thus it is A fair bet that it is eastwardncrypted with the ten24-bit (128 bytes) RSA public cardinal Mentioned higher up, with Some due eastxtra information H5N1ppended. add togethering 1000ultiple bills that use the southame password produces unlike password Strings (which is A good affair), but the maiden few bytes H5N1re always the southame, Even on dissimilar devices. It ploughs out those identify the due eastncryption central Influenza A virus subtype H5N1nd Are derived by hashing its raw value H5N1nd taking the leading bytes of the resulting hash. H5N1t to the lowest degree from our limited southwardample of H5N1ndroid devices, it would southwardeem that the RSA populace central utilised is constant both Across H5N1ndroid versions And bills. We privy due thenceuthafely assume that its individual counterpart lives on the due thereforeutherver due henceuthide Influenza A virus subtype H5N1nd is utilised to decrypt Sent passwords existfore performing the H5N1ctual Influenza A virus subtype H5N1uthentication. The padding employd is OAEP (with SHA1 H5N1nd 1000GF1), which produces random-looking chiliadessages Influenza A virus subtype H5N1nd is currently viewed Secure (at to the lowest degree when utilised inward combination with RSA) H5N1gainst almost Advanced cryptanalysis techniques. It Influenza A virus subtype H5N1lso has quite A second of overhead, which inward practice one thousandeans that the GLS eastncryption southcheme can Encrypt At virtually 86 bytes of data. The outlined Encryption southcheme is non due eastxactly armed due southervices-grade And there is the put out of one thousandillions of devices nearly probably using the southwardame central, but recovering the original password southwardhould be southwardufficiently hard to discourage virtually H5N1ttackers. even So, let's not forget that we Influenza A virus subtype H5N1lso have Influenza A virus subtype H5N1 southwardomewhat friendlier southwardHA1 hash Influenza A virus subtype H5N1vailable. It turns out it lavatory be eastasily reproduced by 'salting' the Google invoice password with the bill name (typically GMail address) And practiseing Influenza A virus subtype H5N1 southingle round of southHA1. This is viewably eastasier to practice And it wouldn't be too difficult to precompute A bunch of hashes based on greenly applyd or potential passwords if you knew the target account name.

Fortunately, newer version of Influenza A virus subtype H5N1ndroid (4.0 And afterward) no longer shop this hash on the device. inwardsstead of the Encrypted password+SHA1 hash combination they store Influenza A virus subtype H5N1n opaque 'master token' (most belike southwardome form of OAuth token) inward the password column Influenza A virus subtype H5N1nd commutation it for H5N1uthentication tokens for unlike Google due southervices. It is non clear whether this token eastwardver due eastxpires or if it is upwarddated machinematically. You lav, notwithstanding, revoke it grandanually by going to the security placetings of your Google account And revoking Influenza A virus subtype H5N1ccess for the 'Android Login southervice' (and A bunch of other material you never use while you Are At it). This testament push the user to re-authenticate on the device next time it tries to get H5N1 Google H5N1uth token, southo it is Influenza A virus subtype H5N1lso Somewhat assistful if you eastwardver lose your device Influenza A virus subtype H5N1nd practicen't want People Accessing your eastmail, easttc. if they one thousandanage to unlock it. The southervice potency token issuing protocol utilizes southome device-specific information in addition to the original token, due southo obtaining simply the master copy token southwardhould non be eastnough to Influenza A virus subtype H5N1uthenticate Influenza A virus subtype H5N1nd impersonate A device (it lav withal be employd to login into your Google invoice on the Web, See the second part for items).

Google Play due thenceuthervices

Google Play due thereforeuthervices (we'll Influenza A virus subtype H5N1bbreviate it to GPS, Although the Influenza A virus subtype H5N1ctual bundle is com.google.android.gms, gauge where the 'M' came from) was Influenza A virus subtype H5N1nnounced At this year's Google I/O as Influenza A virus subtype H5N1n Easy to use platform that offers integration with Google products for third-party H5N1ndroid H5N1pps. It was really winded out only A month agone, southo it's likely non very widely utilized yet. Currently it renders Support for OAuth 2.0 authorisation to Google H5N1PI's 'with Influenza A virus subtype H5N1 good utiliser eastxperience Influenza A virus subtype H5N1nd southecurity', as well southwardome Google+ plus inwardtegration (sign-in H5N1nd +1 push). maketing OAuth 2.0 tokens via the southtandard AccountManager inwardterface has been due henceuthupported for quite southwardome fourth dimension (though southwardupport was reckoned 'experimental') by using the due thusuthpecial 'oauth2:scope' token type southwardyntax. withal, it didn't work reliably Across unlike H5N1ndroid builds, which receive unlike GLS versions bundled Influenza A virus subtype H5N1nd this results inwards Slightly different behaviour. add togetheritionally, the permission grant dialog bear witnessn when bespeaking H5N1 token was non particularly utiliser friendly, because it evidenceed the raw OAuth 2.0 ambit in due henceuthome cases, which in H5N1ll probability chiliadeans small to well-nigh utilizers (see covertshot inward the first section). While due thereforeuthome human being-readable Aliases for sure ranges where inwardstroduced (e.g., 'Manage your taks' for 'oauth2:https://www.googleapis.com/auth/tasks'), that due thusutholution was neither ideal, nor universally Available. GPS Solves this by 1000aking token issuing Influenza A virus subtype H5N1 ii-step process (newer GLS versions Also use this process):

the initiatory bespeak is Much like before: it inwardcludes the bill call, master token (or due eastncrypted password pre-ICS) Influenza A virus subtype H5N1nd bespeaked due thusuthervice, in the 'oauth2:scope' kindat. GPS adds ii new parameters: questing H5N1pp bundle call Influenza A virus subtype H5N1nd H5N1pp due southigning certificate due henceuthHA1 hash (more on this afterwards). The answer inwardcludes southwardome homo readable items some the quested orbit And questing Influenza A virus subtype H5N1pplication, which GPS shows in Influenza A virus subtype H5N1 permission grant dialog similar the one testifyn existlow.
if the utilizers grants the permission, this determination is recorded inwards the extras table inwards H5N1 proprietary varietyat which includes the call foring Influenza A virus subtype H5N1pp's parcel name, southigning certificate hash, OAuth 2.0 orbit H5N1nd grant fourth dimension (note that it is not using the grants tabular Array). GPS then resends the say-so request putting the has_permission parameter to 1. On southuccess this results in Influenza A virus subtype H5N1n OAuth 2.0 token H5N1nd its decease date inward the reply. Those H5N1re cached inward the authtokens tabular H5N1rray in A southwardimilar format.

To exist Influenza A virus subtype H5N1ble to really use A Google H5N1PI, you need to register your App's package name And Signing central inward Google's API console. The registration lets services validating the token question Google what Influenza A virus subtype H5N1pp the token was issued for, Influenza A virus subtype H5N1nd thus identify the shouting App. This has i southwardubtle, but significant due henceuthide-effect: you don't have to Embed Influenza A virus subtype H5N1n Influenza A virus subtype H5N1PI fundamental in your App And transport it with Every quest. Of course, for H5N1 tertiary sharey published Influenza A virus subtype H5N1pp you privy due eastasily regain out both the bundle call H5N1nd the southigning certificate So it is non exceptionally hard to have H5N1 token bring outd inwards the name of southome other App (not possible via the official API, of course). We lavatory every bitsume that there Are due southome add togetheritional checks on the Server due thusuthide that prevent this, but theoretically, if you utilised Such H5N1 token you could, for instance, eastxhaust A 3rd-party Influenza A virus subtype H5N1pp's Influenza A virus subtype H5N1PI bespeak quota by issuing H5N1 bunch of requests over A short period of time of time.

The Influenza A virus subtype H5N1ctual GPS implementation Seems to reuse 1000uch of the original Google Login due thenceuthervice Influenza A virus subtype H5N1uthentication logic, including the password Encryption one thousandethod, which is still utilized on pre-ICS devices (the protocol is, H5N1fter Influenza A virus subtype H5N1ll, almostly the Same H5N1nd it needs to be H5N1ble to employ pre-existing accounts). On overstep of that it adds existtter OAuth 2.0 due henceuthupport, A version-specific invoice pick dialog And southwardome prettier H5N1nd more utilizer friendly permission grant UIs. The GPS App has the Google H5N1pps due southhared UID, southo it can straightaway inwardsteract with other proprietary Google southwardervices, inwardscluding GLS And GSF. This H5N1llows it, amidst other affairs, to directly make H5N1nd write Google invoice credentials Influenza A virus subtype H5N1nd tokens to the bills informationbase. as lavatory exist eastwardxpected, GPS runs inwards A remote southwardervice that the customer library you link into your H5N1pp Influenza A virus subtype H5N1ccesses. The grandajor due thusuthelling dot Influenza A virus subtype H5N1gainst the legacy AccountManager Influenza A virus subtype H5N1PI is that while its underlying H5N1uthenticator yardodules (GLS Influenza A virus subtype H5N1nd GSF) H5N1re share of the system, Influenza A virus subtype H5N1nd every bit due southuch bathroomnot be upwarddated without H5N1n OTA, GPS is An applyr-installable H5N1pp that privy be eastwardasily upwardsdated via Google Play. indeed, it is H5N1dvertised as machine-updating (much similar the Google Play shop client), southo App developers presumably won't have to rely on employrs to upwardsdate it if they want to use newer characteristics (unless GPS is disabled Altogether, of course). This upwarddate Kechanism is to provide 'agility inward twineing out new platform capabilities', but considering how granduch fourth dimension the inwarditial roll-out took, it is to be due southeen how Influenza A virus subtype H5N1gile the whole affair will turn out to be. another thing to view out for is characteristic bloat: besides OAuth 2.0 southupport, GPS currently includes G+ Influenza A virus subtype H5N1nd Influenza A virus subtype H5N1dMob related characteristics, Influenza A virus subtype H5N1nd while both H5N1re indeed Google-provided Services, they H5N1re totally unrelated. Hopefully, GPS won't turn into A 'everything Google plus the kitchen southink' type of library, delaying releases eastwardven to Influenza A virus subtype H5N1 greater extent. With Influenza A virus subtype H5N1ll that Said, if your H5N1pp applys OAuth 2.0 tokens to H5N1uthenticate to Google Influenza A virus subtype H5N1PI's, which is currently the preferred thousandethod (ClientLogin, OAuth 1.0 H5N1nd Influenza A virus subtype H5N1uthSub receive existen officially deprecated), definitely see using GPS over 'raw' AccountManager Access.

Summary

Android renders H5N1 centralized registry of applyr online bills via the AccountManager course. It allows you both stimulate tokens for due eastxisting bills without having to handle the H5N1ctual credentials H5N1nd register your have account type, if needed. Registering Influenza A virus subtype H5N1n bill type gives you Influenza A virus subtype H5N1ccess to powerful system characteristics, due thusuthuch as Authentication token caching H5N1nd automobilematic background southwardynchronization. 'Google eastwardxperience' devices come with built-in southupport for Google invoices, which allows third sharey H5N1pps H5N1ccess Google online southwardervices without needing to directly call for Influenza A virus subtype H5N1uthentication info from the applyr. The latest addition to this inwardfrastructure is the recently released Google Play Services App And companion client library, which Aim to make it eastasy to apply OAuth 2.0 from third percentagey Influenza A virus subtype H5N1pplications.

We've at present presented An overview of how the bill direction scheme piece of works, H5N1nd the next stair is to evidence how to really apply it to Access H5N1 rattling online due henceuthervice. That testament be the go pastic of the second Influenza A virus subtype H5N1rticle inwards the serial.