Password Management on Mobile Platforms: Android vs iOS

Account sign-up and sign-in is critical because that’s what creates friction for users. It may be necessary for the developer to collect information such as email addresses, phone numbers, and passwords but for users having to type such information in is a tedious task.

Google’s Smart Lock for passwords

Google takes a dual approach to the matter: first, it has a neat but underrated and underused feature called Smart Lock for Passwords, which allows users to sign in with their saved passwords on different devices. Smart Lock syncs a user’s passwords to their Google Account when they are signed in with Chrome or Android. This means that this solution is available on all major platforms, as long as Google’s Chrome browser is used across the board.

The feature – codenamed YOLO or You Only Login Once – is available on pre-Marshmallow devices and is actually the precursor of the autofill feature announced with Android Oreo and was improved with new releases.

The OpenYOLO protocol

Unfortunately, only a handful of apps – such as Netflix, Waze and Fitbit – have added support for YOLO, limiting its reach and therefore its usefulness. Third-party services such as Dashlane, however, have quickly spotted a good opportunity to take this to the next level. It started working with Google to develop a protocol that combines all of the advantages of YOLO with third-party password management services. The open source project, branded as OpenYOLO, resulted in an API that was made available in mid-2016, with password managers such as 1Password and LastPass announcing integration a year later.

What does this mean in terms of user experience? Logging into mobile apps and on the web has become much easier because apps and browser extensions will allow the chosen password managers to fill in user credentials for truly frictionless user authentication. However, for that to happen developers need to support this protocol in their Android apps.

Google’s autofill

Google’s second approach is autofill. The launch of Android Oreo included an autofill API that allowed for the system-wide filling of details such as account info, credit card details, and postal addresses. Still, to make it work properly, password management services such as Dashlane had figure out a workaround. Google eliminated that need with Android P and continues to make further developments to ease the integration of autofill.

With iOS 12 Apple takes this feature a bit further. It is based on the password lautofill for apps feature introduced with iOS 11, which allows users to log into apps by showing them their credentials in the QuickType bar. In iOS 12, however, third-party passwords managers that have been approved by Apple on the App Store can provide information to autofill.

Along with the login process, Apple has also taken steps to ease the hassle of signing up. When creating a new account, users will get a prompt in the QuickType bar suggesting a usernameand an automatically generated strong password to go with it. By doing so, the username and password creation becomes a frictionless experience, allowing users to quickly create new logins and save the credentials in iCloud Keychain without any effort on their part.

Also, if a user has activated two-step verification and therefore requires a security code to be sent via SMS to authenticate the account, iOS 12 will identify it from within the Messages app and display it in the QuickType bar, meaning the user only needs to tap on the string to complete the login.

Conclusion

Both Apple and Google have taken important steps to ease the login process for their users. The most popular mobile operating system, Android, still has some work to do in this regard, but it is making good progress. The OpenYOLO protocol is a huge step towards an enhanced and streamlined user experience because it allows users to pick their favorite password manager, while Smart Lock is a neat cross-platform solution. All it needs is to be adopted by a wider selection of apps.

In an interesting move, Apple now allows third-party services to provide information with autofill and iOS saves user credentials when signing up for an app as well, not only on the web. While the security code insertion feature opens up questions about potential security vulnerabilities, it is still a nice feature that streamlines the authentication process.