OpenYOLO Update, and steps towards Final Specification

[Iain McGinniss]

Hello all,

We are very grateful for the support so far in pushing OpenYOLO for Android towards an implementer's draft. I am in Paris working with Dashlane this week, and we would like to understand better what the steps are towards a Final Specification. I would like to see this happen before the end of the year, but of course this is contingent on positive feedback from partners implementing OpenYOLO in their apps and credential managers.

So far, I have seen working implementations from AgileBits, Dashlane and Google. The Dashlane implementation is already available in production, and the Google implementation will be available on all Android devices with Play Services by August. AgileBits will likely land their implementation around the same time (at least, that's my current understanding). I've not heard from Keeper or LastPass for a while; I'll follow up with them separately.

Over the next few months I will be reaching out to existing Smart Lock for Passwords customers to solicit interest in the new API, and will be working with Dashlane and AgileBits to also find new interested parties to implement OpenYOLO in their apps.

Other pending pieces of work:

- Publish the demo app I wrote for CIS 2017.

- Publish simpler, use-case-specific example apps for password retrieval, account hints, etc.

- Iterate on and finalize the OpenYOLO API, which currently lives outwith the specification (which focuses on the protocol).

- Publish a draft extension to OpenYOLO to solicit ID tokens as part of the flow. Currently only Google can provide usable ID tokens via the API, and I would like to open up this part of the process too.

- Work with David Samuelson at Google and Stan Kochen at Dashlane to publish an "extended claims" protocol, in order to provide addresses, credit card numbers and other information useful for sign-up.

Exciting times!

Iain