Android 15s Contact Keys is a step towards Apple-like protection from cybe

[phillynews215]

Credit: Robert Triggs / Android Authority

• Android 15 introduced a new API to facilitate end-to-end encryption in apps. The Contact Keys Manager API gives users a centralized way to manage and verify their contacts public keys.
• The latest Google Play Services beta update contains hints that showcase how this Contact Keys feature will work.
• Apple introduced a similar feature called Contact Key Verification with iOS 17.2, which also features automatic notifications and other extras.

Android 15s first beta introduced a new E2eeContactKeysManager API, which is said to facilitate end-to-end encryption (E2EE) in Android apps by providing an “OS-level API for the storage of cryptographic public keys.” Google notes that the API is designed to integrate with the “platform contacts app” to give users a “centralized way to manage and verify their contacts public keys.” We now have some more info on how the user-facing elements will work for Contact Keys, potentially building up Android as a better competitor against Apple for sophisticated cyberattacks.



While Android 15 introduced the API, Google Play Services will handle the functionality related to Contact Keys. Weve spotted new activities and strings in the latest Google Play Services beta that give us a clue about how the feature will work.

Starting off with the activities, weve spotted three of them within Play Services: one for onboarding, one for showing the QR code, and one for scanning the QR code.



Next, we found plenty of strings, which help us piece together how the feature could work:

Scan codeShow codeScan the QR code on this contact's phone. This will confirm encryption between your phones for all end-to-end encrypted apps. To do this, they'll need to open the Google Contacts app > Contacts settings > Your info.Confirm end-to-end encryptionNo keys to verify.Show numbersAsk this contact to scan your code here, which you can also access from Contacts Settings > Your Info. You can also compare the app specific numbers instead.Error starting key verification, no contact specifiedAs we can learn from the strings, the Contact Keys feature will rely heavily on the Google Contacts app for its UX. Users who want to confirm that all their E2E apps are actually encrypted can scan the QR code present on the other persons Google Contacts app. Alternatively, the strings hint that you could also compare the app-specific numbers instead to reassure yourself about the encryption status.

Apple has a similar feature on iOS called Contact Key Verification, which was added in iOS 17.2. Contact Key Verification lets you receive automatic alerts that help verify that you are communicating only with the people you intend to communicate with. By verifying the encryption status, you can reassure yourself that you are not being targeted by any sophisticated cyber attack.



Contact Key Verification on iOS 17.2
Credit: Apple


If you want to learn more, Apples security blog post goes into more detail about Contact Key Verification.

We expect Googles Contact Keys to be on similar lines, albeit at an earlier stage of progress. The strings dont indicate any automatic messages being sent out like you can with iMessage Contact Key Verification. This can change for the better in the future, but its still a good step forward in its current form.








More...