Thursday, February 11, 2010

Authentication

In the recent past there have been a couple of changes regarding signing in to NewsRob/Google Reader. Judging by the feedback and a couple of thousands uninstalls this is a matter very close to the heart of many NewsRob users. So let me give you some background and a glimpse in the future.

Since very recently NewsRob/Google Reader sessions didn't expire for 3rd party apps. Now the expiration is two weeks. The introduction of this new policy was accompanied by an expiration of all sessions, so that you guys had to re-login.
Also recently another change in Google Reader broke the 3rd party apps. The Google Reader team very quickly rolled back the change, but many of you were affected. You needed to login again. Sorry for that.
There is an upside of the changes though, but more one that later.

On top of that NewsRob's login functionality wasn't as resilient as one would expect. As the sessions never timed out I felt that my time were better spent on other features. Well, live and learn ;-)
Meanwhile the current V3.5.3 handles expired sessions as it should have right from the beginning. This weekend I will release V3.6. This version will also handle CAPTCHAs and allow you to optionally save your password, so that NewsRob can auto-login you when the session expires.

Now to the upside I mentioned above. Some initial testing indicates that one of the recently deployed Google Reader changes now makes the Google Reader authorization compatible with the Android 2.0 Account/Authentication API.
That means, if everything works as expected, NewsRob 3.7 will not need to ask your for your Google account's password again. Instead there is an official way where your password is kept safe and you will only be asked to authorize NewsRob to access Google services using your account. Let me repeat that, the password itself will no longer to be disclosed to NewsRob.
You're probably as happy about that as I am ;-)

It's hard to say at the moment, but I expect NewsRob 3.7 to be out mid March.

10 comments:

  1. Mariano, thanks again for developing an amazing Android application.

    Please be careful about how you implement authentication using built-in accounts on the phone. My Google Apps account has a major disconnect from my Google account even though the email address for both is the same. Basically, I want to make sure I can still use NewsRob with my Google Account once you have upgraded. If you need more details, don't hesitate to contact me.

    ReplyDelete
  2. Hey Tim.

    Thanks for the offer. I will contact you when I have a beta.

    Do you happen to have an Android 2.1 device, a N1? Because it seems that this mechanism is broken in Android 2.0/2.0.1.

    http://groups.google.com/group/android-developers/browse_thread/thread/d8b444e099837e42

    ReplyDelete
  3. Nope, I've got the Motorola Droid, 2.0.1

    ReplyDelete
  4. It doesn't look good then ;-( (see link above)

    Well, 2.1 should roll out for Droids soon.

    ReplyDelete
  5. I cannot wait for 2.1 on my Droid! I'm already running the launcher, news & weather widget, gallery and one other app from 2.1. The launcher/home screen is nice but a bit buggy and slower then Droid default.

    ReplyDelete
  6. i just downloaded NewRob 3.9.2 on Droid Incredible and it's asking me to enter login/password for google reader. Is info being sent to newsrob?

    ReplyDelete
  7. Hey Ryan,

    no, it's not sent to Google Reader, it's not using the Android 2.0 authentication also though.

    I am currently on vacation on a very, very low bandwidth connection and can't search the blog, but you can find more about it on a release note on the blog and on the mailing list.

    Short story: Still sending credentials via SSL to google.com, hoping for better official support on Android, otherwise will likely implement OAuth, which is very inconvenient, but more secure. Don't expect anything really soon. I wasted a lot of time on the Android 2.0 authentication and will now focus on features for the time being.

    Cheers,
    Mariano

    ReplyDelete
  8. Hi Mariano,

    Thank you for your great app. I wanted to ask you if you know why the multitouch zoom is not working when reading the full articles. In fact, I thought your app called the default web browser.
    I am using the trial on HTC Desire running 2.1.

    Thank you.

    Juanan

    ReplyDelete
  9. Hi Antron.

    For the moment Multitouch only works when you have the hovering zoom controls enabled. I am not aware of any way to tell the underlying WebView to do either/or, but just both together.

    Hopefully Gingerbread will add more flexibility here (or I learn that there is something else I can do),

    Cheers,
    Mariano

    ReplyDelete