Is OpenYOLO dead?

David3879

Hey guys,

I noticed the OpenYOLO repo has not been touched in two years and I cannot find any recent news/threads on this topic. Do you still use OpenYOLO? Did it just fail to get adoption? I thought it was a good idea and would like to know what 1Password is doing with it these days.

https://github.com/openid/OpenYOLO-Android

Thanks!

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

mverde

Hi @David3879 and thanks for reaching out to us with your question! Like you, I thought OpenYOLO was a good idea when we first got involved with it, and in many ways I still do. The project created an open protocol for applications to request login credentials from credential providers and our hope was that it would address a distinct need for facilitating that kind of communication between apps.

When compared with the Autofill framework that was added in Android 8, the OpenYOLO protocol has the advantage of being very deterministic, in that the requesting app can specify exactly which details it is wanting to retrieve from the credential provider. With the Autofill framework, there is no request for credentials coming from the active app. Instead, the onus is on the Autofill provider to interpret the views currently displayed in the active app using heuristics to determine whether to offer to provide credentials. As you might imagine, with heuristics there is plenty of opportunity to interpret things incorrectly.

The main disadvantage that OpenYOLO faced when compared to Autofill is that it required developers to adopt it. While I wouldn't say that it is a lot of work to integrate OpenYOLO into your app, it does require some non-trivial decisions about user experience and a handful of lines of code to be written. This is compared to the little to no effort required for app developers to support Autofill (since the onus is almost entirely on the Autofill provider).

There are a couple of factors that have stalled active development on OpenYOLO. The first is that it seems that the disadvantage I mentioned above has won out over the advantage, and adoption of OpenYOLO remains relatively low. The second is that in order for OpenYOLO to truly succeed, SmartLock for Passwords needed to be reimplemented on top of OpenYOLO so that any apps that already supported SmartLock would automatically work with OpenYOLO credential providers in addition to Google. Unfortunately, this didn't happen.

While 1Password for Android does still support OpenYOLO in the current version, I don't foresee any additional development work being done on it without either of the two factors above changing. I know that's probably not the answer you were hoping for, but I hope that gives you some insight into where things currently stand. Please let me know if you have any follow-up questions!

David3879

@mverde Excellent response! That was super informative and helped me understand some advantages of OpenYOLO over the Autofill Framework that I had not understood before... I do not have any follow-up questions at this time. Thanks for the great information!

peri

@David3879 I'm glad mverde was able to help! :)