Update! 3 months after I published this post, Google updated their app

For two-and-a-half years, Google hasn't touched their 2FA app's code. Perhaps it is perfect? Perhaps there are no more UI improvements or security enhancements that can be done? Or, more likely, it joins a long graveyard of Android apps - launched optimistically and then abandoned.

I get it, not every product you release is a winner. And some have to be shuttered gracefully. But Google Authenticator is special. It is trusted to protect users' accounts. Not just Google accounts - thousands of providers specifically recommend it.

Kathryn Corrick

@kcorrick

.@Xero Thoughts please, as I think the only 2FA offered is Google Authenticator for your service? Should customers be concerned? What do you suggest to ensure customer and account security until this is fixed?

Charlie Osborne

@SecurityCharlie

Android malware can steal Google Authenticator 2FA codes dlvr.it/RQr43X pic.x.com/8fdqpwsdic

---

---

Sure, you and I know that any OTP app will work. But Google spend a lot of money on branding - and organisations use that to signal trust to their users.

Frankly, Android Authenticator is too important to be neglected like this.

Open Source

The Authenticator app is open source. But comes with this delightful disclaimer:

While this fork is open source, the official version of the app still remains proprietary. There is no guarantee that the open source repository will receive any changes made upstream (or vice versa).

Despite multiple bugs being filed, no one is fixing them. Occasionally users are told that an internal Google ticket has been raised - and then silence.

As I mentioned last year, I've switched to andOTP. It's open source, and actively being developed and improved.

Final thoughts

It's OK to stop developing software. It's OK to decide that your limited resources are best spent elsewhere.

It's not OK to heavily promote an open security standard, convince people to rely on your proprietary app, and then abandon it.

Bonus Content For Patreon Subscribers!!!!!

Here's a quick look through all of Google LLC's currently published Android Apps. I've highlighted any which haven't been updated in over 12 months. That seems like an appropriate cut off for abandonment.

I'm sure there are some I've missed - and there are loads more which are coming up for their one-year anniversary.

So this is how I solved an annoying problem - how to get the name of a custom slot.

Here's the code, with a fuller explanation afterwards.

from flask import Flask, render_template, request
from flask_ask import Ask, statement, question, session
app = Flask(__name__)
ask = Ask(app, '/')

@ask.intent("YourIntentName")
def your_intent_name():
    content = request.get_json()
    name = content['request']['intent']['slots']['YOUR_SLOT_NAME']['resolutions']['resolutionsPerAuthority'][0]['values'][0]['value']['name']

Yeuch! What's going on?

Alexa lets us define custom slot names - these can be associated with any spoken text. For example, I might want the slot name "car" to be sent whether the user says "car" or "automobile" or "vehicle" or any other synonym.

In my case, I want to send my API the ID Code of a hospital.

If the user says "John Radcliff" or "Oxford" or "John Radcliff Hospital" - then my API should receive the ID RTH08. It can then use that ID in a separate API call.

Here's the JSON that Alexa sends our API (I've truncated it for ease of reading).

{
    "request": {
        "type": "IntentRequest",
        "requestId": "amzn1.echo-api.request.1234",
        "timestamp": "2019-06-17T06:54:52Z",
        "locale": "en-GB",
        "intent": {
            "name": "CarPark",
            "confirmationStatus": "NONE",
            "slots": {
                "hospital": {
                    "name": "hospital",
                    "value": "John radcliff",
                    "resolutions": {
                        "resolutionsPerAuthority": [
                            {
                                "authority": "amzn1.er-authority.echo-sdk.amzn1.ask.skill.1234.hospitals",
                                "status": {
                                    "code": "ER_SUCCESS_MATCH"
                                },
                                "values": [
                                    {
                                        "value": {
                                            "name": "RTH08",
                                            "id": "abc123"
                                        }
                                    }
                                ]
                            }
                        ]
                    },
                }
            }
        }
    }
}

A bit verbose, but easy enough to parse.

I've moaned before about Alexa skill development - but it is getting worse. As you can see from the above screenshot, the development website's contrast isn't great - which makes building a skill physically painful.

Add to that the outdated tutorials, the weird terminology, the multiple sites to use, broken links, and abandoned libraries... It's hard to feel enthusiastic about building more skills.

Amazon have gone down the classic route of paying developers to build for their platform. But I don't think that's enough.

The Alexa team need to work on the developer experience. A GUI like NODE-RED could be used to help build skills in one place. Why is it so complicated to deploy and test skills? Where are the official libraries which "just work"?

I honestly believe that one of the things holding back voice assistants from their full potential is the poor developer experience.

I flatter myself as a reasonably competent techie and programmer, but fuck me AWS Lambdas and Alexa skills are a right pile of shite! Sorry if that sounds a bit harsh, but they're a pain in the arse to get anything done.

I wanted something simple. When I say "Solar Panels", call this API, then say this phrase. That's the kind of thing which should take 5 minutes in something like IFTTT. Instead, it took around two hours of following out-of-date official tutorials, and whinging on Twitter, before I got my basic service up and running.

A quick bit of preparatory searching on Alta Vista 2.0 and I'd got incredibly frustrated.

Terence Eden is on Mastodon

@edent

Does anyone have an EASY tutorial for Alexa skills?
As in, not 27 steps where step 5 just says "install node" & 26 says "see other tutorial"

---

I ended up following this "easy" 30 step guide to develop a basic skill.

It's not so bad, but it does reveal Amazon's contempt for developers. Several of the steps contained errors, it involves multiple logins, random clicks, and a bunch of copy & pasting. Dull and complex.

Terence Eden is on Mastodon

@edent

Replying to @edentBrilliant! AWS picked up the wrong address from my Amazon UK account. How?
It also wouldn't copy across my credit card details! Why?

---

Terence Eden is on Mastodon

@edent

Replying to @edentThe cloud is everywhere!
The cloud is nowhere!
The cloud loves you!
The cloud knows all!
The cloud only works in specific US locations! pic.x.com/15dibbda0v

---

A frustrating and ultimately unsatisfying experience. I ended up using StackOverflow to correct errors in my code because the documentation was so woefully lacking.

The Code

The Python is convoluted, but manageable. When it hears the trigger phrase it opens a JSON API, extracts a result, then speaks it. It's mostly scaffolding. This is based on the example code. I've removed the comments.

from __future__ import print_function
import json, requests

# --------------- Helpers that build all of the responses ----------------------
def build_speechlet_response(title, output, reprompt_text, should_end_session):
    return {
        'outputSpeech': {
            'type': 'PlainText',
            'text': output
        },
        'card': {
            'type': 'Simple',
            'title': "SessionSpeechlet - " + title,
            'content': "SessionSpeechlet - " + output
        },
        'reprompt': {
            'outputSpeech': {
                'type': 'PlainText',
                'text': reprompt_text
            }
        },
        'shouldEndSession': should_end_session
    }


def build_response(session_attributes, speechlet_response):
    return {
        'version': '1.0',
        'sessionAttributes': session_attributes,
        'response': speechlet_response
    }

# --------------- Functions that control the skill's behavior ------------------
def get_welcome_response():
    API_url = 'https://example.com/'
    response = requests.get(url=API_url)
    data = json.loads(response.text)
    watts = data['Body']['Data']['PAC']['Values']['Result']
    session_attributes = {}
    card_title = "Welcome"
    speech_output = "Your Solar Panels are generating " + str(watts) + " watts right now."
    reprompt_text = ""
    should_end_session = True
    return build_response(session_attributes, build_speechlet_response(
        card_title, speech_output, reprompt_text, should_end_session))

def handle_session_end_request():
    card_title = "Session Ended"
    speech_output = "May your day be sunny and bright! "
    should_end_session = True
    return build_response({}, build_speechlet_response(
        card_title, speech_output, None, should_end_session))

# --------------- Events ------------------
def on_session_started(session_started_request, session):
    print("on_session_started requestId=" + session_started_request['requestId']
          + ", sessionId=" + session['sessionId'])

def on_launch(launch_request, session):
    print("on_launch requestId=" + launch_request['requestId'] +
          ", sessionId=" + session['sessionId'])
    return get_welcome_response()

def on_intent(intent_request, session):
    print("on_intent requestId=" + intent_request['requestId'] +
          ", sessionId=" + session['sessionId'])
    intent = intent_request['intent']
    intent_name = intent_request['intent']['name']

def on_session_ended(session_ended_request, session):
    print("on_session_ended requestId=" + session_ended_request['requestId'] +
          ", sessionId=" + session['sessionId'])

# --------------- Main handler ------------------
def lambda_handler(event, context):
    print("event.session.application.applicationId=" +
          event['session']['application']['applicationId'])
    if event['session']['new']:
        on_session_started({'requestId': event['request']['requestId']},
                           event['session'])
    if event['request']['type'] == "LaunchRequest":
        return on_launch(event['request'], event['session'])
    elif event['request']['type'] == "IntentRequest":
        return on_intent(event['request'], event['session'])
    elif event['request']['type'] == "SessionEndedRequest":
        return on_session_ended(event['request'], event['session'])

This is not AI

I kinda thought that Amazon would hear "solar panels" and work out the rest of the query using fancy neural network magic. Nothing could be further from the truth. The developer has to manually code every single possible permutation of the phrase that they expect to hear.

This isn't AI. Voice interfaces are the command line. But you don't get tab-to-complete.

Amazon allow you to test your code by typing rather than speaking. I spent a frustrating 10 minutes trying to work out why my example code didn't work. Want to know why? I was typing "favourite" rather than the American spelling. Big Data my shiny metal arse.

Why not IFTT?

So, there is an official If-This-Then-That channel for Alexa.

But like most IFTTT services, it isn't well supported by the company. It works with a few blessed services, but you can't bring in your own APIs, nor define your own responses.

It is barely tested and has all sorts of weird restrictions.

Here's a tip, gang, if your service can't cope with upper-case characters that means it isn't ready to release to the public.

The founder of SaySpring recommended their easy to use product:

Stacey Higginbotham

@gigastacey

This entire thread is killing me. Especially in light of Amazon's press about Alexa being easy as it's competitive differentiator. x.com/edent/status/8…

Terence Eden is on Mastodon

@edent

Does anyone have an EASY tutorial for Alexa skills?
As in, not 27 steps where step 5 just says "install node" & 26 says "see other tutorial"

---

---

Mark C. Webster

@markcwebster

Replying to @gigastacey@gigastacey @edent this is what we're working on at @sayspring. We're just getting started, but take a look.

---

Sadly, it's only available to US customers.

Driving me dotty

I reluctantly got a Dot because I thought it would be a nifty way to control my new Internet connected light switches.

Most Alexa skills require you to have the sort of lifestyle where you are regularly desperate to know what the weather is like at a specific airport. Or have a life which is intimately tied to the range of Amazon-only services.

Taking a look through what developers have released, it's an obvious conclusion that most developers have better things to do that spend time battling with Amazon's inadequate developer experience.

Oh, and there's the requisite "fart apps" and other high quality services;.

The future may be voice interfaces - but Amazon aren't leading the way there.

I was paid $50 for my opinion - in Amazon vouchers. I hope this hasn't comprimised the honesty of my answers.

These are just my thoughts - I can't claim that they would solve RIM's problems, but I do think they would be a good way to help reclaim developer mindshare.

What are the main reasons why you are not planning to develop applications for the Blackberry 10 platform?

1. Platform won't be available until 2013!
2. Probably no Linux platform.
3. Tiny marketshare unless majority of phones are upgradeable.
4. Can't get any reference hardware / emulators to test on.
5. Have to learn yet another development language! I know Java, ObjC, JS, C# - I really can't be bothered to learn another. I tried using JavaScript on the PlayBook and it wasn't a great success.
6. Finally, and I hate saying this because I've had BB's since the the black and white days, will BB10 ever come out? Will there even be a BlackBerry.

What specific things could the Research in Motion developer relations team do or communicate that would make you more likely to develop applications for the Blackberry 10 platform?

1. Linux based SDK and toolkit. I'm not buy a Mac or a copy of Windows just for you!
2. Remove the ridiculous signing requirements. I don't want to have to use your signing server - especially with its atrocious uptime.
3. Provide high quality, open source programs which we can build on. I don't want to have to start from scratch.
4. Developer incentives. Microsoft are literally paying some developers to develop. Nokia are giving out hardware. Google already have great mindshare and yet still give out thousands of dollars of goods to devs. Reference hardware would be really useful. Paying me market rate for for several weeks development would be nice. Running competitions is a waste of time.
5. Turn up at hackdays. I attend - and I'm not exaggerating - 100 developer events a year. BlackBerry rarely turn up. When they do, they do a presentation, give hardware out as a prize, and then disappear. They need to stay, teach people, talk through their concerns, offer prizes for software developed specifically for RIM.
6. Don't offer money. (I realise this contradicts the above!) Most developers can afford a phone, a kindle, or most prizes. Offer us things we can't buy. Promotion in the app store, a meeting with your investors, a UI consultation with your best team, business advice from your CEO! The sort of stuff we can't get elsewhere.
7. FIGHT THE FUCK BACK! Seriously - no one wants to go invest in a platform which looks like it's losing. I don't know how you do that - but make it convincing!