Android gets ‘System Key Verifier’ app to authenticate users during chatting

The Android OS ecosystem has received a new “System Key Verifier” app. This system-level service helps Android device users establish and authenticate the identity of the person they are chatting with.

‘System Key Verifier’ app for Android rolled out via a Google Play Store update

Google helps protect messages with end-to-end encryption (E2EE). Messages secured with E2EE could be intercepted, but they cannot be read (deciphered) by bad actors. Google recently added that RCS E2EE between Android and iOS is in the works.

Although E2EE exists in several apps and services, it is difficult to truly establish or confirm the identity of the person at the other end. Several online accounts regularly get hijacked. Hackers use these compromised accounts to scam other people that are in the contact list of their victims.

To help ensure there’s a genuine contact and not a malicious actor at the other end, Google has released a new app called “Android System Key Verifier”, which is included in a Google Play Store update. It lets Android users verify if the person on the opposite side is the one they are texting. The app will work on Android 10 and later.

How does the new system-level app help establish identity?

First spotted by Mishaal Rahman, Google has now rolled out the Android System Key Verifier app. The company included the system-level app in last week’s Google Play System update. According to the release notes, the Android System Key Verifier app “lets developers store end-to-end encryption keys.”

It is highly likely the app uses the Contact Keys feature. In other words, it could be similar to the Contact Key Verification present in iOS. This system-level app displays a warning in the Apple Messages app when an unrecognized device gets added to a contact. Tapping on the warning allows users to use an alternate number to verify with the person either offline or via voice.

Alternatively, the app can verify devices when one of the parties shares and scans the other person’s QR code. This creates a key on that device, which can be authenticated. Needless to say, this associates the device with the contact that the user has created. Google advises both users should scan the other’s QR code to verify both the devices.

In the future, if a different device is used, the synced keys won’t match. This could indicate the person chatting might not be the actual contact. This could also mean they are using a new device to chat, which would necessitate scanning the QR code again.

Android System Key Verifier (Google Play Store)