Tag Archives: Android

Project Fi welcomes Android One, with the moto x4

With Project Fi, we set out to make your wireless experience fast, easy and fair—with access to three national 4G LTE networks, and international roaming at no extra cost. But many of you have asked us for more options for high quality, affordable devices that work with Project Fi. We've heard you and we're excited to launch our newest phone for Project Fi: the Android One moto x4.

We took some important steps with Android One earlier this month by expanding the program to bring a fresh, secure software experience designed by Google to more high-quality devices no matter the price point. The launch of Android One moto x4 on Project Fi is the next step in our commitment to work with more partners and expand Android One to new places.



Packed with a pure Android experience, advanced hardware and great network connectivity, here’s a closer look at what you’ll get with the new Android One moto x4.

Best-in-class software experience designed by Google

Like all Android One phones, Android One moto x4 runs a pure Android experience, with a clean software design and a carefully curated set of preinstalled apps to give you just what you need. For example, it comes optimized for the Google Assistant to help you get more done, and offers high-quality video calling with Google Duo. You’ll also get access to the latest updates from Android, such as Android Oreo before the end of the year. Android One moto x4 will be among the first to receive an upgrade to Android P.


Powerful cameras and unlimited high-quality photo storage

The Android One moto x4 comes with three cameras. A 12MP + 8MP dual rear camera system lets you capture wide-angle photos and detailed portraits. The front-facing camera comes packed with 16MP and an adaptive low light mode. And with free high quality storage from Google Photos, you never have to worry about running out of space.


All day battery and ultra-fast charging

Power through the day and enjoy your favorite Android software features like battery saver. When you need to recharge, TurboPower™ charging makes it ultra fast: You can get up to six hours of power in just 15 minutes.


Top of the line security

The Android One moto x4 will receive timely security updates and built-in malware protection from Google Play Protect, working around the clock to keep your device, data and apps safe.


The Android One moto x4 is priced at $399, comes in Super Black and Sterling Blue, and is available only in the U.S. on Project Fi’s network. You can pre-order it on the Project Fi website starting today. If you've got an older Nexus phone and want to trade it in for a new device, we're making it easier than ever with our new trade-in program. We’ll give you up to $165 for select Nexus devices, and if you start your trade-in for an Android One moto xby October 5, you’ll earn an extra $50 Fi credit.

Project Fi welcomes Android One, with the moto x4

With Project Fi, we set out to make your wireless experience fast, easy and fair—with access to three national 4G LTE networks, and international roaming at no extra cost. But many of you have asked us for more options for high quality, affordable devices that work with Project Fi. We've heard you and we're excited to launch our newest phone for Project Fi: the Android One moto x4.

We took some important steps with Android One earlier this month by expanding the program to bring a fresh, secure software experience designed by Google to more high-quality devices no matter the price point. The launch of Android One moto x4 on Project Fi is the next step in our commitment to work with more partners and expand Android One to new places.



Packed with a pure Android experience, advanced hardware and great network connectivity, here’s a closer look at what you’ll get with the new Android One moto x4.

Best-in-class software experience designed by Google

Like all Android One phones, Android One moto x4 runs a pure Android experience, with a clean software design and a carefully curated set of preinstalled apps to give you just what you need. For example, it comes optimized for the Google Assistant to help you get more done, and offers high-quality video calling with Google Duo. You’ll also get access to the latest updates from Android, such as Android Oreo before the end of the year. Android One moto x4 will be among the first to receive an upgrade to Android P.


Powerful cameras and unlimited high-quality photo storage

The Android One moto x4 comes with three cameras. A 12MP + 8MP dual rear camera system lets you capture wide-angle photos and detailed portraits. The front-facing camera comes packed with 16MP and an adaptive low light mode. And with free high quality storage from Google Photos, you never have to worry about running out of space.


All day battery and ultra-fast charging

Power through the day and enjoy your favorite Android software features like battery saver. When you need to recharge, TurboPower™ charging makes it ultra fast: You can get up to six hours of power in just 15 minutes.


Top of the line security

The Android One moto x4 will receive timely security updates and built-in malware protection from Google Play Protect, working around the clock to keep your device, data and apps safe.


The Android One moto x4 is priced at $399, comes in Super Black and Sterling Blue, and is available only in the U.S. on Project Fi’s network. You can pre-order it on the Project Fi website starting today. If you've got an older Nexus phone and want to trade it in for a new device, we're making it easier than ever with our new trade-in program. We’ll give you up to $165 for select Nexus devices, and if you start your trade-in for an Android One moto xby October 5, you’ll earn an extra $50 Fi credit.

Source: Android


Google Play Billing Library 1.0 released

Posted by Neto Marin, Developer Advocate

In June we announced the developer preview for a new Google Play Billing Library. Today, we are pleased to announce the official release of the Play Billing Library 1.0. This library simplifies the development process for Google Play Billing, allowing you to focus your efforts on your app.

Thank you for your valuable feedback and suggestions that helped us reach the 1.0 release. Watch the video below for a quick overview of the library's features.

Before you start

With Play Billing, you can receive payments from users around the world via a payment system they trust and you can take advantage of features and reports in the Play Console to manage and earn more revenue.

If you have never implemented in-app billing in your apps, or you want to know what you can offer using Play Billing Library, read the In-app Billing Overview to familiarize yourself with concepts and terminology that make it easier for you to implement In-app Billing using the Play Billing Library.

Getting started

Play Billing Library is available through Maven repository, and adding Play Billing Library to your project is simple as adding the following dependency into your app's build.gradle file:

dependencies {
    ...
    compile 'com.android.billingclient:billing:1.0'
}

The Play Billing Library 1.0 automatically adds the com.android.vending.BILLING permission to your APK. This means you no longer need to manually include it in your application module's manifest.

BillingClient and PurchasesUpdatedListener

These classes are the most important pieces when integrating the library into your Android app. The BillingClient is the bridge between your app and Google Play. You will use it for listing available products, starting the billing flow for in-app products or subscriptions (i.e. opening the payment interface), getting user purchases, and creating or modifying subscriptions.

When creating your BillingClient instance, you'll need to set a PurchasesUpdatedListener. This allows your app to receive updates from the In-app Billing API, including transaction results after the billing flow, as well as purchases completed outside of your app, e.g. user redeemed a Promo Code or bought a product on another device.

The following code demonstrates how you could override the )">onPurchasesUpdated() method of your PurchasesUpdatedListener:

@Override
void onPurchasesUpdated(@BillingResponse int responseCode,
        List<Purchase> purchases) {
    if (responseCode == BillingResponse.OK
            && purchases != null) {
        for (Purchase purchase : purchases) {
            handlePurchase(purchase);
        }
    } else if (responseCode == BillingResponse.USER_CANCELED) {
        // Handle an error caused by a user canceling the purchase flow.
    } else {
        // Handle any other error codes.
    }
}

You can implement the PurchasesUpdatedListener in your Activity or in any other class you want, according to your app's architecture. And here's the code for creating the BillingClient instance, and setting the PurchasesUpdatedListener:

mBillingClient = BillingClient.newBuilder(mContext)
                              .setListener(mPurchasesUpdatedListener)
                              .build();

Listing and selling products

To sell products in your app, first, you need to add them using the Play Console. For more details about how to add in-app products see the page Administering In-app Billing.

Attention: If this is a brand new app, before adding the products you must publish it to the alpha or beta distribution channel. For more information, see Draft Apps are No Longer Supported.

To get a list of product details with prices for current user, call , com.android.billingclient.api.SkuDetailsResponseListener)">querySkuDetailsAsync(). You must also specify a listener which implements the SkuDetailsResponseListener interface. You can then override the onSkuDetailsResponse() method which notifies the listener when the query finishes, as illustrated by the following sample code:

List<String> skuList = new ArrayList<> ();
skuList.add("premiumUpgrade");
skuList.add("gas");
mBillingClient.querySkuDetailsAsync(SkuType.INAPP , skuList,
    new SkuDetailsResponseListener() {
        @Override
        public void onSkuDetailsResponse(SkuDetailsResult result) {
            // Process the result.
        }
    })

After the user chooses a product to buy, you'll need to start the billing flow and handle the transaction result. To start a purchase request from your app, call the launchBillingFlow() method on the Play Billing Library client. You must call the launchBillingFlow() method (and all the other methods from BillingClient) from the UI thread.

The launchBillingFlow() method needs BillingFlowParams object that contains relevant data for completing the purchase, such as the product ID of the item to purchase and the product type (in this case, SkuType.INAPP). To get an instance of BillingFlowParams, construct it with newBuilder() method:

BillingFlowParams.Builder builder = BillingFlowParams
                                       .newBuilder()
                                       .setSku(skuId).setType(SkuType.INAPP);
int responseCode = mBillingClient.launchBillingFlow(builder.build());

As we mentioned earlier, the transaction result will be sent to the )">onPurchasesUpdated() method. For details how to process the data received on )">onPurchasesUpdated() and how to handle a purchase, check the section Purchase an item in our training guide.

Consuming products

By default, all in-app products are managed. It means that Google Play tracks the product ownership and doesn't allow to buy multiple times. To be able to buy a product again, you must consume the product before it becomes available again.

It's common to implement consumption for in-app products which users may want to purchase multiple times, such as in-game currency or equipment. You typically don't want to implement consumption for in-app products that user purchases once and provide a permanent effect, such as a premium upgrade.

To consume a product, call the consumeAsync() method on the Play Billing Library client and pass in the purchaseToken String value returned when you made the purchase. The consumption result is returned via onConsumeResponse() method of the ConsumeResponseListener interface, that you must override to handle the consumption result.

The following example illustrates consuming a product using the associated purchaseToken:

ConsumeResponseListener listener = new ConsumeResponseListener() {
    @Override
    public void onConsumeResponse(@BillingResponse int responseCode, 
                                  String outToken) {
        if (responseCode == BillingResponse.OK) {
            // Handle the success of the consume operation.
            // For example, increase the number of player's coins,
            // that provide temporary benefits
        }
    }
};
mBillingClient.consumeAsync(purchaseToken, listener);

Sample updated: Trivial Drive V2

With a new library comes a refreshed sample! To help you to understand how to implement in-app billing in your app using the new Play Billing Library, we've rewritten the Trivial Drive sample from the ground up.

Since we released Trivial Drive back in 2013, many new features, devices, and platforms have been added to the Android ecosystem. To reflect this evolution, the Trivial Drive v2 sample now runs on Android TV and Android Wear.

What's next?

Before integrating within your app, you can try the Play Billing Library with the codelab published during Google I/O 2017: Buy and Subscribe: Monetize your app on Google Play.

In this codelab, you will start with a simplified version of Trivial Drive V2 that lets users to "drive" and then you will add in-app billing to it. You'll learn how to integrate purchases and subscriptions as well as the best practices for developing reliable apps that handle purchases.

Get more info on the Play Billing Library and the official reference for classes and methods documentation on the Android Developers website. For a step-by-step guide to implementing the Play Billing Library in your project, visit the library's training class.

We still want your feedback

If you have issues or questions, file a bug report on the Google Issue Tracker, and for issues and suggestions on the sample (like a bug or a new feature), contact us on the Trivial Drive issues page.

For technical questions on implementation, library usage, and best practices, you can use the tags google-play and play-billing-library on StackOverflow or visit the communities on our Google+ page.

Android Things Hackster Contest

Posted by Dave Smith, Developer Advocate for IoT

Android Things lets you build professional, mass-market products on a trusted platform, without previous knowledge of embedded system design. With Android Things you get a turnkey hardware solution and an easy-to-use software development platform based on Android Studio and the Android SDK -- making it easy to build designs that scale to production. Android Things is currently in developer preview and we'd love to see what you can build with our latest release.

Today we are announcing a contest with Hackster and NXP for developers to showcase their use of Android Things with other Google developer platforms. Project ideas should be added to Google's Hackster.io Community by including Android Things as a software component, then registered through the contest page.

Idea Submissions

Submit your project ideas starting today. Ideas submitted by September 29, 2017 are eligible to receive one of 120 Pico Pi i.MX6UL Kits to use in the final design. During this phase, projects do not need to be complete; we just want to see your amazing ideas! We are looking for concepts in the following categories:

  • Smart Home
  • Robotics
  • Smart City
  • Industrial IoT / Manufacturing
  • Retail
  • Entertainment

Project Submissions

Final projects must be submitted by Oct 31, 2017. Your project does not need to be one of the chosen recipients of a Pico kit to be eligible for the grand prize. Winners will receive support from Avnet, Dragon Innovation and Kickstarter to take their ideas from prototype to production. See the contest page for more details.

We are eager to see the projects that you come up with. More importantly, we're excited to see how your work can inspire other developers to create something great with Android Things. To learn more about the benefits of Android Things, watch the recording from the Bootstrapping IoT Products with Android Things webinar. You can also join Google's IoT Developers Community on Google+, a great resource to get updates, ask questions, and discuss ideas.

SafetyNet Verify Apps API, Google Play Protect at your fingertips

Posted by William Luh, Software Engineer

Google Play Protect, which includes the Verify Apps security feature, helps keep users safe from harmful apps. Google Play Protect is available on all Android devices with Google Play installed and provides users with peace of mind and insights into the state of their device security.

App developers can get similar security insights into the installed apps landscape on user devices from the SafetyNet Verify Apps API. This new suite of APIs lets developers determine whether a user's device is protected by Google Play Protect, encourage users not already using Google Play Protect to enable it, and identify any known potentially harmful apps (PHAs) that are installed on the device.

These APIs are especially useful for developers of apps that may be impacted by installed PHAs on the same device as their app. Determining that Google Play Protect is enabled with isVerifyAppsEnabled() gives developers additional assurance that a device is more likely to be clean. If a device doesn't have Google Play Protect enabled, developers can request that the user enable Google Play Protect with enableVerifyApps(). With Google Play Protect enabled, developers can use the listHarmfulApps() method to determine whether there are any potentially harmful apps installed on a user's device. This easy-to-use suite of features does not require API keys and requesting quota.

Enterprise-focused apps in particular may benefit from using the Verify Apps API. Enterprise apps are designed to safeguard a company's data from the outside world. These apps often implement strict enforcements, such as ensuring the mobile device is approved by the enterprise and requiring a strong password for lockscreens. If any of the criteria are not satisfied, the enterprise may revoke credentials and remove sensitive data from the device. Having a mechanism to enforce Google Play Protect and scan for PHAs is another tool to help enterprise app developers keep enterprise data and devices safe.

For better protection, developers should use the attestation API along with the new Verify Apps API. Use the attestation API first to establish that the device has not been modified from a known state. Once the Android system can be trusted, the results from the Verify Apps API can be trusted. Existing attestation API users may find additional benefits in using the Verify Apps API as it may be able to detect on-device PHAs. In general, using multiple signals for anti-abuse detection is encouraged.

To learn how to use this API in your app, check out the developer docs.

Google and Ideas United Launch Program to Support Inclusivity in Game Design

Posted by Daraiha Greene, CS Education in Media Program Manager, Multicultural Strategy, and Kate Brennan and Mathilde Cohen Solal, Google Play

Today, we are thrilled to announce Infinite Deviation: Games. Infinite Deviation is an initiative created by Google Computer Science (CS) in Media and Ideas United in order to tackle issues of representation by bringing creativity and computer science together in unexpected ways -- ensuring that representations of computer scientists are inclusive of women, people of color, the LGBTQIA+ community, people with disabilities, and other underrepresented groups. Last year, Infinite Deviation produced a series of narrative short films to dispel stereotypes in computer science and is excited to collaborate with Google Play to bring the Infinite Deviation program to gaming.

Currently only 23% of people in the gaming industry identify as women and only 3% of game developers are African-American. From ensuring women are represented in video games to giving young girls the chance to create their own games, Google Play is committed to bringing new, diverse voices to gaming. The program gives game designers from all backgrounds the chance to pitch an original mobile game concept and have it developed, published, and promoted in partnership with Google Play. Applicants can submit their mobile game concepts until October 9.

The top three ideas will be chosen by a panel of industry experts and designers will receive the resources and support they need to bring their games to life on Google Play. Games will be judged on creativity and innovation, as well as their ability to tell original stories that resonate with underrepresented audiences.

Participants must have less than two years of professional game design experience in order to be eligible. For more information on the program, including how to apply, you can visit InfiniteDeviation.com.

By promoting original games that resonate with underrepresented audiences, we hope the program creates more favorable perceptions of computer science, bust biases, and nurture acceptance through an activity many enjoy.

Making Google Translate better—and more magical—for seven Indian languages

As the novelist and physician Khaled Hosseini wrote “if culture was a house, then language was the key to the front door, to all the rooms inside”. We agree—language is incredibly important, not only for understanding culture, but also for accessing information in general. That’s why over the past several months, we’ve been updating our products to work better for the many Indian language users coming online every day. In April, we launched several new features and updates, including neural machine translation for more languages, and just a few weeks ago we enabled voice input for additional eight Indian languages. Today, we’re bringing several updates to the Google Translate app, making it easier for speakers of Bengali, Gujarati, Kannada, Marathi, Tamil, Telugu, and Urdu to translate when they’re on the go. Now, you can do offline translations and instant visual translation in seven more Indian languages, type a Translate query with your voice in eight more languages (the seven above and Malayalam), and use conversation mode in two more languages: Bengali and Tamil. All these features have been available in Hindi, and are now accessible for more languages on both Android and iOS*.



Offline Translation in seven more Indian languages
With Google Translate, you can easily turn your phone into a powerful translation tool––for studies, business, or travel. But whether you’re on a spotty connection in a remote area or just want to switch off data while you’re on the go, sometimes you’d like to translate a word or sentence even when you’re not connected to the internet. This rings particularly true for us here in India, where connectivity can be an issue. To help you translate in moments like this, we’ve already enabled Offline Translation in Hindi, and now we’re launching the feature for seven more Indian languages––something many Indian users have asked about.


If you’d like to do offline translations in say Kannada, you can download the Kannada language pack when you’re on WiFi. Then just open the Translate app, select Kannada on either side of the screen and then tap the download button. English is automatically embedded in all language packs, so you can start translating offline between English and your language straight away.
Instantly translate signs or menus with Word Lens––now in more Indian languages
With today’s update, we’re also launching instant visual translation for these seven Indian languages, so you can now translate signs or menus from English to Bengali, Gujarati, Kannada, Marathi, Tamil, Telugu, and Urdu, in addition to Hindi. The Translate app already lets you use camera mode to snap a photo of English text and get a translation for it in these languages. Now, we’re taking it to the next level and letting you instantly translate text using your camera—so it’s way easier for speakers of local Indian languages to understand English street signs in the city, or decide what to order from a restaurant menu. Word Lens is powered by machine learning, using computer vision to distinguish between letters on an image.


To get started, open the Translate app, point your camera at an English sign or text, and you’ll see the translated text in your language overlaid on your screen. If you’re using Word Lens in a language for the first time, you might be prompted to download a translation file first, as Word Lens works offline.







Start a bilingual conversation in Bengali or Tamil (and Hindi)
Conversation mode is a feature that lets you have a bilingual conversation with someone, simply by talking to the Google Translate app. For instance, when you’re at a marketplace trying to snag a good deal on that shawl, Conversation Mode can help you converse with the locals. This already works for Hindi, and today we’re launching two additional languages: Bengali and Tamil. Simply tap the mic to start speaking in a selected language, then tap the mic again, and the Google Translate app will automatically recognize which of the two languages are being spoken, letting you have a fluid conversation—it’s like having an interpreter in your pocket!



Translate with your voice in nine Indian languages
Typing in Indian languages on a phone can be slow and cumbersome, in fact more people in India are using their voice to “type” a translation query than the keyboard. That’s why we’re excited to bring Voice Translation to more Indians––with the recent launch of voice input for eight additional languages, speakers of Hindi and now Bengali, Gujarati, Kannada, Malayalam, Marathi, Tamil, Telugu, Urdu, and Tamil can dictate their translation queries using their voice.  For instance, if you’re on the go and would like to type with your voice in Urdu, open the Translate app, select Urdu on the left side of the screen, and tap the microphone to start talking.


We’re hoping these new features help further bring down language barriers and provide more Indians with the ability to access information around them. All features announced today are already available in Hindi on the Google Translate app, and have started to roll out in the additional Indian languages both on Android and iOS*. With these updates, the Google Translate app supports Offline Translation for 59 languages, Word Lens for 37, Voice Translation for 66, and conversation mode for 40 languages. Our goal is to bring these and other features to more and more languages, breaking down language barriers in India and countries around the world.


*Please note that Voice Translation for the eight additional Indian languages currently only works on Android, but we’re looking to roll it out on iOS soon


Posted by Barak Turovsky, Product Lead, Google Translate

Helping indie developers get discovered on Google Play

Posted by Adriana Puchianu, Google Play Developer Marketing

There are increasing growth opportunities for indie game developers, but being one can still feel daunting in today's crowded gaming industry. We've been working hard to help indie developers find an audience and to recognize them for their creativity and innovation. We launched the Indie Corner as a destination for exciting new games along with longstanding indie masterpieces. Since launch, more than 380 games have been featured. Earlier this year, we launched Android Excellence which showcases apps and games that deliver incredible user experiences on Android, while providing another opportunity to be discovered on Google Play.

We've also held several indie games contests across the globe, giving indies the chance to showcase their games and find new audiences. In April, we selected the winner of the second Indie Games Festival in South Korea and we recently announced the top 20 finalists of this year's San Francisco event. Come and see the finalists in person on September 23rd, it's free to attend and open to the public. Soon we'll be bringing back the second Indie Games Contest in Europe too.

Watch François Alliot, the developer of Reigns, an indie game showcased in Android Excellence and the winner of last year's Indie Games Contest in Europe, share how he built a successful games business in the video below.

And, finally, check out our recent Q&A with Spry Fox, makers of the popular game Alphabear, to learn more about what it’s like to be an indie game developer.

How useful did you find this blogpost?

7 ways admins can help secure accounts against phishing in G Suite

We work hard to help protect your company against phishing attacks—from using machine learning, to tailoring our detection algorithms, to building features to spot previously unseen attacks. While we block as many external attacks as we can, we continue to build and offer features designed to empower IT administrators to develop strong internal defenses against phishing.

Here are seven things we recommend admins do in G Suite to better protect employee data.

1. Enforce 2-step verification

Two-step verification (2SV) is one of the best ways to prevent someone from accessing your account, even if they steal your password. In G Suite, admins have the ability to enforce 2-step verification. 2SV can reduce the risk of successful phishing attacks by asking employees for additional proof of identity when they sign in. This can be in the form of phone prompts, voice calls, mobile app notifications and more.

Image 1: phishing post

G Suite also supports user-managed security keys—easy to use hardware authenticators. Admins can choose to enforce the use of security keys to help reduce the risk of stolen credentials being used to compromise an account. The key sends an encrypted signature and works only with authorized sites. Security keys can be deployed, monitored and managed directly from within the Admin console.

The Key to working smarter faster and safer

2. Deploy Password Alert extension for Chrome

The Password Alert chrome extension checks each page that users visit to see if that page is impersonating Google’s sign-in page and notifies admins if users enter their G Suite credentials anywhere other than the Google sign-in page.

Admins can enforce deployment of the Password Alert Chrome extension from the Google Admin Console (Device management > App Management > Password Alert)—just sign in and get started. You should check “Force installation" under both “User Settings” and “Public session settings.”

Image 2: phishing post

Admins can also enable password alert auditing, send email alerts and enforce a password change policy when G Suite credentials have been used on a non-trusted website such as a phishing site.

3. Allow only trusted apps to access your data

Take advantage of OAuth apps whitelisting to specify which apps can access your users’ G Suite data. With this setting, users can grant access to their G Suite apps’ data only to whitelisted apps. This prevents malicious apps from tricking users into accidentally granting unauthorized access. Apps can be whitelisted by admins in the Admin console under G Suite API Permissions.

Image 3: phishing post

4. Publish a DMARC policy for your organization

To help your business avoid damage to its reputation from phishing attacks and impersonators, G Suite follows the DMARC standard. DMARC empowers domain owners to decide how Gmail and other participating email providers handle unauthenticated emails coming from your domain. By defining a policy and turning on DKIM email signing, you can ensure that emails that claim to be from your organization, are actually from you.

5. Disable third-party email client access for those who don't need it

The Gmail clients (Android, iOS, Web) leverage Google Safe Browsing to incorporate anti-phishing security measures such as disabling suspicious links and attachments and displaying warnings to users to deter them from clicking on suspicious links.


By choosing to disable POP and IMAP, Google Sync and G Suite Sync for Microsoft Outlook, admins can ensure that a significant portion of G Suite users will only use Gmail clients and benefit from the built-in phishing protections that they provide. Additional measures include enabling OAuth apps whitelisting to block third-party clients as suggested earlier in the blog.


Note: all third-party email clients, including native mobile mail clients, will stop working if the measures outlined above are implemented.

Image 4: phishing post
Image 5: phishing post

6. Encourage your team to pay attention to external reply warnings

By default, Gmail clients (Android, Web) warn G Suite users if they’re responding to emails sent from outside their domain by someone they don’t regularly interact with, or from someone not in their contacts. This helps businesses protect against forged emails, from malicious actors or just plain old user-error like sending an email to the wrong contact. Educate your employees to look for these warnings and be careful before responding to unrecognized senders. Unintended external reply warnings are controlled from the Admin console control in the “Advanced Gmail” setting.

Image 6: phishing post

7. Enforce the use of Android work profiles

Work profiles allow you to separate your organization's apps from personal apps, keeping personal and corporate data separate. By using integrated device management within G Suite to enforce the use of work profiles, you can whitelist applications that access corporate data and block installation of apps from unknown sources. You now have complete control over which apps have access to your corporate data.

Image 7: phishing post

These steps can help you improve your organization’s security posture and become more resistant to phishing attacks. Learn more at gsuite.google.com/security or sign up for our security webinar on September 20, 2017 which features new security research from Forrester and a demonstration on how the cloud can help effectively combat cyber threats.

Source: Google Cloud


7 ways admins can help secure accounts against phishing in G Suite

We work hard to help protect your company against phishing attacks—from using machine learning, to tailoring our detection algorithms, to building features to spot previously unseen attacks. While we block as many external attacks as we can, we continue to build and offer features designed to empower IT administrators to develop strong internal defenses against phishing.

Here are seven things we recommend admins do in G Suite to better protect employee data.

1. Enforce 2-step verification

Two-step verification (2SV) is one of the best ways to prevent someone from accessing your account, even if they steal your password. In G Suite, admins have the ability to enforce 2-step verification. 2SV can reduce the risk of successful phishing attacks by asking employees for additional proof of identity when they sign in. This can be in the form of phone prompts, voice calls, mobile app notifications and more.

Image 1: phishing post

G Suite also supports user-managed security keys—easy to use hardware authenticators. Admins can choose to enforce the use of security keys to help reduce the risk of stolen credentials being used to compromise an account. The key sends an encrypted signature and works only with authorized sites. Security keys can be deployed, monitored and managed directly from within the Admin console.

2. Deploy Password Alert extension for Chrome

The Password Alert chrome extension checks each page that users visit to see if that page is impersonating Google’s sign-in page and notifies admins if users enter their G Suite credentials anywhere other than the Google sign-in page.

Admins can enforce deployment of the Password Alert Chrome extension from the Google Admin Console (Device management > App Management > Password Alert)—just sign in and get started. You should check “Force installation" under both “User Settings” and “Public session settings.”

Image 2: phishing post

Admins can also enable password alert auditing, send email alerts and enforce a password change policy when G Suite credentials have been used on a non-trusted website such as a phishing site.

3. Allow only trusted apps to access your data

Take advantage of OAuth apps whitelisting to specify which apps can access your users’ G Suite data. With this setting, users can grant access to their G Suite apps’ data only to whitelisted apps. This prevents malicious apps from tricking users into accidentally granting unauthorized access. Apps can be whitelisted by admins in the Admin console under G Suite API Permissions.

Image 3: phishing post

4. Publish a DMARC policy for your organization

To help your business avoid damage to its reputation from phishing attacks and impersonators, G Suite follows the DMARC standard. DMARC empowers domain owners to decide how Gmail and other participating email providers handle unauthenticated emails coming from your domain. By defining a policy and turning on DKIM email signing, you can ensure that emails that claim to be from your organization, are actually from you.

5. Disable POP and IMAP access for those who don’t need it

The Gmail clients (Android, iOS, Web) leverage Google Safe Browsing to incorporate anti-phishing security measures such as disabling suspicious links and attachments and displaying warnings to users to deter them from clicking on suspicious links. 

By choosing to disable POP and IMAP, admins can ensure that all G Suite users will only use Gmail clients and benefit from the built-in phishing protections that they provide. POP and IMAP access can be disabled by admins at the organizational unit level.

Note: all third-party email clients including native mobile mail clients will stop working if POP and IMAP are disabled.

Image 4: phishing post
Image 5: phishing post

6. Encourage your team to pay attention to external reply warnings

By default, Gmail clients (Android, Web) warn G Suite users if they’re responding to emails sent from outside their domain by someone they don’t regularly interact with, or from someone not in their contacts. This helps businesses protect against forged emails, from malicious actors or just plain old user-error like sending an email to the wrong contact. Educate your employees to look for these warnings and be careful before responding to unrecognized senders. Unintended external reply warnings are controlled from the Admin console control in the “Advanced Gmail” setting.

Image 6: phishing post

7. Enforce the use of Android work profiles

Work profiles allow you to separate your organization's apps from personal apps, keeping personal and corporate data separate. By using integrated device management within G Suite to enforce the use of work profiles, you can whitelist applications that access corporate data and block installation of apps from unknown sources. You now have complete control over which apps have access to your corporate data.

Image 7: phishing post

These steps can help you improve your organization’s security posture and become more resistant to phishing attacks. Learn more at gsuite.google.com/security or sign up for our security webinar on September 20, 2017 which features new security research from Forrester and a demonstration on how the cloud can help effectively combat cyber threats.

Source: Android