October 2020 Summaries

Password-based sign-in remains widely used because it is familiar, but it creates security and usability risks including forgotten passwords, credential theft, and password reuse. Firebase Authentication and Google Cloud Identity Platform recommend securing password authentication by restricting API keys, supporting password managers and One Tap sign-in, enforcing password policies, enabling email enumeration protection and App Check, and requiring multi-factor authentication for sensitive data such as financial or medical information. When MFA is not used, social sign-in and email-link authentication are presented as stronger, lower-friction alternatives, with email links recommended as a migration path away from passwords. Phone authentication can serve users without email access but carries risks related to transferable phone numbers and shared devices.

Firebase Authentication for Android version 20.0.0, available through Firebase Android BoM version 26.0.0, removes its dependency on Google Play services, allowing developers to use Firebase services such as Cloud Firestore, Realtime Database, and Cloud Storage on Android devices without Google Play services. Developers can adopt the change by updating their Gradle dependencies and recompiling, and can remove prior non-GMS workarounds. For Phone Number Authentication, Firebase uses Android SafetyNet on devices with Google Play services to verify legitimate requests, while falling back to reCAPTCHA when SafetyNet is unavailable or a device raises suspicion checks. Developers using phone authentication should enable the SafetyNet API and test both verification paths, including the ability to force the reCAPTCHA flow during testing.

Firebase Summit 2020 highlighted growth from 2 million to more than 2.5 million monthly active apps using Firebase, including platforms such as Classkick, which scaled remote learning services during COVID-19 with Firebase and Google Cloud. The announced updates focus on accelerating development through Firebase Authentication support in the Emulator Suite, Hosting preview channels for reviewing changes before publication, and new Extensions including Stripe payment tools and an alpha online-presence feature. Firebase also introduced a redesigned Performance Monitoring dashboard and expanded Remote Config organization, targeting, and metrics capabilities to help developers manage app quality and configuration. For scaling businesses, new Google Analytics APIs provide event logging, reporting access, and administration controls, while imported segments allow developers to bring custom BigQuery audiences back into Firebase for targeted messaging, configuration, and promotions.

Firebase encouraged developers to migrate from the legacy Fabric SDK to the generally available Firebase Crashlytics SDK before Fabric’s November 15 shutdown, after which Fabric-based apps would stop reporting crashes. The Firebase SDK is estimated to capture about 30% more Android crashes and report twice as many on the day they occur, while its reduced-size Gradle plugin improves build performance, mapping and native-symbol uploads, and compatibility with modern Android Gradle Plugin features. For Apple platforms, Crashlytics added Catalyst, iOS App Clips, community-supported watchOS, and shared installations across iOS, tvOS, and macOS, while significantly accelerating large dSYM symbol uploads. The SDK also aligns its APIs and initialization process with other Firebase services, replacing Fabric-specific setup and deprecated fabric.io references with FirebaseApp configuration.

Google announced updates to the next generation of Google Analytics for Firebase projects, expanding app-focused reporting, predictive insights, gaming analytics, and advertising capabilities. New features include support for impression-level revenue data from AdMob mediation and third-party platforms such as MoPub and ironSource, enabling developers to assess customer lifetime value, build high-value user audiences, and evaluate advertising revenue in Firebase A/B tests. The platform also simplifies event measurement through property-level custom dimensions and metrics, reducing the need to register the same parameter separately for each event. Signed-in user insights can now be used to connect cross-device and cross-platform customer journeys, create remarketing audiences, and manage granular controls for ads personalization. Developers are encouraged to upgrade through the Firebase console to access these capabilities.

Firebase Hosting introduced preview channels, an official GitHub Action, and version cloning to improve collaboration and deployment workflows. Preview channels let teams deploy development versions to temporary, shareable URLs, while each Hosting site retains a live production channel and can support multiple preview channels with configurable expiration periods. Available through Firebase CLI version 8.12.0 or later and the Firebase console, channels can be created, deployed, listed, and managed using dedicated commands. The new GitHub Action can automatically create preview deployments for pull requests and optionally deploy changes to the live channel after merges, with setup available through Firebase initialization commands. Version cloning allows content already deployed to a preview, staging, or other authorized site channel to be copied directly to a live channel, avoiding unnecessary rebuilds and supporting workflows across sites and Firebase projects.

Firebase Remote Config has introduced enhanced app version targeting for Android and iOS, enabling developers to more precisely customize feature flags, fixes, and A/B tests for users on particular app releases without publishing updates. For iOS, previous “version number” conditions have been renamed as “build number” because they target CFBundleVersion, while a new version condition in Firebase iOS SDK 6.24.0 and later targets the user-facing CFBundleShortVersionString. Remote Config also now supports semantic version comparisons with numeric operators such as greater than, less than, and equal to, removing the need for complex regular expressions and allowing ranges such as versions from 1.2.3 up to, but not including, 1.3.4.

Cloud Firestore now supports not-equal and not-in queries, allowing developers to retrieve documents whose field values differ from a specified value or are excluded from a list of values, such as projects not marked “completed” or “dropped.” These queries do not return documents where the queried field is absent. They also follow existing inequality-query limitations, including restrictions on applying not-equal conditions to multiple fields or sorting by a different field, while combinations with equality filters on another field may require a composite index. The functionality is available in the iOS, Android, Web, Node.js, and Java SDKs, with C++ and additional server-library support planned.