[deleted]
Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
51–60 of 73 posts
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#52Earlier quoted context omitted.
On all sites/apps I’ve built offering SSO, we’ve gone out of our way to support linking of accounts and detecting existing accounts when claims like emails are found. Also allowing for merges after the fact. I would consider this a best practice when iffering any “ sign in with...”
This seems like a nice user experience, but I'd be worried about leaking which email address has an account with us.
Wouldn’t the sign in mechanism (which validates e-mail) prevent this, in the sense than they won’t be able to get a third-party account to authenticate with for a particular e-mail without verifying ownership of that e-mail to the third-party provider?
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#53Earlier quoted context omitted.
On all sites/apps I’ve built offering SSO, we’ve gone out of our way to support linking of accounts and detecting existing accounts when claims like emails are found. Also allowing for merges after the fact. I would consider this a best practice when iffering any “ sign in with...”
This seems like a nice user experience, but I'd be worried about leaking which email address has an account with us.
You address this by only linking accounts once a user has successfully signed in with another provider. That way if their email exists from another provider, you're more certain that it's the same account
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#54Haven’t done anything with Apple sign in, but I worked with a lot of other providers before. If you have multiple options, users might forget what service they used. This becomes an even bigger problem if the paid for a service with a different provider and can’t find their purchase. If you do use something like this, only having one provider (only Apple) makes things less confusing.
We have the same problem, it's probably our 3rd biggest support issue. "Where's my stuff??" We offer only Facebook, Google, or Email. People see the email box and start typing in their email, they forget if they signed in with Facebook or Google previously. I'm surprised it isn't the other way around. Of course, this wasn't an issue before we added email, but we got a bunch of requests from people who didn't want to…
Same! People log in again after a few weeks/months and can’t find their stuff.
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#55Haven’t done anything with Apple sign in, but I worked with a lot of other providers before. If you have multiple options, users might forget what service they used. This becomes an even bigger problem if the paid for a service with a different provider and can’t find their purchase. If you do use something like this, only having one provider (only Apple) makes things less confusing.
Second that. We analyse where our users are coming from across all channels and added only that. This made it really easy for the users to both remember what they used and also to sign up/sign in almost instantly.
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#56Haven’t done anything with Apple sign in, but I worked with a lot of other providers before. If you have multiple options, users might forget what service they used. This becomes an even bigger problem if the paid for a service with a different provider and can’t find their purchase. If you do use something like this, only having one provider (only Apple) makes things less confusing.
I worked on the design and rollout of multiple sign in providers on a popular app. There are best practices that avoid these issues (users forgetting which service they used), but they are rarely implemented.
The trick is to be very forgiving: If a user tries to sign in using provider X, and we discover an email address conflict with an account that uses provider Y, we would simply ask users to confirm by clicking a button to sign in with provider Y. From that point forward, both provider X and provider Y can be used to sign into the account.
So many apps miss the importance of this and cut corners by only allowing an account to be associated with 1 sign-in provider, or forcing users to create passwords for these accounts, or differentiating between login and signup.
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#57Earlier quoted context omitted.
Yes, this happens. Although I've been using SG for something like 10 years now and it's rare when a website blocks @SG (and the dozen other synonym domains) addresses. What's nice with SG is that the emails are sent to /dev/null once the count is over whereas with a catchall, you keep receiving everything sent to any address for ever.
> with a catchall, you keep receiving everything sent to any address for ever. That's true, and I wish Fastmail had a better way of managing rules remotely (with something like remote sieve or an API) so I could script a click-button-turf-address-forever. On the other hand, I don't mind still getting the follow-ups for some stuff. For example, Target has target@thatdomain.italkedabout.example for years to use for ord…
You can also set a SG address to always forward emails coming from a particular email. So you could set it so that orders@target.com is always forwarded and doesn’t change the count and you’ll always get these but not the newsletter.
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#58I’m about to embark on a new iOS built with SwiftUI. What backend would you recommend for authentication (server side) when using Sign In with Apple? Do you all use Firebase?
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#59Haven’t done anything with Apple sign in, but I worked with a lot of other providers before. If you have multiple options, users might forget what service they used. This becomes an even bigger problem if the paid for a service with a different provider and can’t find their purchase. If you do use something like this, only having one provider (only Apple) makes things less confusing.
This. I'm not a big user of SSO in general, but on the few sites that I did use it, I'd forget whether I used SSO or not. Also, using SSO locks you into using that vendor. I've a couple of accounts that I'd like to change to normal uname/pwd but am locked into the SSO vendor (which I'm hoping to move away from)
No it doesn’t. All the SSO providers (besides Apple in some cases) provide a verified email address to the site that can use to dedupe.
Re: Ask HN: Mobile devs who added Apple Sign In, what conversion changes?
#60Earlier quoted context omitted.
Similarly if your Apple (or other SSO) login is compromised the blast area is much bigger as all linked sites are now compromised You could make the same argument if your password manager is compromised, but definitely worth being aware of
Most people are already vulnerable to this because they use the same password everywhere. The fewer service providers there are holding a copy, the lower the risk of compromise.
This is not how it works. We don't hold any copies of users' passwords these days, there are hashes for that. Certainly, some old, or poor quality in-house software still do it, but then it won't offer you integration with whatever SSO service anyway. And single point of failure is very real, if you trying to operate world-wide: sign-in with X may suddenly become illegal, or inaccessible outside of the USA.