Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Popular Is “Sign in with Apple”?

daringfireball.net

Post reply on HN
Print view View original

71–80 of 340 posts

Re: How Popular Is “Sign in with Apple”?

#71

Post by dfrey »

habosa wrote: post #41

I tried to do a Sign in with Apple integration on Android (wanted the app to have the same options across platforms). Testing on Android was next to impossible. To test I needed an Apple ID with 2FA. But SMS 2FA was not good enough, you need the hardware-based 2FA. To get that you need a recent macOS or iOS device. As an Android developer I have no reason to own either of those. Eventually I just had a friend who own…

> Seems like a nice sign-in option for iPhone owners but it's a portability disaster.

So basically it's like everything that Apple makes

Re: How Popular Is “Sign in with Apple”?

#72

Post by pier25 »

ehsankia wrote: post #59
habosa wrote: post #41

I tried to do a Sign in with Apple integration on Android (wanted the app to have the same options across platforms). Testing on Android was next to impossible. To test I needed an Apple ID with 2FA. But SMS 2FA was not good enough, you need the hardware-based 2FA. To get that you need a recent macOS or iOS device. As an Android developer I have no reason to own either of those. Eventually I just had a friend who own…

Apple continues to not give any care whatsoever to anything outside their walled garden. For the longest time you couldn't even preview songs on iTunes store without having iTunes. Want to watch their biggest WWDC live? Had to use Safari until last year. Obviously iMessage and FaceTime are complete no-gos outside their walled garden too. This is how they keep people in. They have to close down their walls as tightly…

I use a mix of Apple and non-Apple devices. It's a shame that I can't, for example, use Safari on Windows or Android.

Re: How Popular Is “Sign in with Apple”?

#73

Post by adamlett »

ilikehurdles wrote: post #46
jandrese wrote: post #39

Earlier quoted context omitted.

Is there any good reason to do the Sign In With ? I never take that option if there is anything else available. They don't need to see my signins on other sites, why should I just give it to them? For a few sites where it is utterly unavoidable I make one-off twitter accounts instead, because Twitter doesn't require your phone number to make an account and doesn't have a "only one account per person" policy I think.

Sign in with Apple has the advantage that the service on the other side of the auth window doesn't get to see you actual email address. They're provided instead with an anonymized email address from Apple that serves as a forwarding address for you. It's also easy in general to revoke permissions with these SSO providers rather than dealing with whatever the service's account cancellation protocol is.

What’s cool about that anonymized email address is that even if it gets leaked, only the registered service can use it to communicate with you.[1]

[1] https://support.apple.com/en-au/HT210318

Re: How Popular Is “Sign in with Apple”?

#75

Post by richardthered »

jandrese wrote: post #39
fetus8 wrote: post #14

I've seen "Sign in with Apple" exactly once since iOS 13 launched. I am kind of surprised it's not being rolled out more widely. The first app I've seen and used it with was Byte (the Vine successor) over this past weekend.

Is there any good reason to do the Sign In With ? I never take that option if there is anything else available. They don't need to see my signins on other sites, why should I just give it to them? For a few sites where it is utterly unavoidable I make one-off twitter accounts instead, because Twitter doesn't require your phone number to make an account and doesn't have a "only one account per person" policy I think.

Login fatigue. Yes, I use a password manager (1password). But it means I need to stop going through the sign-up flow, jump over to the password manager, create a new login, change the password recipe from random-letter to random-word (which I prefer), generate a password, then go further modify it to accommodate the site's particular password complexity rules (upper/lower/special/numbers), add the URL, save, then go back to the sign-up flow to finish.

And... 90% of the time, that's what I do, because I prefer to have separate logins for every site.

But sometimes, I just click the 'sign in with google' because it's a hell of a lot faster and easier.

Re: How Popular Is “Sign in with Apple”?

#76

Post by gibolt »

pgkyc wrote: post #66

I've spent the last +18 months building a product that does this with even more privacy than Apple. It's called idvpn.ca and we assign a virtual ID (pseudonym) to you for each app/vendor you connect to. This way if they're breached, you don't care and they don't care, yet we can meet any compliance requirements the app/vendor has such as age checking, sanction list checking, anti-money laundering, counter terrorist f…

Sounds like you should have started your last step 18 months ago.

Getting it integrated on a scale large enough to warrant regular people using it and having it in more than one app they use will be the biggest challenge you'll face. Focus as much percentage of your resources as possible there.

Re: How Popular Is “Sign in with Apple”?

#78

Post by dep_b »

habosa wrote: post #41

I tried to do a Sign in with Apple integration on Android (wanted the app to have the same options across platforms). Testing on Android was next to impossible. To test I needed an Apple ID with 2FA. But SMS 2FA was not good enough, you need the hardware-based 2FA. To get that you need a recent macOS or iOS device. As an Android developer I have no reason to own either of those. Eventually I just had a friend who own…

> As an Android developer I have no reason to own either of those.

Of course you do: Please implement this iOS application/feature in Android.

Not being able to run an application from Xcode onto an iOS device severely hampers your career. I have to deal with so many Android developers and their output I absolutely cannot afford the luxury to not run Android apps from Android Studio.

I don't think Sign In With Apple will be a huge hit on Android anyway. But perhaps you could share your code on Github for people that run into the same requirements?

Re: How Popular Is “Sign in with Apple”?

#79

Post by TJSomething »

mikece wrote: post #45
ascagnel_ wrote: post #12

Earlier quoted context omitted.

My understanding is that "Sign in With Apple" is still officially in beta; once it launches in full, all iOS apps that offer third-party sign ins (like the Google & Facebook options) will be mandated to also offer Apple's OAuth sign-in -- and must give it more prominent placement than third-party services.

Is Sign in with Apple compliant with OAuth2 / OpenID Conenct? If it's not I don't see how Apple can justify mandating the inclusion of something that isn't standards-based?

It's mostly compliant as of a few months ago [0]. That document is actually out of date, because Apple added a discovery endpoint since then [1]. They also haven't implemented the userinfo endpoint, but the only claims they expose are openid, name, and email, so it's not that big of a deal to just ask for those in the id_token. And the client_secret_post thing isn't much of a problem either, since their custom JWT is a perfectly valid client secret that's compliant with the underlying OAuth 2.0 standard and it's explained in their discovery document.

[0] https://bitbucket.org/openid/connect/src/default/How-Sign-in...

[1] https://appleid.apple.com/.well-known/openid-configuration

Re: How Popular Is “Sign in with Apple”?

#80

Post by adamlett »

pgkyc wrote: post #66

I've spent the last +18 months building a product that does this with even more privacy than Apple. It's called idvpn.ca and we assign a virtual ID (pseudonym) to you for each app/vendor you connect to. This way if they're breached, you don't care and they don't care, yet we can meet any compliance requirements the app/vendor has such as age checking, sanction list checking, anti-money laundering, counter terrorist f…

I don’t understand how that is more private than what Apple offers? To my understanding, “Sign in with Apple” optionally also hides your true identity (ie. email address).
Post reply on HN