Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why we won’t be supporting Sign in with Apple

blog.anylist.com

Post reply on HN
Print view View original

161–170 of 485 posts

Re: Why we won’t be supporting Sign in with Apple

#161

Post by KeepFlying »

WorldMaker wrote: post #95
addicted wrote: post #70

Earlier quoted context omitted.

So someone explicitly chose to hide their email, and then on logging into an app is asked to share their real email. Anyone in that position would think the app is shady AF and user hostile.

Progressive consent makes sense though: in starting out with an app that i have no previous trust relationship, "Hide my email" sounds like a good idea in a trial balloon. If after using the application it tells me that to better use its collaboration tools it would like me to consent in giving a more direct email address, I might change my mind given changes in trust relationship (I have been using this app for some…

I like this approach. And giving users that progresive consent is smart. If I open your app and am greeted with "You need to give us your email to get the most out of our app" then I'll be upset as that is user hostile. But If I click a share button and am told "In order to make it easier for people to send you things, would you provide your email" and being able to dismiss that and continue to use the app and all of its features, I'll be significantly happier.

That said though, I don't see why the app couldnt just change their sharing model to an "invite link" based pattern. If I want to share something with a friend, why do I need to provide their private information to the app to do it? Why can't I generate an invite link and send that through my already established channels of communication? I don't think the "but your friends don't know your Apple privacy email" reason is very compelling. That might not work in their current system, but it is definitely not an insurmountable problem.

Re: Why we won’t be supporting Sign in with Apple

#162

Post by faet »

gramakri wrote: post #121

Not an Apple use but I had a question. If one signs up with Signin with Apple, how can that user move over his stuff to say an Android app? Or even Desktop app? (Or does the Apple ID keep track of all this anonymous id to app mapping?)

You still have your apple account on your PC/Android phone/etc. You just login on apple's website with your apple account and it passes the token/id to whatever app needs it.

For example you can goto dropbox on your pc/whatever and click signin with apple to see how it works.

Re: Why we won’t be supporting Sign in with Apple

#163

Post by jborichevskiy »

crazygringo wrote: post #157

As they point out at the very bottom, all their arguments apply to all third-party sign-ons, so they're removing Facebook as well. So there's nothing specifically against Apple, despite the title seeming to imply it -- just that they're taking the move right now because of Apple's new policy coming into effect. I've got to say, I really wish there were a way to know whether I already used Facebook, Google, or Apple t…

Yes! Especially once you start juggling multiple accounts for different companies and projects. Becomes a guessing game, and each wrong guess creates another account magically. Infuriating

Re: Why we won’t be supporting Sign in with Apple

#164

Post by swagonomixxx »

ajhurliman wrote: post #118
swagonomixxx wrote: post #102

Earlier quoted context omitted.

The anonymous e-mail that Sign-In with Apple generates forwards to the e-mail used to set up your Apple ID. So it's not like it's a random e-mail that acts as a /dev/null. This is by far the biggest selling point of Sign-In with Apple for me and I will continue to use it, and continue to not use apps that don't support it. I have plenty of e-mail aliases, but having an alias auto-generated for you is very convenient,…

Small nit: Potential hackers would only have access to your email, provider id and whatever other details they pass along (preferred name, profile picture URL, etc.). Social login doesn't provide consumers (AnyList in this case) with your password.

Agreed, social login like Facebook et. al do not provide passwords to consumers, but e-mail is already contentious enough.

Most people use the same e-mail for every single account they have. A large majority of these users use the same password for all of their accounts. (Just want to clarify that I do neither of these things - I have a large set of e-mail aliases and have a unique & secure password for each account I have to set up manually).

If you'll grant me that fact, then all I need is your e-mail from a dump of AnyList's users table, and look up that e-mail in my already vast database of dumped tables, and see that your password was "hunter2". Now I have access to your bank account, because you used the same e-mail and password for that account as well.

This is a bit of a contrived example, but in general, any personal information that is leaked (e-mail included) is bad - full name, address, and the like, which many websites ask for, is even worse, because crackers have even a better shot at guessing a lot of your personal information, and at that point, the ball is in their park.

Re: Why we won’t be supporting Sign in with Apple

#165

Post by joshspankit »

crazygringo wrote: post #157

As they point out at the very bottom, all their arguments apply to all third-party sign-ons, so they're removing Facebook as well. So there's nothing specifically against Apple, despite the title seeming to imply it -- just that they're taking the move right now because of Apple's new policy coming into effect. I've got to say, I really wish there were a way to know whether I already used Facebook, Google, or Apple t…

Having had this same problem multiple times, I actually made it a point to save a “login” for those sites that when I autofill it reminds me which auth service I’ve used.

Username: Log in with FB

Password:

Re: Why we won’t be supporting Sign in with Apple

#166

Post by Aeolun »

swagonomixxx wrote: post #102
renewiltord wrote: post #88

Earlier quoted context omitted.

How is this ironic? It is by design and obviously they know why people do it because the very next sentence says that. Why on Earth would you'd want to use a list-sharing app that uses email as the addressing system and then not share your email.

The anonymous e-mail that Sign-In with Apple generates forwards to the e-mail used to set up your Apple ID. So it's not like it's a random e-mail that acts as a /dev/null. This is by far the biggest selling point of Sign-In with Apple for me and I will continue to use it, and continue to not use apps that don't support it. I have plenty of e-mail aliases, but having an alias auto-generated for you is very convenient,…

So you say you are using your email as the unique identifier instead of the password?

If you use a unique password for every service, what would you need a unique email for?

Re: Why we won’t be supporting Sign in with Apple

#167

Post by Aeolun »

Smoosh wrote: post #101
TheArcane wrote: post #76

> Another issue is Sign in with Apple’s “Hide My Email” feature. With this feature, if you create an account with us, Apple will generate a special email address just for that account. So rather than your email address being john.doe@icloud.com, we will see your email address as something like dpdcnf87nu@privaterelay.appleid.com. Ironically, this is also why I use Sign Up with Apple at every opportunity I can

The article also implies that if anyone can guess your email address, they can send you/share with you a list. I wonder what anti-spam measures AnyList implements?

I assume they rely on the fact that sharing a random list with a random person a thousand times is pointless.

Re: Why we won’t be supporting Sign in with Apple

#168

Post by KeepFlying »

duxup wrote: post #45
no_wizard wrote: post #12

A lot of the points they make here are real points, and I think AnyList has validity in their actions. I also think it’s not as unmanageable as it seems. Let’s analyze this quote, from the article, as it highlights what I imagine are a big crux of this issue: > with the “Hide My Email” option, your spouse or friends obviously won’t know your privaterelay.appleid.com email address, so when they enter your email addres…

I wonder if Apple would be ok with asking them to give up their email? Apple clearly likes the idea of the hide option... personally I would expect a less than positive reception from Apple. I get where both AnyList (if they asked) and Apple (if they didn't like it) would be coming from here. It does seem to be a shortcoming here where outside of a user one time sign up situation... you don't want to have to burden t…

I think it would come down to user hostility here.

If I sign in with Apple and opt out of giving my email only to be faced with a prompt demanding I give up my email address, I'll be upset. I JUST told the app (via checking the box in Apple) that I don't want to give my mail, so why is it now suddenly required?

However if the app allows me to sign in and only asks for my email when I try to interact with a feature that would be more usable had I given my email, then I would be more accepting of it. Though I would still fully expect to be able to use the app in its entirety even if I opt out.

Now what Apple will say to this, I have no idea. But as a privacy conscious user, I would be happier with this.

As for having to come up with silly names, I don't understand why I need to be discoverable within an app. We have established social media and communication platforms, use them. Let me send a link to a friend to connect with them in your random app. I don't need to be able to add them within the dang app.

Re: Why we won’t be supporting Sign in with Apple

#169

Post by jeffrogers »

I dunno. There are simple solutions to the issues raised in the blog post, many good ones here in the comments. Seems likely they wanted to get rid of third party logins and oddly chose to throw it on Apple. And I’m not sure anyone, including Apple, cares if they adopt Sign In with Apple. In the end, I think everyone just wants to end creepy sign-in practices. Facebook login deleted from Anylist... that’s a win for everyone.

Re: Why we won’t be supporting Sign in with Apple

#170

Post by dahfizz »

WorldMaker wrote: post #147
dahfizz wrote: post #143

Earlier quoted context omitted.

They directly address this point. In the article they say they considered adding sign in with Apple everywhere. Besides the fact that it's more code to write and test, they say the documentation is very poor for other platforms, as it's not even great for iOS.

It seems sufficient to me? https://developer.apple.com/documentation/sign_in_with_apple...

Absolutely not. Compare the native ios documentation[1] with their "other platforms" documentation[2]. Their native documentation has code snippets, helpful links, and explains in depth what is happening.

The "other platforms" documentation is "make this request, store some data, follow redirects". No code, no helpful links on how you might accomplish these things, nothing. You get the bare minimum.

I'm not saying its impossible, and neither is the article. I'm saying that Apple clearly doesn't care about supporting a platform as huge as Android, and that clearly signals to multi-platform developers that they are on their own.

[1] https://developer.apple.com/documentation/authenticationserv...

[2] https://developer.apple.com/documentation/sign_in_with_apple...

Post reply on HN