Why we won’t be supporting Sign in with Apple

Post by ben509 » Tue, Jun 30, 2020, 1:13 PM UTC

joshspankit wrote: post #165

crazygringo wrote: post #157

As they point out at the very bottom, all their arguments apply to all third-party sign-ons, so they're removing Facebook as well. So there's nothing specifically against Apple, despite the title seeming to imply it -- just that they're taking the move right now because of Apple's new policy coming into effect. I've got to say, I really wish there were a way to know whether I already used Facebook, Google, or Apple t…

Having had this same problem multiple times, I actually made it a point to save a “login” for those sites that when I autofill it reminds me which auth service I’ve used. Username: Log in with FB Password:

Post by zchrykng » Tue, Jun 30, 2020, 1:26 PM UTC

indymike wrote: post #415

_b8r0 wrote: post #412

Earlier quoted context omitted.

> If the service provider does not have your email address, they are severely hampered with regards to customer support. No, they're not. They're just relying on email as a user verification methods as it's the easiest approach. Other methods are possible.

Verification is only one part of the problem. The other is communication. If I can't contact my customers, how do I support them (e.g. report a security problem)? If my customers can't communicate which account is theirs, how do we help solve problems? Email addresses and/or phone numbers make this a lot easier.

Post by zchrykng » Tue, Jun 30, 2020, 1:31 PM UTC

tallanvor wrote: post #395

lilyball wrote: post #331

Earlier quoted context omitted.

For the first point, the app can explicitly tell the user what their login is, or otherwise assign some unique identifier the user can use when contacting support. The app can also offer to contact support for them, which can pre-fill the user identifier. For the second, that’s entirely the user’s choice. Your app can also allow them to associate a new email address for this purpose (which strikes me as exactly what…

And when you're using the web app on a desktop? There's no easy sharing mechanism there.

Post by necovek » Tue, Jun 30, 2020, 2:02 PM UTC

jacurtis wrote: post #234

fennecfoxen wrote: post #206

Earlier quoted context omitted.

The credentials are at least not in multiple databases and stand some chance of being more secure, so it’s not as bad as with direct credential reuse, but yes, if you do compromise that one identity provider you’re in big trouble.

With Social SSO, you essentially are passing the trust from some random company getting hacked and revealing your re-used password, onto the shoulders of internet giants like Facebook, Google, Twitter, Apple, etc and putting the trust on them, that they know what they are doing in terms of security. I still agree that they are variants of the same fundamental problem (a single credential protects all of your logins)…

Post by barkerja » Tue, Jun 30, 2020, 2:16 PM UTC

crispyporkbites wrote: post #61

duxup wrote: post #45

Earlier quoted context omitted.

I wonder if Apple would be ok with asking them to give up their email? Apple clearly likes the idea of the hide option... personally I would expect a less than positive reception from Apple. I get where both AnyList (if they asked) and Apple (if they didn't like it) would be coming from here. It does seem to be a shortcoming here where outside of a user one time sign up situation... you don't want to have to burden t…

Why should Apple be allowed to dictate if an app asks for an email address? They should not become the defacto law makers of our society