Why we won’t be supporting Sign in with Apple • Hacker News Board

Re: Why we won’t be supporting Sign in with Apple

#441

Post by basch » Tue, Jun 30, 2020, 4:04 PM UTC

thomaslord wrote: post #437

_b8r0 wrote: post #412

Earlier quoted context omitted.

> If the service provider does not have your email address, they are severely hampered with regards to customer support. No, they're not. They're just relying on email as a user verification methods as it's the easiest approach. Other methods are possible.

> No, they're not. Did you read the article? It seemed very clear to me that they had significant issues with customer support past just verification. And what would you suggest as an alternative way to identify the user, anyway? Any alternative method of authentication seems doomed to fail - using a real name runs into issues with duplication, requiring users to set a username would likely require significant change…

A simple "let me email a 6 digit alphanumeric code to your icloud email" 2fa style identification would cover anybody who is able to open their mailbox. Not perfect, but gets around some of the problem.

I actually think the customer experience of "I switched from apple to android and now I dont know any of my usernames" is a bigger issue. If apple wants Sign in with Apple to work, it needs to behave a bit more like an agnostic 3rd party password manager, work on every platform, and have ways to interact with it on any device. They should release Keychain as an Android app and Chrome extension, and allow you to use it to see your Sign in with Apple data.

Re: Why we won’t be supporting Sign in with Apple

#442

Post by kemayo » Tue, Jun 30, 2020, 4:05 PM UTC

thaway757383884 wrote: post #400

AnonC wrote: post #228

Earlier quoted context omitted.

Obfuscation of the email address is an explicit choice by the user when using Sign in with Apple. It’s not something forced by the service. If users are choosing to do that, it says something about the lack of trust the users have with whatever they’re signing up for.

The biggest problem is that Apple insists on tying the fake email with your iCloud email, which the vast majority of people don’t use. If they tied it instead to what people’s normal mail was, a lot of issues would be averted.

They tie it to whatever your Apple ID primary email is. This is only your iCloud email if you've deliberately made one, which isn't the default.

Re: Why we won’t be supporting Sign in with Apple

#443

Post by thomaslord » Tue, Jun 30, 2020, 4:07 PM UTC

lilyball wrote: post #331

randomchars wrote: post #328

Earlier quoted context omitted.

From the article: > If a customer contacts us asking for support, and we need to look up something in their account, typically we can just ask them for the email address on their account. But with “Hide My Email” that wouldn’t be easily possible, because the customer would have to figure out the privaterelay.appleid.com email address used for their account. > Furthermore, if there are platforms where AnyList doesn’t…

For the first point, the app can explicitly tell the user what their login is, or otherwise assign some unique identifier the user can use when contacting support. The app can also offer to contact support for them, which can pre-fill the user identifier. For the second, that’s entirely the user’s choice. Your app can also allow them to associate a new email address for this purpose (which strikes me as exactly what…

> For the second, that’s entirely the user’s choice. Your app can also allow them to associate a new email address for this purpose (which strikes me as exactly what you actually want since the real unstated motivation here is getting the user’s email).

So the solution here is for a developer to add a bunch of code to their codebase on at least 4 platforms just to get to the same exact functionality and level of privacy, but with a worse user experience?

> For the third, don’t make me type in someone’s email. The exact same issue as described happens if they have multiple email addresses too. Just let me use my OS’s sharing mechanism to send a special link that they can open to establish the sharing connection. An invite to share, as it were. Not only does that solve the problem, it’s significantly more user-friendly.

As a user, I find that functionality to be incredibly clunky by comparison (on all platforms). It may be moderately better on iOS than Android, but even then Anylist and others are running multiplatform apps. If I'm using a computer and I need to manually copy a link, open my email client, compose a new email, type the subject and a message, paste the link, and hit send, that feels dramatically more cumbersome than just entering an email address and hitting "share". It also takes a good amount of new code to implement something like that on an existing system that uses email-based sharing, which I don't think developers should have to deal with just because Apple built a lousy login system.

Re: Why we won’t be supporting Sign in with Apple

#444

Post by basch » Tue, Jun 30, 2020, 4:07 PM UTC

zeepzeep wrote: post #406

coldtea wrote: post #397

Earlier quoted context omitted.

> My app isn’t untrustworthy at all either. That's up to the user to decide. For me trustworthy = something like Basecamp, Amazon, etc, not some random small app.

> That's up to the user to decide. > trustworthy = [...] Amazon Good point, because your example includes one of the few companies I don't trust at all.

different types of trust.

Trust not to misuse.

Trust not to leak in a breach.

Realistically, my email address is something I trust Amazon with both of, because email isnt how they spam me, they are smart enough they can identify me without my email address, and I expect their security to be more hardened and battle tested.

Re: Why we won’t be supporting Sign in with Apple

#445

Post by dev_tty01 » Tue, Jun 30, 2020, 4:13 PM UTC

nikitaga wrote: post #332

dev_tty01 wrote: post #300

Earlier quoted context omitted.

You can create an iCloud account with your own email address. That avoids getting another email address. When using Apple login, Apple offers the choice of providing an anonymous email to the third party or your actual email. It's up to you. Its about user choice. More privacy or less. Apple wants you to have a choice. Use it or not.

Then why do most of my non-tech relatives have an @icloud.com address that they never needed and never read? Blame the user all you want, but their "choice" was guided by Apple designed UI and Apple provided defaults. Whatever it is, it's producing optimal outcomes for Apple and no one else.

I can't answer that. However, if you go to appleid.apple.com to create a new AppleID, you must use an existing email address.

When I create a new user account on the mac, it asks the new user if they want to create an AppleID. The default is to use their existing email address. You must specifically select an option to get an iCloud account. If you purchase an Apple device, you again have the option of an iCloud account or using your existing email address for your AppleID. Apple is not using some deceptive UI to get you to create an iCloud email address.

However, I guess you still feel it is somehow evil that Apple does allow you to get a free email account where the provider does NOT read your email content and use it to target ads at you. Suboptimal for Apple from a pure profit perspective.

Re: Why we won’t be supporting Sign in with Apple

#446

Post by oramit » Tue, Jun 30, 2020, 4:14 PM UTC

After reading the article and comments i'm honestly a bit baffled.

Why is email address obfuscation an important component of online privacy? There are so many other more invasive and pernicious privacy concerns to worry about. It seems like we're spending an enormous amount of time to build far more complex authentication systems that are brittle and confusing just to avoid sharing an email address. Why?

Email addresses are supposed to be semi-public. If I share it with you I want you to contact me. People do abuse this, of course, but the open nature of it is exactly its best quality. I can sign up for new services easily, they can contact me, and if they bother me I block them.

I've had the same email address for almost 20 years now and have never had issues managing it. I cannot say the same for Facebook connect and Google Auth. I actively avoid signing up for services if I have to use a 3rd party auth service.

Re: Why we won’t be supporting Sign in with Apple

#447

Post by martini333 » Tue, Jun 30, 2020, 4:16 PM UTC

cry me a river

Re: Why we won’t be supporting Sign in with Apple

#448

Post by WorldMaker » Tue, Jun 30, 2020, 4:19 PM UTC

on_and_off wrote: post #357

tech-historian wrote: post #120

Earlier quoted context omitted.

Sure, except there is no documentation for it. From the article: "For example, Apple vaguely states that you can implement Sign in with Apple on Android, but there is no direct documentation on how to do it. We understand that Apple probably doesn’t care much for Android, but if they are going to provide a login system, and are going to force developers of multi-platform apps to adopt it, then providing no real suppo…

Also, even if they support it, it does not look like Apple has released an app or SDK for Android. So there would be no apple account registered on the phone. So each app wanting to implement apple login would have to : - pretty much implement it from scratch - still have a very subpar experience compared to any other login mechanism (even way worse than email + password) since they would have to ask users to find th…

Sign in with Apple asks for your normal iCloud email address. It's Apple's servers that look up your app-specific obfuscated relay email address if you've used one for the app.

Re: Why we won’t be supporting Sign in with Apple

#449

Post by ric2b » Tue, Jun 30, 2020, 4:19 PM UTC

oramit wrote: post #446

After reading the article and comments i'm honestly a bit baffled. Why is email address obfuscation an important component of online privacy? There are so many other more invasive and pernicious privacy concerns to worry about. It seems like we're spending an enormous amount of time to build far more complex authentication systems that are brittle and confusing just to avoid sharing an email address. Why? Email addre…

An e-mail address is as close to a unique id of a user as you can get online.

It makes cross-site/service tracking very easy.

Re: Why we won’t be supporting Sign in with Apple

#450

Post by on_and_off » Tue, Jun 30, 2020, 4:44 PM UTC

WorldMaker wrote: post #448

on_and_off wrote: post #357

Earlier quoted context omitted.

Also, even if they support it, it does not look like Apple has released an app or SDK for Android. So there would be no apple account registered on the phone. So each app wanting to implement apple login would have to : - pretty much implement it from scratch - still have a very subpar experience compared to any other login mechanism (even way worse than email + password) since they would have to ask users to find th…

Sign in with Apple asks for your normal iCloud email address. It's Apple's servers that look up your app-specific obfuscated relay email address if you've used one for the app.

duh ! I blame my sleepiness for missing that.

Still pretty meh that it is the only solution of its kind without an sdk