Why we won’t be supporting Sign in with Apple • Hacker News Board

Re: Why we won’t be supporting Sign in with Apple

#351

Post by lrem » Tue, Jun 30, 2020, 7:31 AM UTC

qwerty456127 wrote: post #350

There are 3 major problems with this kind of sign-in from the user perspective they apparently omit: whenever you sign-up for a service B with an account at A (usually Google, probably applies to Apple, Facebook and the rest as well) 1. A will block your account at B at any time as soon as its (A's) algorithms realize they don't like you for some stupid reason they won't even tell you (which is icky but understandabl…

Why is 2 so obvious? I imagine many implementations would do that, but basically once you exchange your SSO token for the site-specific token, you could stop making any requests to the SSO provider. The only part of your SSO provider's offering that inherently needs to track you is running detection if you're a bot.

Re: Why we won’t be supporting Sign in with Apple

#352

Post by vladvasiliu » Tue, Jun 30, 2020, 7:32 AM UTC

tigershark wrote: post #346

vladvasiliu wrote: post #325

Earlier quoted context omitted.

I agree with the sibling in that defaults are powerful. However, I've never built anything directly used "by the public", nor am I very familiar with how Apple Sign in works. So I'm wondering, as the developer of a trustworthy app, what's the drawback in the user giving an obfuscated address? Is it not possible for you to contact the user using this address? Does the user have to manually allow getting mail to this a…

As explained in the article a lot of people use the iCloud mail for their apple account and they don’t check it because they use another provider main mail address. Furthermore if they contact them from their email for support they have no way to associate it with the mail registered in the system, so they can’t help them. If you ask me they seem both very valid points.

> if they contact them from their email for support they have no way to associate it with the mail registered in the system, so they can’t help them.

Thanks for the clarification, I didn't think of this scenario.

This looks like a pretty big problem, as I can imagine a situation where the user doesn't have access at all to the app and may not have kept the initial email with any identifying info.

Isn't there an easy way for the user to know which obfuscated address was used for which app?

Re: Why we won’t be supporting Sign in with Apple

#353

Post by spullara » Tue, Jun 30, 2020, 7:42 AM UTC

crazygringo wrote: post #157

As they point out at the very bottom, all their arguments apply to all third-party sign-ons, so they're removing Facebook as well. So there's nothing specifically against Apple, despite the title seeming to imply it -- just that they're taking the move right now because of Apple's new policy coming into effect. I've got to say, I really wish there were a way to know whether I already used Facebook, Google, or Apple t…

This is as close as we got trying to do it from the app itself: https://www.lukew.com/ff/entry.asp?1906

I absolutely agree that password managers could remember this stuff. Single-signon is pretty easy to identify and you could setup the relationship.

Re: Why we won’t be supporting Sign in with Apple

#354

Post by Loulybob » Tue, Jun 30, 2020, 7:47 AM UTC

jzzskijj wrote: post #40

muro wrote: post #18

Earlier quoted context omitted.

I've never seen an app that required a FB or Google login. It was always possible to use email+password.

Pokemon Go's account own doesn't work. Even if you manage to create that account, it won't log you in. With Google account it works as expected. I tried to create two Pokemon Go accounts, gave up and created a Pokemon Go only Google account for child's playing. It has worked a few years.

Pokemon Trainer Club accounts (what you thing of as "Pokémon Go accounts", even though they're used for other Pokémon services) in the past were more buggy than Google accounts, but for at least the past two years I have had no more trouble with my account than my friends who have Google accounts. Additionally, they created a feature where you can link Google/FB to your PTC login so if it does go down in the future you can log in with those other services if you wish.

Re: Why we won’t be supporting Sign in with Apple

#355

Post by ludditetech » Tue, Jun 30, 2020, 7:48 AM UTC

Well opined piece, as a customer of Anylist for over 3 years you have my full support in this decision.

Re: Why we won’t be supporting Sign in with Apple

#356

Post by [deleted] » Tue, Jun 30, 2020, 7:49 AM UTC

crazygringo wrote: post #157

As they point out at the very bottom, all their arguments apply to all third-party sign-ons, so they're removing Facebook as well. So there's nothing specifically against Apple, despite the title seeming to imply it -- just that they're taking the move right now because of Apple's new policy coming into effect. I've got to say, I really wish there were a way to know whether I already used Facebook, Google, or Apple t…

[deleted]

Re: Why we won’t be supporting Sign in with Apple

#357

Post by on_and_off » Tue, Jun 30, 2020, 7:51 AM UTC

tech-historian wrote: post #120

WorldMaker wrote: post #112

> Furthermore, if there are platforms where AnyList doesn’t support Sign in with Apple, like Android, and someone wants to log into their account, they’d have to know their privaterelay.appleid.com email address. (And that certainly won’t be easy to find if you no longer have an iOS device.) And then they’d have to create a password with us, since they wouldn’t be able to sign in using Sign in with Apple. The easy an…

Sure, except there is no documentation for it. From the article: "For example, Apple vaguely states that you can implement Sign in with Apple on Android, but there is no direct documentation on how to do it. We understand that Apple probably doesn’t care much for Android, but if they are going to provide a login system, and are going to force developers of multi-platform apps to adopt it, then providing no real suppo…

Also, even if they support it, it does not look like Apple has released an app or SDK for Android.

So there would be no apple account registered on the phone.

So each app wanting to implement apple login would have to :

- pretty much implement it from scratch

- still have a very subpar experience compared to any other login mechanism (even way worse than email + password) since they would have to ask users to find their obfuscated apple email address.

Re: Why we won’t be supporting Sign in with Apple

#358

Post by necovek » Tue, Jun 30, 2020, 7:52 AM UTC

rahimnathwani wrote: post #194

crazygringo wrote: post #157

As they point out at the very bottom, all their arguments apply to all third-party sign-ons, so they're removing Facebook as well. So there's nothing specifically against Apple, despite the title seeming to imply it -- just that they're taking the move right now because of Apple's new policy coming into effect. I've got to say, I really wish there were a way to know whether I already used Facebook, Google, or Apple t…

"all their arguments apply to all third-party sign-ons" No they don't. Other sign-on options don't obfuscate the email address. They are likely removing FB login as otherwise their next app update will be rejected by Apple for supporting third party login but not Apple login.

Nor do they demand you implement their SSO system if you use any SSO or your app would not be available.

That's a pretty big argument specifically against Apple!

Re: Why we won’t be supporting Sign in with Apple

#359

Post by CiaranMcNulty » Tue, Jun 30, 2020, 7:53 AM UTC

jessaustin wrote: post #289

JAlexoid wrote: post #284

Earlier quoted context omitted.

Sure you can. But they explain why it's not applicable for their use case. And I would literally blow up at Apple, if they forced this on TripIt... Sharing trip information is done using registered email. And iCloud email is crap.

Sharing trip information is done using registered email. Could you provide any details? How is such "registered" email different than any other email?

"by using the email account you registered with"

Re: Why we won’t be supporting Sign in with Apple

#360

Post by envolt » Tue, Jun 30, 2020, 7:57 AM UTC

crazygringo wrote: post #157

As they point out at the very bottom, all their arguments apply to all third-party sign-ons, so they're removing Facebook as well. So there's nothing specifically against Apple, despite the title seeming to imply it -- just that they're taking the move right now because of Apple's new policy coming into effect. I've got to say, I really wish there were a way to know whether I already used Facebook, Google, or Apple t…

Not all.

1. Apple obfuscate email - this complicates the support system, and as per them Apple hadn't thought about it thoroughly. Collaboration is obstructed. Password recovery is not an easy process. 2. Cross Platform - The post states that Apple vaguely says that sign in on Android is possible, but doesn't state how it is to be done.