Live data from Hacker News

Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

marco.org

41–50 of 110 posts

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#41

It's actually Apple's fault, they should offer an API for this kind of thing!

It's not Apple's fault. If I ask for your gmail user / pass is that fine because there's no API ?

If Google listed your fishing attack in a recommended app list, then yes, it would be Google's fault.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#42
post #14
post #8

Earlier quoted context omitted.

You don't need to at all. I use two separate Apple IDs on my iOS devices. Apple ID accounts are individually configurable for most, if not all iCloud/App Store services.

If no one uses a feature the feature might as well not exist.

As plenty of people do use that feature, I'm not sure of your point.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#43
post #32

Okay, I have a question. AppleID and pw non-withstanding, I have experienced the following. I played Where's my water2 recently and came to the end where you have to pay to get additional levels. No biggie, I did this with the first game as well. But, when I clicked the in app purchase and entered my password I was prompted with a pop saying I needed to answer my 3 security questions next. Of course I hit cancel and…

I had the same request from inside one of Apple's apps. I think Apple just want you to update your security questions. I logged into the AppleID site, appleid.apple.com, and updated the questions there. Relaunched the app and no more questions.

I think you get 3 or 4 tries before they lock your account, I had gotten 1 question wrong 2x an didn't want the account locked because of a typo.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#44

Admittedly, Android does it much better by providing oAuth, an easy way to get the users sign in, and of course APIs for almost all the popular features. And also, for installing $0 apps you don't need any credit card details at all. Even the buttons are different "Install" v/s "Buy".

>> Admittedly, Android does it much better by providing oAuth, an easy way to get the users sign in, and of course APIs for almost all the popular features.

First of all this has nothing to do with iOS/Android. This is an app trying to access a web service. Apple needs to provide oath or similar for accessing their iCloud services.

>> And also, for installing $0 apps you don't need any credit card details at all. Even the buttons are different "Install" v/s "Buy".

This is untrue. I couldn't download any free apps until I had setup a merchant account with credit card.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#45
post #23
post #8

Earlier quoted context omitted.

You don't need to at all. I use two separate Apple IDs on my iOS devices. Apple ID accounts are individually configurable for most, if not all iCloud/App Store services.

To quote JWZ: "You have invoked the "Oh, but there's a preference to turn off that stupid behavior" defense. I am showering you with negativity." (Yes, it's not a preference pedantically, it's an option to create multiple accounts. Still the default and most used is using one account).

I'm an engineer an I didn't know you could use two accounts for different tasks on the same device. Just never thought about it, because why would I? Not a reasonable workaround, I agree.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#46
post #38
post #14

Earlier quoted context omitted.

If no one uses a feature the feature might as well not exist.

Who doesn't use this feature? Single people, that's who. People with families have known about this feature for years. The sales staff at the Apple Stores specifically bring it up.

Yeah, I suppose single people have no interest in security, so poorly devised workarounds are ok.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#47
post #15

Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…

Unfortunately, you are asking your users to engage in an inherently unsafe behaviour. Even if your implementation is rock solid, users shouldn't get used to supplying AppleID credentials to random applications.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#48
post #29
post #15

Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…

Can you explain how it is possible to generate secure tokens? I can't find anything related to it from the iCloud documentations.

I'm guessing, that they simulate an iCloud login and then store the cookie on their servers and then use that cookie to login in the future?

But thinking about it, it's a CalDAV server which normally uses email + password to authenticate..

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#49
post #15

Hey everybody, Pierre from @sunrise. This is the blog post we've just published to give more context: "Users sometimes ask us why we require the user’s Apple ID and password in Sunrise, instead of using the local Calendar API. That’s a great question to ask, and we understand why users don’t want to share their credentials without context. We’ve thought a lot about that. The two reasons why we are doing this are: - o…

We understand our users, they want a unified Sunrise experience everywhere, and so we can’t use a local API for that.

Of course you can, but you need to do extra work to store and synchronise calenders.

Re: Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password

#50
post #45
post #23

Earlier quoted context omitted.

To quote JWZ: "You have invoked the "Oh, but there's a preference to turn off that stupid behavior" defense. I am showering you with negativity." (Yes, it's not a preference pedantically, it's an option to create multiple accounts. Still the default and most used is using one account).

I'm an engineer an I didn't know you could use two accounts for different tasks on the same device. Just never thought about it, because why would I? Not a reasonable workaround, I agree.

> Just never thought about it, because why would I?

Anyone with family members using their iTunes account would and has for many years. That's why it's there.

Post reply on HN