35 ms·

Apple Sign In

• minimaxir 7y ago
  Per a screenshot in the Keynote, Sign in with Apple will also work on the Web, which will be interesting.
  • oh_hello 7y ago
    They already offer Apple Pay on the web. I imagine the experience will be similar here.
    • minimaxir 7y ago
      True, although that would imply Sign in with Apple would be Safari-only, which might be a hard sell.
      • saagarjha 7y ago
        Might be a JavaScript API like MusicKitJS, since I don’t see this requiring hardware support.
      • forthwall 7y ago
        Safari has a really high market share on mobile, so I would not discount it especially for non-power users who primarily just use their phone.
• mjlee 7y ago
  Disposable, anonymous email forwarding is a massive step forward for privacy. I know we've all been doing it for a while, but this on a consumer level is fantastic.
  • pmart123 7y ago
    I wonder how many poorly designed database schemas this will break that used email as a primary key/id.
    • saagarjha 7y ago
      I think the email is consistent for each app, so there should only be a problem if the user wants to change their email, right? Plus, apps would have to opt-in to support this.
    • not_kurt_godel 7y ago
      Why would this break any databases? Accounts will still have valid emails. The difference is just that there won't be data for that email in third-party tracking databases, which is a good thing.
    • dmix 7y ago
      I don't think you'll find much sympathy for someone who's software would break on such a change. That sounds broken already.
      • beat 7y ago
        Yeah, it doesn't break anything. It just reveals that it was already broken.
  • albertgoeswoof 7y ago
    If you don’t use apple, I just built this as a stand-alone product: https://idbloc.co https://idbloc.co
    • nextos 7y ago
      There is also spamgourmet, which is free and has been around for 20 years.
      • albertgoeswoof 7y ago
        Unfortunately they’re not accepting new signups
        • dvtrn 7y ago
          Is there by chance a Firefox add-on on your product roadmap? This looks interesting
          • albertgoeswoof 7y ago
            Thanks! It’s already available as a Firefox and chrome add on: https://addons.mozilla.org/en-GB/firefox/addon/idbloc/ https://addons.mozilla.org/en-GB/firefox/addon/idbloc/ https://chrome.google.com/webstore/detail/idbloc-secure-and-unique/jhjhmcgfjgfnbolmedfhbbjeidjpmajl?hl=en https://chrome.google.com/webstore/detail/idbloc-secure-and-...
        • nextos 7y ago
          Oh, I hadn't noticed. Your service looks nice, and if spamgourmet is not taking new signups it does make even more sense.
    • bglusman 7y ago
      This looks a lot like 33mail (https://33mail.com/ https://33mail.com/) which I've been using pretty happily for 4-5 years now (and paying I think $10-15 a year for, so a lot less than this on a per month basis, but they're not strictly unlimited)
  • snarf21 7y ago
    I agree that it is great. I'm not sure how we convince people to not signup on sites that don't offer this SSO option. I've always struggled with the question of 'How do we convince people to care about privacy when they post their location and meal to a public social media every hour?'.
    • hprotagonist 7y ago
      My rule, and it is a semi-idiotic one, is "i don't impulse buy from independent merchant websites that don't support apple pay at checkout". I usually email them after, too. "I actually clicked through your instagram ad, looked at some clothes that looked nice, and didn't buy anything because I was on my phone and didn't want to make a new account and add credentials to my password manager. Have you considered adding apple pay support to your shopify account?" I have no idea if i'm helping or not.
      • reaperducer 7y ago
        It's dumb that so many sites require you to create an account just to buy something from them. One of the reasons I get lunch from Panera and Pei Wei is because I can check out on my phone as a guest when I order ahead. Heck, even fleaBay lets you do a guest check out now. That was what made me consider using it again.
      • bscphil 7y ago
        I think it's not an idiotic idea, it's just that your idea of what counts as third-party payment support is a single smaller payment provider located mainly in the United States. I follow a similar policy, but in my case the third-party payment services are Paypal, Stripe, and Coinbase, all of which are reliable and don't require me to give financial data to the seller. Paypal seems to be near-universally supported on small ecommerce sites.
        • oefrha 7y ago
          Note that PayPal gives away your email address, and I’m not a fan of that. If a third party wants my email address, they should ask me directly (and I’ll give them a unique one); PayPal shouldn’t distribute my email address for me. Look, I use three email domains for online accounts, in addition to a unique address for each account — one domain that links to my actual identity (my public-facing, professional domain), one domain that’s somewhat anonymous, and one domain reserved for highly sensitive accounts, e.g. online banking, PayPal, AppleID, etc. And PayPal sharing my email address with third parties breaks the model, making my sensitive domain less secure.
  • anbop 7y ago
    And being done by Apple, most services can’t just reject these the way they do with Mailinator addresses, since it would be throwing away a giant chunk of their revenue. Apps with huge consumer demand like Uber or Facebook could get away with it, but not the vast majority of apps.
    • jiveturkey 7y ago
      I think this will be proven wrong. Do you think that the folks using Mailinator are strictly non-Apple users? As an Apple user that signs up with a mailinator ID, if rejected I either move on or use a more palatable address, as the case may be depending on my desire to use that service. The same will hold true for any private appleid address.
      • untog 7y ago
        You're missing the scale. Mailinator users are a very small percentage of users, while Apple Sign In users are likely to represent a much larger slice of your potential users, given that you have a honking great button there waiting for them.
      • anbop 7y ago
        I’d say that one month from release, 100 times as many people will know about Sign in With Apple as have ever used Mailinator. And Apple marketing will drill into them why they should use it, and mark apps in the App Store that support it. Eventually for experimental apps that they are not 100% decided on getting, there will be a large fraction of users who simply won’t try an app that doesn’t support it.
      • dan-robertson 7y ago
        I think there are two differences here: 1. Services have little incentive to support mailinator, and indeed may deliberately choose not to if they feel it is leading to signups they don’t like. On the other hand it would be hard to argue with an incentive like the App Store requiring you to support apple’s service. 2. Because the service is built in to apple’s systems there seems to be an implicit contract that apple wont let it be abused for the purposes that many sites claim mailinator is used for (because it isn’t useful to apple customers if sites don’t trust it and it). So they might be more willing to accept these email addresses. I guess neither of these help services like mailinator gain credibility.
  • taytus 7y ago
    My first thought was: Bye bye mailinator.com
    • throaway5533 7y ago
      I use mailinator to have some privacy from my email provider.
    • jacquesm 7y ago
      As if everybody uses Apple.
      • taytus 7y ago
        what is the need to have such a knee jerk reply? Seriously, why would you say something like that? My comment meant: "Bye bye " for me. As in: I'm not using it anymore. I don't get you man.
        • Permagate 7y ago
          I'm not the commenter. But taken at face value, your comment could be either bye bye mailinator.com (I'm not using you anymore) or bye bye mailinator.com (no one is going to use you anymore). Fwiw, I thought you meant the latter until I read your reply.
          • taytus 7y ago
            Thank you. I can see that. But if anyone really is curious about the meaning and needs clarification, I believe it’s best to ask.
            • throaway5533 7y ago
              I would have never thought you meant the former. I believe it’s better to be more clear and evident in your writing.
  • nothrabannosir 7y ago
    In case anyone needs something similar today: Outlook already allows you to create ephemeral top-level aliases, i.e. XXXX@outlook.com. You can use this to sign up, then delete the alias. It can't be traced back to your account and nobody blocks @outlook.com. https://account.live.com/names/Manage https://account.live.com/names/Manage (not to take away from this announcement at all; just to provide some context. it's an often overlooked feature which people here might appreciate.)
    • throaway5533 7y ago
      I switched to Outlook because of this. I also like how you can set it so only a specific email can login. That way if your alias is compromised, your account won’t be.
    • ocdtrekkie 7y ago
      Microsoft's email management has some neat perks here: You can change which one's the primary as well. It's entirely possible for you to change the email address of your Microsoft account, by adding an alias, making it primary, and then deleting the original. In fairness, there are some quirks with this, my old email address would still get sent some receipts or some newsletters because the configuration for service A, B, or C was buried somewhere else in the account. But generally speaking, it works pretty well. As someone who changed their name but had to keep their Google account with the old one because of how much Google account data/purchases can't be moved to a new account, this felt positively revolutionary. Google accounts can only have one Gmail address for their entire lifetime.
    • iwasakabukiman 7y ago
      Apple also lets you do this with your Me/iCloud address as well.
    • basch 7y ago
      I dont think thats quite the same thing as an Identity Service, its just a component. In Microsoft's world im either using my Microsoft Account to sign in OR using throwaway email addresses, not both. . Apple can get way ahead of the competition by combining about 3 things. 1) Ephemeral email addresses 2) OAuth or apples equivalent tokens 3) Keychain autogenerate and auto-populate If all those products are integrated correctly, this becomes the SINGLE sign on of single sign ons. If a service supports Apple OAuth, your name is hidden, and you only have one Apple password to remember. If the service doesnt support Apple Tokens, then apple fills in a private email address and a random password, and abstracts away the fact that the service doesnt support Apple Tokens. The user experience is nearly the same regardless. Tokens and randomly generated passwords should be managed from the same interface, allowing you to either revoke access (token) or cycle the key (both.) I've felt it for a while, but the banking industry needs to arrive at something similar. Chase, BoA, WF, and Citi should turn Zelle into a banking OAuth Identity Service.
  • Pym 7y ago
    I've been trying for some time to explain to my friends and family how a unique email/password + 2FA strategy is the best thing to do and how it would allow them to cut one in case it gets leaked. I guess I will just tell everybody about "Sign in with Apple" now, it will be easier.
    • damnyou 7y ago
      Will you also tell that to your Android or Windows using friends?
      • aendruk 7y ago
        You can tell them it's a valuable category of service that they should want an analog of.
      • Pym 7y ago
        Family is easy, I made them switch to Apple years ago and things have been a breeze since. Most of my friends using Android are also working in IT and are already using disposable/forwarding emails AFAIK. And... to be honest, I don't have friends using Windows :D
    • notlukesky 7y ago
      Take a look at SAASPASS Authenticator & Password Manager. It might meet your criteria of usability and security.
      • eropple 7y ago
        It's only polite to disclose that it's your company when you flog it like that.
  • buildbuildbuild 7y ago
    They also have pretty strict whitelisting requirements around who can send emails to these privacy addresses. "In order to send email messages through the relay service to the users’ personal inboxes, you will need to register your outbound email domains. All registered domains must create Sender Policy Framework (SPF) DNS TXT records in order to transit Apple's private mail relay. You can register up to 10 domains and communication emails." https://help.apple.com/developer-account/#/devf822fb8fc https://help.apple.com/developer-account/#/devf822fb8fc
    • moduspol 7y ago
      Neat. It sounds like this extra step prevents a situation where, for example, a dev's server-side database gets hacked and the users' relay e-mail addresses are exposed. The attacker wouldn't even be able to send e-mail messages to the users. He'd also need to compromise the registered domain's mailservers, or their DNS servers (to modify the SPF records), or their Apple dev account to add their own registered domain.
      • deleted 7y ago
        [deleted]
  • aasasd 7y ago
    I was wondering why all the popular ‘private’ email services don't seem to have such a feature.
  • ljm 7y ago
    Apple is evolving and adapting in a way the rest of the industry can’t follow. And, they have the money to do it. For as long as Android has google ownership... they will never, ever be able to compete on the level of privacy that Apple is now buying into.
  • codezero 7y ago
    Totally agree. I set this up for myself to have a anything@mytrowawaydomain.com and it's great to see when folks sell your email :) So far it's only happened once, actually, when Keen.io got bought by a PE firm, I got a bunch of spam, so they clearly sold off my email address. It's a system that would be hard to operate as a "normal" person, so this is a great step.
    • josephwegner 7y ago
      As a former (pre-sale) Keen employee, this makes me sad. I'm very sorry.
      • codezero 7y ago
        No worries. I am at least glad the product is still alive. Despite being a competitor, there is a lot to admire about the offering. I am really bummed it didn't come out ahead of other competitors :)
  • kukabynd 7y ago
    Agreed, I think it’s the most important part of the demo today.
• gnicholas 7y ago
  Does this require that every device you'd wish to use to sign into the service be an Apple device? That is, if you're signing up for Netflix with this, would you be able to access your account from a Roku box?
  • gkoberger 7y ago
    I imagine you'd have to get the private email from your iPhone, similar to how 1Password works.
    • gnicholas 7y ago
      And it appears from the image that the private email would be a bear to type into another device.
      • tzs 7y ago
        Hopefully, more devices will move away from requiring you to type anything into the device to sign in. Quite a few devices or apps on devices have already done so. Instead of having you enter the account ID and password directly, they give you a URL to visit that is something like https://<device-maker>.com/add-device https://<device-maker>.com/add-device, and show you a random code. You go to the given URL in your normal browser on whatever device you normally use for web browsing, where you can login to your account at <device-maker> and enter the code the device gave you. A few seconds later the device notices you've completed this, and you are then automatically signed in on that device.
• pletnes 7y ago
  This is a natural step that I’ve been waiting for for years. This can almost remove the need for password typing, as you don’t even need one to unlock the device anymore. Let’s hope Microsoft does the same, and integrates with apple’s solution. A lot of people are on iOS+Win10 for laptops.
• empath75 7y ago
  Finally an excuse to delete my Facebook account completely. SSO was the only reason I was still using it. I do wonder how many sites will actually implement it.
  • driverdan 7y ago
    Why do you need SSO? Password managers make it easy to manage accounts.
    • ben509 7y ago
      PMs don't make it easy, they make it reliable and central. The default password generation usually doesn't work, and a web form doesn't capture everything, but I'm never clicking and guessing even when I haven't used an account in years. But SSO wins on mobile, because the PM is clunky even with a custom keyboard. Even then, I keep a dummy entry in my PM just so I'm tracking it.
      • basch 7y ago
        Mobile Dashlane and Lastpass work much better on Android, where the OS allows you to set default apps. If Apple deserves any antitrust spankings its for not allowing user control of protocol handlers and default programs.
        • djrogers 7y ago
          iOS allows you to set your default password manager...
          • basch 7y ago
            I thought that was just default AutoFill? It allows saving passwords to your password manager too?
            • rootusrootus 7y ago
• grenoire 7y ago
  "This domain is not allowed."
  • r00fus 7y ago
    Is this a current issue you're having or your expected industry response?
  • keymone 7y ago
    yeah, and say goodbye to your app on app store and hundreds millions users.
  • chrisshroba 7y ago
    While websites do blacklist temporary email providers like Mailinator, I think Apple has more power here; blocking the domain can be pegged as more of an anti-privacy move than blocking Mailinator, which is more anti-spam.
• bxio 7y ago
  Google's + and . trick on a dummy-proof, invisible, consumer level. Nice!
• jeroenhd 7y ago
  Will this service be available on the web? I get the feeling that this will only be available on iOS, meaning that you lose access to all your accounts if you decide to switch to Android.
  • malloreon 7y ago
    ios, macos, web, all announced.
• nwsm 7y ago
  What's the incentive for apps to offer it? Now they don't get user data.
  • dthedev 7y ago
    Convenience and access to Apple's user base who partake in the service. Those are the main reasons I used Google and Facebook sign-in on my website.
  • the_watcher 7y ago
    There are plenty of applications that don't actually care about the additional data they could arguably get from a Google/Facebook login, and only offer it because one click sign-up/login drives more signups.
    • nwsm 7y ago
      In cases of a trustworthy third party, what is the concern of linking to Google/Facebook account compared to an Apple account that doesn't offer any data? I don't think I've seen any instances of Facebook integration credentials being hacked/stolen.
      • the_watcher 7y ago
        In reality, pretty much nothing (particularly since now, third parties basically only get name + email). The value is that some (small or large) number of potential users might not know or believe that and trust Apple more.
        • rootusrootus 7y ago
          Ha, I can't imagine why I might trust Apple more than Facebook or Google. /s
  • nihonde 7y ago
    They still get user data. They just can’t tie it to a real person outside the scope of their app.
• hk__2 7y ago
  I can already see devs implementing things such as `if email domain ends in privaterelay.appleid.com reject the email address and ask for a "real" one`, like what already exists for yopmail and others.
  • chinhodado 7y ago
    The difference is Apple is too big of a player to ignore.
  • Tomte 7y ago
    But now they block "normal users", not nerds. And there are many of normal users. I'm not sure if they could sustain such a policy.
  • moduspol 7y ago
    Such a dev would likely just not implement "Sign in with Apple". This is for the devs that specifically want the minimal-friction sign-in.
    • dcbadacd 7y ago
      Some screenshots display that it also works on the web, I'd love to find out how exactly but I ain't buying an Apple device and a developer license for that.
  • cal5k 7y ago
    The difference here is that Apple can reject apps that do this from the App Store.
• pishpash 7y ago
  Some sites now seem to check whether an address is valid from some database or heuristic, because a random email with a valid domain is still rejected.
  • kyboren 7y ago
    There is definitely a phenomenon of checking for prohibited email domains. However, absent extra-functional motivations like user data collection, smart developers don't bother with heuristics for email addresses much beyond the presence of an '@' character. If you want to know if a purported email address is deliverable, try to deliver email to it.
• ycombonator 7y ago
  This is awesome news for developers ! They should have done this years ago.
• dyarosla 7y ago
  Can’t services just disallow/block this address? Fun thing is, Apple themselves block name+addon@gmail.com addresses when using their dev console. You can bet that some companies will disallow Apple’s signature private passwords similarly if they can, in the name of ‘security’ or what have you. Or am I being too cynical? Feel free to CMV. EDIT: best response addressing this seems to be ‘The addresses are only generated from the "Sign In With Apple" workflow that a developer has to enable in the first place’
  • wvenable 7y ago
    No, you're clearly correct. But Apple pushing this does give it a sense of legitimacy and blocking signups from this service might just cause less signups than actually forcing people to use their real address. If Apple makes this extremely user friendly and quick to use than blocking it will cause a loss of signups.
    • dyarosla 7y ago
      Devils advocate: ‘Error: We love Apple and anonymity but we require a real email address to prevent fraud and to properly secure your account. Please enter your real email address.’
      • untog 7y ago
        Then you get kicked out of the App Store. (potentially)
      • saagarjha 7y ago
        This sounds like a way to get your app rejected for abusing APIs.
        • dyarosla 7y ago
          In an app I agree. On a website signup however..?
• ramon 7y ago
  I loved the concepts! Cannot wait to see the site with the SDKs and all.
• AJRF 7y ago
  Someone who is not apple should do this and charge for it. I'd pay $10 for something like that
  • gowld 7y ago
    You would pay, but no one would build a company for the $1M total revenue this would bring in
  • danShumway 7y ago
    Don't Fastmail aliases already work the same way? That's $5 a month for 600 private email addresses, which (for me at least) is more than enough to cover all of the services I use. Unless they're easier to re-associate with your main account for some technical reason I'm not aware of?
  • r2ut3u 7y ago
    check out maskmail.net it's basically the same thing
• olliej 7y ago
  How long until sites start blocking the cloaked addresses? (although of course Apple can just churn those address patterns)
  • JustSomeNobody 7y ago
    How long until those sites cease to exist?
• zenbane 7y ago
  I'd like to have something similar for actual physical mailing addresses, perhaps UPS or Fedex could offer this.
  • lumens 7y ago
    Shyp tried to do this ~4 years ago. Very challenging problem.
  • ChicagoBoy11 7y ago
    My local UPS office in NY can accept packages on my behalf for a very small sum of money. Do you mean something more extensive than that?
  • ceejayoz 7y ago
    PO boxes?
• lghh 7y ago
  What is forcing the sites that I'd want to use a fake email address with to use this? It wouldn't be in their interest to. They will just stick with their current SSO setup of Google/Facebook/whatever and never touch this, if they have SSO at all. I LOVE LOVE LOVE the idea, I just don't know if it will be useful and successful.
  • jdminhbg 7y ago
    Nothing is forcing them to, and lots probably won't. The carrot is the much lower friction for sign up for users. It's similar to Apple Pay, where you don't get credit card info, but you do get a much easier user flow that will get you more signups.
    • DuskStar 7y ago
      But will it be lower friction than login with Google or Facebook? It feels like it's more common for someone to have an account from one of those two than from Apple, and so "sign on with Apple" will never be able to be the only SSO option, while Google or Facebook could be. If the better (for the site) SSO options also have near-universal market penetration, what's the incentive to add Apple?
      • awinder 7y ago
        I would venture a guess that apple/icloud accounts are the highest % account type amongst iPhone holders. All sorts of people have reasons for not having gmail / facebook / etc., but apple account setup is pretty prominent in device setup.
        • DuskStar 7y ago
          Sure, it might be the highest % among iPhone holders - but for a website, what portion of your users are going to be iPhone holders, and what portion of the Windows/Android crowd have Apple accounts?
          • 7y ago
• simonhamp 7y ago
  This is the ultimate way to manage your incoming email - I’ll be filtering everything based on the `to:` address when this rolls out and my life will be wonderful again
• buboard 7y ago
  So this is only for mac/iphone users? That's not a large enough segment to warrant adding a sign in option for most sites. Would be nice if Mozilla had done something similar with Persona.
  • ilikehurdles 7y ago
    Something like 58% of site visits are from mobile browsers, and mobile Safari makes up over half of all mobile browsers. Of course, your mileage may vary, but that's a pretty large segment.
    • buboard 7y ago
      So its like 25% of Americans and much less everyone else. Plus you will be at the mercy of apple if they decide to remove your app, plus if you need an actual usable email, you have to ask for a second email. Sounds a bit confusing, they shouldnt have tied this to email address.
• jbeckham 7y ago
  Maybe I'm cynical, but this looks more like a data hording scheme than a protect my privacy enhancement. If I use Google to sign in, Google and the app has that data and can monetize it. Now if I sign in using Apple, they are going to have the data to monetize. They may keep the app from getting my information, but that means that their data is better than someone else's data, so it is more valuable. Also, they are getting app usage statistics that I may have opted out of at the OS level, but they now have due to having the sign in history.
  • prdonahue 7y ago
    Who do you trust more _not_ to do sketchy stuff with your data, Apple or Google? For me it's unequivocally Apple.
    • peeters 7y ago
      Problem is, today I agree, 10 years ago it would've been a tossup, and 5 years from now, who knows? These "trusted central broker" privacy models are nicer than giving your info to dozens of individual actors (when you trust that central broker more than anyone else), but they also become a single point of attack/failure.
      • lotsofpulp 7y ago
        You will never be able to know the future, you can only make decisions based on information available now.
        • peeters 7y ago
          My point is some of the information available now is that historically, companies that respect your privacy today might not tomorrow. And might only be respecting your privacy to get a monopoly on your data so they can exploit it later.
          • threeseed 7y ago
• kevin_b_er 7y ago
  Companies already massive dislike fake/temporary emails. Go find a throwaway email service and you'll find many many websites blacklist them. I'll actually be angry if Apple succeeds, because it'll just mean I can only have private email address as an apple customer and not anywhere else. Many companies might make an exception for Apple, but not anyone else.
  • crooked-v 7y ago
    On the other hand, if Apple succeeds, this gives a clear route to push for other services that work the same way.
  • thrill 7y ago
    This is neither a fake nor a temporary email. It is unique, made specific by the combination of the user's appleid and the target app/website, and permanent in that it will remain the same. The ability of the user to automatically discard/block content sent to the email address doesn't change this, as it's no different other than (probably) more convenient than setting up a bunch of spam filter rules for those "services" that refuse to remove your address.
    • Xelynega 7y ago
      It says in the article that it's a 'unique, random address', so I don't know where you're getting the 'combination of the user's appleid and the target app/website' from. The purpose of the service is the same as other temporary email services, to anonymize signing up for services by providing a fake email.
• dpq 7y ago
  Sounds like a good time to remind people about Telegram having a similar function for quite some time now. And just yesterday they announced a feature to simplify logging into web sites using TG bots: https://telegram.org/blog/privacy-discussions-web-bots https://telegram.org/blog/privacy-discussions-web-bots It might be a personal choice, but for stuff when privacy is really important I'd definitely pick Telegram over Apple, no matter how much the latter claims to keep me safe from three-letter agencies as well as marketers.
  • saagarjha 7y ago
    > I'd definitely pick Telegram over Apple Why?
    • eitland 7y ago
      Works everywhere with the devices and OS you have like (or can afford): Android, Linux desktop, Mac, iOS, Windows and more.
      • Asmod4n 7y ago
        Telegrams end to end encryption is locked to the two devices which started it, so it’s totally useless when you want it across devices.
        • eitland 7y ago
          How is this related to login?
    • dpq 7y ago
      For a start, I don't own, and don't want Apple devices. Also, stories about FISA overreach, PRISM, the rest of the alphabet soup plus gag orders do not particularly inspire confidence.
      • w3rhn2j34oh5o 7y ago
• kartikeye 7y ago
  Privacy BS. This is their way of tracking you around the web.
  • saagarjha 7y ago
    Why would they need to do this?
    • kartikeye 7y ago
      Gives them valuable insight on user priority & needs. One who has it controls the web. This is what Google has and Apple wants it too. Only difference is Apple won’t sell it, just use it to refine its product service mix. Google/FB do both besides preempting/ buying emerging competitors.
      • saagarjha 7y ago
        Apple has never shown any inclination for doing this.
  • mcphage 7y ago
    If they needed to do this, they already control the browser.
• schaum 7y ago
  If they implement it in OIDC they basically randomize the mail address for every application? What about the other scopes? https://auth0.com/docs/scopes/current/oidc-scopes https://auth0.com/docs/scopes/current/oidc-scopes
• ruffrey 7y ago
  We've been thinking about this for Mailsac.com. It is already possibly but clunky. Considered making browser plugins to make it easier to create and route disposable addresses, and "black hole" disposable email addresses once it's clear they've been resold to advertisers.
• baxtr 7y ago
  Sounds promising, because this is where Apple is really got at: taking something “at the fringes” and taking it to the mainstream.
• Scrantonicity 7y ago
  Doesn't this also lock in users to Apple? Will I still be able to use these apps on other devices?
  • inapis 7y ago
    If Apple discloses the generated email id. But the given examples seem very tedious to type.
• yamann 7y ago
  This has to be a joke. The only purpose for this BS is to provide Apple more information about your activity around the web since they are at a big disadvantage compared to Google and Facebook.
• jiveturkey 7y ago
  How will this be different that anon.penet.fi? (Besides the data being held in the US, where it is very much in reach of the authorities; Apple isn't going to shut down the service to uphold some privacy principle vs a government authority.)
• mrb 7y ago
  I love that TC chose a picture of "fc452bd5ea@privaterelay.appleid.com" to illustrate the article. When was the last time you saw a service that could be described by a single "word"?
  • buboard 7y ago
    Why do they resort to hexadecimal usernames instead of using the entire alphabet for shorter names?
  • ignoramous 7y ago
    If I showed it to my mom, she still wouldn't know what was up. The genius would be in to make the UX frictionless and disposable addresses the default. Let's see how Apple executes this. They do absolutely pull UX stuff off from time to time. So, that's there.
• thrill 7y ago
  I updated my AppleID since I haven't used it in years (have other devices) in anticipation of implementing this as soon as it's available on a site I'm working on. It appeared they offered two-factor authentication to get away from those 1990's type of security questions. Ah, not so fast - 2FA is only enabled with Apple devices. Poor play there, Apple. This service looks like something sorely needed - bring the rest of the flock into the fold and let everyone plug in their Yubi key.
  • Tepix 7y ago
    FIDO U2F or TOTP. On the other hand it‘s perfectly understandable that they use his to sell their hardware.
    • thrill 7y ago
      Google doesn't limit who can login by their device manufacturer, but the supposed privacy focused company does?
      • freewilly1040 7y ago
        Yep, the privacy focused company makes money selling hardware rather than ads.
        • thrill 7y ago
          So, the privacy draw is just another gimmick to them, and not a supposed part of their DNA?
          • asaddhamani 7y ago
            If you're not paying them, they need to pay for you to use their services. And to do that, they will want to make their money back on that. It is a good thing that they're not giving their services away for free; they're putting their money where their mouth is. If you look at all the companies that give their stuff away for free, they do it to collect data for advertising, and they make money from advertising, in most cases (unless they're using investor money to fund you). Apple is not an advertising company, and I do not see any problem in them using this to draw in customers. It is a major selling point for Apple that they respect your privacy. They do a lot of their ML stuff on-device to preserve your privacy, they encrypt your data on their servers or anonymise it whenever possible, they do a lot to prevent apps from tracking you like limiting location access and other data, etc.
• NN88 7y ago
  Apple is ahead of the game officially.
  • throaway5533 7y ago
    Outlook.com has allowed email aliases for a really long time.
• Justsignedup 7y ago
  While I like this for privacy purpose this is pretty nafarious. There is no mechanism by which you can use this sign-on without Apple. That means you are stuck with these specialized accounts you would need to re-setup once you leave apple. Just another lock-in. This is definitely not the first time apple does anything like this. If apple really cared they would make a tool for any device or operating system to enable this. But they will not.
  • Aaronn 7y ago
    ... if you looked at the screenshot of the app they showed it also had sign up without using Apple Sign in and just using a email address.
    • danShumway 7y ago
      You might be misunderstanding what the poster was talking about -- it's not that you'll need an Apple ID to sign up for a site, it's that once you sign up with an Apple ID, you might not have a way to link your account to a different email address. That effectively means that you'd need to recreate your account when you move away from Apple. Of course, the other side of that is that sites are probably going to have ways to link accounts, and it likely won't be a huge deal. They certainly have no motivation to help Apple with lock in. It's not going to be any different from the process that exists today for moving associating an email with an account you created through Google/Github signin. Still, it would be nice to have a way to use this without an iPhone, or it will be a (small) extra piece of friction you just have to deal before moving ecosystems, rather than piecemeal after getting a new phone. Also note that the same exact concerns exist with Google/Facebook sign in, it's just that they aren't tied to a physical device so you only need to worry about losing them if you're making a conscious decision to delete your account.
  • judge2020 7y ago
    This is something solvable by the service provider. Services can allow you to sign up with Apple, but hopefully they also allow you to link other social accounts and/or set up a password for login without IDP.
• masnick 7y ago
  For a while now I’ve been using “someservice.com@account.mydomain.me” when signing up for accounts. I use FastMail for my email hosting, and they allow you to turn on wildcards for any custom domain. I don’t get any spam because it’s at a subdomain — never enable *@mydomain.me because you will get a mountain of spam to admin@, webmaster@, etc.
• beenBoutIT 7y ago
  When Apple users use this to commit fraud/trolling/stalking/etc. and get tracked down it's going to make Apple look bad.
  • busymom0 7y ago
    Not really. It's still linked transparently behind the scenes to your Apple ID. The connection won't be visible to the developers but the fraud etc will already be taken care of when signing up for your Apple ID.
    • beenBoutIT 7y ago
      The reality is that it won't do much to protect users privacy or prevent tracking, although it will make it easier for users to avoid spam filling up their inboxes.
• mindgam3 7y ago
  This is a huge move. Apple striking at the core of Facebook's play to own your identity, which they had with Facebook Connect but have completely fudged out with countless breaches of user privacy and trust. I used to be the biggest fanboy of facebook connect, but now I have to say: Go Apple.
  • basch 7y ago
    Apple ID as SSO, iMessage Profile, Memoji, and Apple Pay. Apple is near FB Messenger parity, now that it functions as an account for external services. It's an extremely strong move on Apple's part, especially considering how close to it they have been for a while. They sure like taking their time sometimes.
    • mindgam3 7y ago
      True. Apple definitely playing the long game here, effectively. When iMessage came out I totally didn't see it ever becoming a viable identity play. But with all these privacy concerns, now it feels like the one to beat.
      • damnyou 7y ago
        How can I access iMessage from my Linux laptop?
        • mindgam3 7y ago
          Not sure if that's possible. iMessage is a mobile first product, so presumably you need an iPhone to start using it. Then a Mac computer. It's definitely a closed system that works great if you buy into Apple's family of products, less great otherwise.
          • damnyou 7y ago
            I know it's impossible. Since I don't have any Apple phones iMessage is useless for me. The vast majority of people in the world are similar to me. Apple's products are not a play for anything. Their services are built for people with more money than sense.
• busymom0 7y ago
  I develop apps myself and I am 100% onboard with using this instead of offering the signup with google or facebook buttons (can offer those as secondary options). I might even push users slightly to use this instead of others as it gives my apps a bit of extra trust worthiness imo. Only question I have is if it's possible to integrate this on websites and for non-apple products too? Because I would like my app which is available on Android too to be able to use this. EDIT: Apple's site says it will be available on websites too. Let's hope it's available on non-apple devices too: > Apple is introducing a new, more private way to simply and quickly sign into apps and websites. https://www.apple.com/ca/newsroom/2019/06/apple-previews-ios-13/ https://www.apple.com/ca/newsroom/2019/06/apple-previews-ios...
  • atticmanatee 7y ago
    On the presentation they said it would be available on web and android.
    • busymom0 7y ago
      Thanks, I was reading the docs and apparently it will be available for websites too and comes with a JS library which will let me use it on Android too. I am quite excited for this as a developer.
• gigatexal 7y ago
  This single feature shown off today at WWDC has solidified my forever lock-in on all things Apple and especially iOS: no longer will my email be sold needlessly or be spammed and my logging into to different web properties sold to marketers and ad networks and data aggregators. I trust Apple a whole lot more becaUe they charge and arm-and-a-leg for high end hardware and soon services because the products and services are the products not their users.
  • basch 7y ago
    As soon as Keychain can abstract away passwords completely (rando generation, never need to show the user the password), so an end user cant tell if a site supports Apple SSO or if Apple is just emulating SSO, Apple deserves to be crowned the Identity Winner.
    • gigatexal 7y ago
      This would be amazing.
    • pat2man 7y ago
      There is a session on WebAuthN on Thursday.
      • equalarrow 7y ago
        This is the bigger news I think and what people should really be paying attention to.
      • lucasverra 7y ago
        if you are attending, could you share your learnings and how can we, outside the conference, can have access to the information displayed?
        • Redoubts 7y ago
          https://developer.apple.com/wwdc19/live/#!/room/ https://developer.apple.com/wwdc19/live/#!/room/ This may host it live, but all presentations are recorded and will be here soon.
• piokoch 7y ago
  Am I correct that TechCrunch page violates GDPR? I don't see any option to opt-out from being tracked. There is OK button and manage option link, but I can't manage anything, I can only agree for tracking...
• parliament32 7y ago
  I'm not an Apple user, and don't own any of their products, but this is a great step forward for privacy. I'm happy to see companies prioritizing privacy for users. That being said, any company that actually cares about collecting users' identities (you know, the ones you'd actually want to use this for) will definitely block @privaterelay.appleid.com from being used. Apple would've been better off using a well-known domain and having both private and non-private addresses on it, like @me.com .
• buboard 7y ago
  So what if in the future apple decides they dont want to allow your website to use it anymore (because e.g. it violates their UX guidelines)?
• fenbielding 7y ago
  If anyone needs this right now, we've been offering this for a while with https://www.faircustodian.com https://www.faircustodian.com Lots more planned for the future of personal privacy protection too.
• yalogin 7y ago
  Emails from companies already have a unsubscribe button. So if I unsubscribe they shouldn't send me emails. That is not changing with the new Apple Sign In feature. Emails will still have the unsubscribe feature. The only reason for devs to push for a real email is to sell it to advertisers. They are not deleting the email once I unsubscribe. So giving them an ankoymized email is good. I hope this succeeds.
  • tartuffe78 7y ago
    Many spam emails I get these days from companies say things like "Unsubscribe from this list" so for example I have to unsubscribe from their "Daily Digest", "Weekly Digest", "Recommendations", etc. all one at a time.
    • SOLAR_FIELDS 7y ago
      And there's no guarantee how many of those "lists" you are on with some softwares. You might have a one-click unsubscribe, but you just one-click unsubscribed from the first of 100 lists you were placed on for that company.
• ashtonian 7y ago
  Orr you could buy a domain, and use a catch all email rule and then use an unique rmail address per site. Like mybank@mydomain, yourepamsite@mydomain ect.. I've never had any security problems.
  • danShumway 7y ago
    How would that help with tracking? The domain you buy will be a unique identifier that's owned only by you. What tracking will this defeat that couldn't also be thwarted by putting dots and plus modifiers in a Gmail address?
• ashtonian 7y ago
  Wish all the cc companies would do this with their numbers. Some do.
• buildbuildbuild 7y ago
  It seems you must first have an *OS app in order to use Apple Sign In on the web, a $100/year barrier to entry for web developers verses Google/Facebook auth. "To configure web authentication, you must create a Services ID and associate your website to an existing primary iOS, macOS, tvOS, or watchOS App ID enabled for Sign In with Apple." Source: https://help.apple.com/developer-account/#/dev1c0e25352 https://help.apple.com/developer-account/#/dev1c0e25352
  • rezz 7y ago
    Sounds like a great SAAS opportunity.
• gameguy43 7y ago
  This is neat. But I'd have thought the lower-hanging fruit anti-spam wise for Apple would've been to add a "mark as spam" button next to push notifications so users can start reporting all the apps that abuse push notifications to send them advertisements.
• ricardobeat 7y ago
  Whoa. Apple is picking up where Mozilla’s ball dropped, but with a massively better chance of success. Cheers to whoever is running this show.
  • loceng 7y ago
    Tim Cook and the Board of Directors, no? Of course there will be other who initiated and are spearheading the effort to include in the cheers.
  • move-on-by 7y ago
    Mozilla dropped the ball on this? They never had an opportunity to do this. Apple will only succeed by bulling developers that want to stay in the AppStore. Mozilla doesn’t have the market share or financial leverage to do anything like this.
    • ricardobeat 7y ago
      https://en.wikipedia.org/wiki/Mozilla_Persona https://en.wikipedia.org/wiki/Mozilla_Persona > Mozilla doesn’t have the market share or financial leverage to do anything like this Precisely. There was very little incentive for websites to adopt it at the time; Apple has a lot more power.
      • move-on-by 7y ago
        They tried, they didn’t have a way to force it on companies. Not sure how that’s considered dropping the ball?
• sdan 7y ago
  Is this Safari only or for all browsers?
• deleted 7y ago
  [deleted]
• ChrisMarshallNY 7y ago
  I'll use it.
• maxheadroom 7y ago
  This is a great idea but it kind of falls short. Elaboration with example: LinkedIn is notarious for swiping up any data points that it can find. Your carrier, your GPS location, etc. As long as there are two or more data points to successfully tie you to that id, it's already game over. It'll just be added to your "targeted advertising profile" and, given the wrong company getting ahold of it (looking at you, Equifax), sold/traded on the advertising market to third-party advertisers to build better profiles because... ...advertising dollars? Anyways, the premise is cool but I think - without addressing the dragnet that is targeted advertising - it'll just be a minor inconvenience, which will be conquered over time with the collection of enough data points to tie it back to the "you" that they already know. ...unless you start-off with a brand new phone (new IMEI) and don't associate any old accounts with it, that is.
  • minhazm 7y ago
    Apple doesn't allow you access the IMEI or even Mac address. And they announced at WWDC today that they're locking down people scanning for wifi access points + bluetooth beacons to determine location also. The purpose of this isn't to make you anonymous. It's just to make sign on a little simpler and for apps that you think might not be super trustworthy or apps that don't actually need your email address you can choose to give them this proxied one. Obviously social accounts and other applications that will ask for your real name will know who you are.
  • pluffycat 7y ago
    It’s a step in the right direction. One step at a time.
• groovybits 7y ago
  This is similar to Abine's Blur service, which provides a throwaway phone number, and (seemingly) infinite throwaway emails addresses that can forward to your own personal email address. https://www.abine.com https://www.abine.com
• dooglius 7y ago
  Does this effectively kill the ability for services to have sign-up promo codes?
• pndy 7y ago
  Isn't there a flaw? What does stop service provider/application vendor from banning this relay domain and force users to provide real email address for data-mining purposes aka "ensuring that service/app will work"? Unless of course that Apple would deal with those who would go for this
• stirner 7y ago
  I used to do something similar when I ran my own mail server. Whenever I created an account for a new service, I would add an entry to /etc/aliases e.g. news.ycombinator.com: stirner and sign up for the service as news.ycombinator.com@mydomain.com. If I ever left a service, I would just remove the corresponding alias and restart Postfix. I eventually got tired of the work required to avoid spam filters and switched to iCloud Mail, so I’m glad to see this feature built in.
• plonkus 7y ago
  I like that you can use the feature on the web too, but it appears you need a paid developer account to generate the client id/secret https://developer.apple.com/documentation/signinwithapplerestapi https://developer.apple.com/documentation/signinwithappleres...
• ngcc_hk 7y ago
  Great. I guess also you need to use apple machines to remember the email address and any password for you. Sometimes they ask for it.
• bound008 7y ago
  Free disposable forwarding email addresses that you can turn off. Built on the startup bus years ago: http://boun.cr http://boun.cr MailGun ( a YC company ) was providing their API for free, until another company came along and offered to take over the project. All of the code and design was built on a bus from CA to ATX. (and one of the team members met their co-founder on that (StartupBus) trip and went through YC. I believe they are a unicorn now)
• tschwimmer 7y ago
  This is really good for consumers, but I'm afraid that many websites simply won't bother to implement this. Apple just doesn't have the unique marketshare that Google and FB have. The set of users that would use such a thing is the union of privacy focused users and users with an Apple ID and not a Facebook or Google account. This set is heavily overrepresented on HN but is relatively small overall. If I run foo dot com, is that set of users attractive enough to me that I'll spend the engineering time to implement this? I can't think of many instances where it would be.
  • dantheman0207 7y ago
    Might be true. Certainly it’s true that Apple represents a smaller user base then, say, Google or Facebook. But Apple users represent a disproportionately large subset of the users that spend money.
• countbackula 7y ago
  "Apple says it can authenticate a user using Face ID on their iPhone without turning over any of their personal data to a 3-p company." So is this feature exclusive to Face ID and iPhone? Would users, Face ID enabled or not, be able to use it with only their iCloud email/ID? And would older iPhone models incapable of FaceID still be eligible? These may be just questions of a skeptical mind, but I really hope Apple isn't using a pro-user, pro-privacy feature to phase users out of older models.
• dcbadacd 7y ago
  Unfortunately there's no way to implement this as a OAuth2 flow and without having an Apple device. Seems unreasonable to require an Apple dev account just for providing sign up - it can be tested without installing apps or just borrowing an iPhone.
• cfarm 7y ago
  Google and FB will likely copy this asap.
• xalava 7y ago
  In order to read this article you must redeem your privacy to more than a dozen companies or go through five screens with a confusing UX to change parameters. Oh Irony
• jedikv 7y ago
  Great feature, shame it's tied to apple hardware - making it inaccessible to those who cannot afford it.
• shaneos 7y ago
  Seems like a direct copy of MaskMail.net Nice to have the product validated, but never fun when a giant just duplicates your business
• polutropos 7y ago
  According to the App Store review guidelines update posted today, Sign In with Apple will be required for any iOS app that implements a single-sign in button. "Sign In with Apple will be available for beta testing this summer. It will be required as an option for users in apps that support third-party sign-in when it is commercially available later this year." https://developer.apple.com/news/?id=06032019j https://developer.apple.com/news/?id=06032019j
  • jiveturkey 7y ago
    that smells like an anti-competitive behavior. obviously apple has considered this and is forging on anyway. good for them.
    • nihonde 7y ago
      Competition is not anti-competitive. Excluding other third party sign on options would be problematic if Apple were abusing a dominant position among smartphone makers, which is not the case by any objective measure.
      • sb8244 7y ago
        Is it problematic if Apple says "you must include us if you include anyone else?" That seems anti-competitive to me.
        • nihonde 7y ago
          That’s competing. Fair play unless you’re the dominant player in the relevant market.
          • maxerickson 7y ago
            Leveraging their status as the controller of the platform to require support for their solution is not the same thing as their solution competing head to head with other solutions. Note that I'm not making an argument about how to classify the behavior legally, I'm arguing that calling it "competing" is pretty generous.
• xtat 7y ago
  right, another one to ban
• xtat 7y ago
  2019 big tech innovation is basically finding ways to ensure only they have access to your data
• max76 7y ago
  On the downside if I use Apple Sign In on apps I probably won't be able to sign in to that application on my Android devices.
  • twiceaday 7y ago
    Or a non-Mac computer? I doubt it. This is likely just an Apple id sign-in that is progressively enhanced on ios / osx.
  • pat2man 7y ago
    They do have an sdk for web, will probably work on any platform with a web browser.
• nly 7y ago
  Using 'Sign in with X' with service Y means you're giving X, or anyone forcing X to abuse their position, full access to your account on Y. Additionally, anything sent to you@privaterelay.appleid.com flows through an Apple server. You can trust Apple with this now, but it's not so easy to revoke that trust later. Still, it's useful for throwaway signups and garbage I suppose.
• NightlyDev 7y ago
  "without turning over any of their personal data to a third-party company" Uhm.. If a user sign up on my site with apple sign in then they definetly will share personal data with a third-party: Apple. If user A wants to use product B and signs in using solution from C then C is the third-party.
  • paintstripper 7y ago
    Yeah, but lots of people including me trust Apple with their data. I sure as hell don't trust your site.
• cavisne 7y ago
  This is very cool in terms of security principles (no email that can be used to track you by default, mandatory 2FA, mandatory SPF for emails). The mandatory inclusion if you use third party SSO already (smart I think as otherwise FB and Google would probably start paying developers not to include it) aside, this will probably get a lot of uptake for apps that dont use SSO. Apps that people mainly use on mobile devices and TV's would benefit a lot from this (as these devices arent good for typing in complex passwords). Additionally larger companies would be concerned about letting Google or FB sell their user list to competitors for targeting. Apple already has all this information, so nothing is lost by enabling SSO.
• timothyduong 7y ago
  I've been predicting this since iOS 11! So good to see it come to fruition. Apple SSO :)
• skc 7y ago
  I'm no big fan of Apple, but I must say I get a perverse pleasure out of moves like this because you'd probably find that 90% of Facebook employees swear by and love Apple products.
• awfully 7y ago
  How is this going to work with all the websites that make you login with your email address? Gonna be super hard remembering them?
• jason46 7y ago
  Will this effect apps that i use on an ipad and an android phone that share a login?
• oneluv1464 7y ago
  I'm a student from Mbarara University of Science and Technology, here is my story. At first it was Samson Kojak who testified on how he got help from an HACK WIZARD. Tell the audience how this hacker helped deliver a debit card that can withdraw up to $ 5,000 a day. Later, Cathy Jolly who gave her testimony of how her husband whats-app,2months deleting messages,text, calls recording and facebook were hacked with the help of HACK WIZARD she had a chance to gain access to her husband's privacy, After reading all these posts. I contacted hack Wizard to increase my last year result which he said it will take him 7days but you will not believe WIZARD sent me an e-mail on the fifth day that the job is done,immediately I run to cybercafe to check it out. He increased my grade. I do not know if you believed my story but I can assure that CYBERWIZARD1995@GMAIL.COM TEXT/WHATSAPP +1 662 727 5740 is really genuine, do not be afraid to try it for all the hacking services you want.
• dontbenebby 7y ago
  Interestingly Mozilla tried something like this a while back: https://en.wikipedia.org/wiki/Mozilla_Persona https://en.wikipedia.org/wiki/Mozilla_Persona Sadly they cancelled it. (I was actually hired as an intern to work on it, but they stopped paid development between me accepting my offer and my arrival in SF)