3 ms·

You missed the point. There's no access because you can require end-to-end encryption for mails that use the forwarding system, just like the PGP remailer/forwa

You missed the point. There's no access because you can require end-to-end encryption for mails that use the forwarding system, just like the PGP remailer/forwarding systems, so the remailer node isn't subject to MITM. Moreover, if you're using "Sign in with X" in the first place, there's no password and no password reset. Key Exchange is the big MITM vulnerability. There's decades of experience now around building distributed identity. Bitcoin wallets are a large scale example of that. If we're going to finally flip the switch on not using verifiable, public email addresses as part of credentials, we should rip the bandaid off and get rid of the centrality all together.

scarface74 7y ago
So instead of asking developer to support another Oauth provider which should be a simple change, now they have to support an encrypted email system that isn’t widely supported. Also, an iCloud ID doesn’t require you to use an Apple email address. So you also have to have an email provider that supports E2E encryption.
- cromwellian 7y ago
  Sure, why not. Folks have no trouble laying on all kinds of requirements when GDPR is brought up, but now suddenly requiring S/MIME or alternatives is a bridge to far. If we're going to have single signon for the world, and finally get rid of passwords, it should not be locked into one OS platform. If I sign on from Apple, how go I log in on my Linux desktop or non Apple device?
  - scarface74 7y ago
    You’re depending on every single email provider and client to support it. GDPR is not a great example. A lot of American companies didn’t even bother and just blocked everyone with an EU IP address.
    - clay_the_ripper 7y ago
      Well as an end user, I do trust Apple. I want to put this in the hands of a for profit company that has the reach and know how to make this viable right now, not in some far distant future where adoption is low. While I like the idea, in practical terms the goal is: 1. Make a login system that is private, secure and easy 2. Have it be widely adopted right now 3. Have it work forever, seamlessly A for profit company with the reach of Apple is the perfect solution for all three points.

scarface74 7y ago

So instead of asking developer to support another Oauth provider which should be a simple change, now they have to support an encrypted email system that isn’t widely supported. Also, an iCloud ID doesn’t require you to use an Apple email address. So you also have to have an email provider that supports E2E encryption.

cromwellian 7y ago
Sure, why not. Folks have no trouble laying on all kinds of requirements when GDPR is brought up, but now suddenly requiring S/MIME or alternatives is a bridge to far. If we're going to have single signon for the world, and finally get rid of passwords, it should not be locked into one OS platform. If I sign on from Apple, how go I log in on my Linux desktop or non Apple device?
- scarface74 7y ago
  You’re depending on every single email provider and client to support it. GDPR is not a great example. A lot of American companies didn’t even bother and just blocked everyone with an EU IP address.
  - clay_the_ripper 7y ago
    Well as an end user, I do trust Apple. I want to put this in the hands of a for profit company that has the reach and know how to make this viable right now, not in some far distant future where adoption is low. While I like the idea, in practical terms the goal is: 1. Make a login system that is private, secure and easy 2. Have it be widely adopted right now 3. Have it work forever, seamlessly A for profit company with the reach of Apple is the perfect solution for all three points.