14 ms·

It seems like it could be really good for users, but the fact that it's _required_ for any apps that use other 3rd-party sign-in options and that it's _required

by habosa 7y ago

It seems like it could be really good for users, but the fact that it's _required_ for any apps that use other 3rd-party sign-in options and that it's _required_ to be listed first among those options leaves a bad taste in my mouth. I can't even imagine what would happen if Google did the same thing with Google Sign In and the Play store. Disclaimer: I work for Google, not on anything related, and am speaking for myself (as always).

redbergy 7y ago
I know what you're saying but I'm okay with it. In this case Apple chose users over developers. iOS developers have to do a little more work (Apple has made it very easy from what I've seen of the framework) and have a little less freedom but users signing in to apps using 3rd party auth are guaranteed the privacy protections Apple is promising. They drew a line in the sand by making their solution mandatory but I think they had to to deliver what they're promising to users (which I think is great).
- stefano 7y ago
  That privacy seems a bit overboard though. This is fine if a user can create his account directly inside the app. But it's not very clear how to support a workflow where you have an organization with multiple users authorized by an admin to use the app. How can the admin add a user to his organization, if he doesn't know in advance the user randomly generated email? I guess you could send an invitation code, and let the user enter that code after the apple sign in, to associate the account to the authorized user. This sounds more complex for the user than a workflow where the admin can directly authorize specific emails.
  - MBCook 7y ago
    Does this apply to enterprise apps distributed outside the normal App Store? I bet it doesn’t. Also I think you’re given the choice of using your real email address instead if the anonymizes one. At least that was my understanding.
    - saagarjha 7y ago
      App Store guidelines have no bearing on enterprise apps.
  - cavisne 7y ago
    The randomly generated email is a user choice, they can also provide their real email. The randomly generated one would not work for things like slack sso etc.
olliej 7y ago
It's not required to be first, it's "suggested" :-/ But lets look at it another way: * I buy an app on the App Store, and then find out that I have to use FB or Google login. * So to use the app I have purchased I am required to allow the app and/or Google or Facebook to further their abuse of my privacy. Alternatively: * An App is shown as "Free" * I install it, and it require FB or Google sign in. That isn't free. Again, signing up for abuse of my privacy is not free.
- nahtnam 7y ago
  However it is _required_ that you add Sign in With Apple. I'm all for privacy but I disagree with this move because apple said "You must add Apple Sign In" rather than "You must allow one form of anonymous login" which means they are forcing developers to use their tools. Additionally, if the app only has FB or Google login and you don't use either, you can just not use the app
  - olliej 7y ago
    The problem here is very basic: Why should an app be listed as free if using it requires sacrificing my privacy to use it? That's fundamentally not free. If the app cost me money then I've purchased an app I cannot use. This is very simple: they're saying that you cannot require Apple's (and by extension your) users to submit to abuse of their privacy in order to use your app.
    - stickfigure 7y ago
      This "they're stealing my privacy!" outrage is tiresome. Someone built an app; it authenticates a certain way; if you don't like it, uninstall it. Both Google and Apple offer near immediate refunds. But really there's some due diligence required here - installing an app is not like visiting a web page, you should take a little care what you spend money on. You're complaining that someone else is building apps in a way you don't like. That's their right; they aren't building them for you.
      - 7y ago
on_and_off 7y ago
I am very uneasy with this as well. Apple has just leveraged their position as the iOS gatekeepers in order to obtain a huge marketshare of the SSO market.
- hector_vasquez 7y ago
  The SSO "market" is only a market if the SSO providers are monetizing your data at the expense of your privacy. Private authentication is not a "market" almost any of us needs or wants, but rather a right that we deserve.
  - jamiequint 7y ago
    It's also a "market" if you happen to run one of the largest payment networks in the world (Apple Pay) and if having users signed in with your service gives you the ability to let them easily provide payment information through you to the exclusion of your competitors (Amazon Pay, Google Pay, etc).
    - kalleboo 7y ago
      Apple Pay is a feature of the iOS SDK and Safari browser, not a feature of the login system. Which method you used to login doesn't change the friction of paying with it.
      - ma2rten 7y ago
        But it easily could in the future.
  - sushid 7y ago
    Not sure why you've put "market" in quotes there. Okta is literally a SSOaaS that has a $14 billion market cap.
    - scarface74 7y ago
      Does anyone use Okta outside of the Enterprise? No enterprise focused app is going to allow any random third party credentials. Okta is also not by any definition a “social network”.
Gaelan 7y ago
My understanding is that putting SIWA first is in their Human Interface Guidelines, which (nominally) are not mandatory. Some apps have been rejected for HIG violations, however, so maybe they'd enforce that (but I doubt it). Plenty of HIG-violating apps make it into the App Store, so they definitely don't enforce all HIG violations.
mithr 7y ago
Apple knows that for most people (unlike this website's audience), the privacy concern is not as important as using That Cool New App, and if this was just another option developers could, but didn't have to implement, many apps would choose not to -- and most people would still download them. The only way to make sure that most users' email/login/usage isn't being sold or used to track them is to force developers to offer Apple's auth option, and make it as easy to use as choosing to log in with Facebook or Google. > I can't even imagine what would happen if Google did the same thing with Google Sign In and the Play store. If Apple made its money by mining its users' data, there would be a big uproar about this announcement, too. But Apple made it very clear that they will not be doing that with this data, and is moving more and more towards establishing itself as the privacy-focused alternative to Google... So this is by and large (and obviously there are many people with reservations, whether about Apple forcing developers' hands, or about trusting a big company in general) being seen as more of a Good Thing.
scarface74 7y ago
Well, maybe if Google didn’t do stuff like trick users into installing privacy invasive apps by using developer certificates that were only suppose to be used for internal apps you might have a leg to stand on....
- lern_too_spel 7y ago
  Can you point to anyone who was tricked? I signed up for that program myself. It was very clear what I had signed up for. I wasn't tricked into it any more than a Nielsen family is tricked into getting paid to use a Nielsen box.
  - scarface74 7y ago
    You’re comparing a Neilson box with installing spyware on your phone that can intercept every piece of information you send across the internet? Not to mention that Google knew that the certificates were meant for internal use only and agreed to the terms.
    - lern_too_spel 7y ago
      > that can intercept every piece of information you send across the internet? Just like a Nielsen box, the app collected clearly specified data, and users were paid for it.
      - scarface74 7y ago
        From the link you posted it wasn’t clear that it could intercept anything. Can a Neilson box intercept my emails? My account details and drain my account?
        lern_too_spel 7y ago
        > From the link you posted it wasn’t clear that it could intercept anything. That's Apple's fault if the permission screen didn't show that. What the app actually collected was different from what it had OS permission to collect and was clearly described to the user.
antpls 7y ago
To me this is a fair rule and benefetial for the end users, it will give more options to them. It simply says "if there are competitors, you must include us". I'm not an Apple user, but I would expect Apple to provide and guarantee that you can log in any app with your Apple login. Seems fair to me. Also, I'm pretty confident that Google offering a privacy-oriented SSO on Google Play would be appreciated by everyone. Privacy on Android is such a joke : any app can freely read the accounts present on your phone, they don't even need you to sign in to identify you
jeroenhd 7y ago
Google should just add a similar requirement in response. With this rule Apple is forcing their signup method to be taken up across all platforms (web, Android, iOS) because you can't only enable logging in with Apple on one platform. If Google were to implement the same requirement, any cross platform app with Apple's login would also now have a Log in with Google button, making sure that Apple won't be getting any Oauth monopoly any time soon just to keep them in check.

by habosa 7y ago

redbergy 7y ago

I know what you're saying but I'm okay with it. In this case Apple chose users over developers. iOS developers have to do a little more work (Apple has made it very easy from what I've seen of the framework) and have a little less freedom but users signing in to apps using 3rd party auth are guaranteed the privacy protections Apple is promising. They drew a line in the sand by making their solution mandatory but I think they had to to deliver what they're promising to users (which I think is great).

stefano 7y ago
That privacy seems a bit overboard though. This is fine if a user can create his account directly inside the app. But it's not very clear how to support a workflow where you have an organization with multiple users authorized by an admin to use the app. How can the admin add a user to his organization, if he doesn't know in advance the user randomly generated email? I guess you could send an invitation code, and let the user enter that code after the apple sign in, to associate the account to the authorized user. This sounds more complex for the user than a workflow where the admin can directly authorize specific emails.
- MBCook 7y ago
  Does this apply to enterprise apps distributed outside the normal App Store? I bet it doesn’t. Also I think you’re given the choice of using your real email address instead if the anonymizes one. At least that was my understanding.
  - saagarjha 7y ago
    App Store guidelines have no bearing on enterprise apps.
- cavisne 7y ago
  The randomly generated email is a user choice, they can also provide their real email. The randomly generated one would not work for things like slack sso etc.

olliej 7y ago

It's not required to be first, it's "suggested" :-/ But lets look at it another way: * I buy an app on the App Store, and then find out that I have to use FB or Google login. * So to use the app I have purchased I am required to allow the app and/or Google or Facebook to further their abuse of my privacy. Alternatively: * An App is shown as "Free" * I install it, and it require FB or Google sign in. That isn't free. Again, signing up for abuse of my privacy is not free.

nahtnam 7y ago
However it is _required_ that you add Sign in With Apple. I'm all for privacy but I disagree with this move because apple said "You must add Apple Sign In" rather than "You must allow one form of anonymous login" which means they are forcing developers to use their tools. Additionally, if the app only has FB or Google login and you don't use either, you can just not use the app
- olliej 7y ago
  The problem here is very basic: Why should an app be listed as free if using it requires sacrificing my privacy to use it? That's fundamentally not free. If the app cost me money then I've purchased an app I cannot use. This is very simple: they're saying that you cannot require Apple's (and by extension your) users to submit to abuse of their privacy in order to use your app.
  - stickfigure 7y ago
    This "they're stealing my privacy!" outrage is tiresome. Someone built an app; it authenticates a certain way; if you don't like it, uninstall it. Both Google and Apple offer near immediate refunds. But really there's some due diligence required here - installing an app is not like visiting a web page, you should take a little care what you spend money on. You're complaining that someone else is building apps in a way you don't like. That's their right; they aren't building them for you.
    - 7y ago

on_and_off 7y ago

I am very uneasy with this as well. Apple has just leveraged their position as the iOS gatekeepers in order to obtain a huge marketshare of the SSO market.

hector_vasquez 7y ago
The SSO "market" is only a market if the SSO providers are monetizing your data at the expense of your privacy. Private authentication is not a "market" almost any of us needs or wants, but rather a right that we deserve.
- jamiequint 7y ago
  It's also a "market" if you happen to run one of the largest payment networks in the world (Apple Pay) and if having users signed in with your service gives you the ability to let them easily provide payment information through you to the exclusion of your competitors (Amazon Pay, Google Pay, etc).
  - kalleboo 7y ago
    Apple Pay is a feature of the iOS SDK and Safari browser, not a feature of the login system. Which method you used to login doesn't change the friction of paying with it.
    - ma2rten 7y ago
      But it easily could in the future.
- sushid 7y ago
  Not sure why you've put "market" in quotes there. Okta is literally a SSOaaS that has a $14 billion market cap.
  - scarface74 7y ago
    Does anyone use Okta outside of the Enterprise? No enterprise focused app is going to allow any random third party credentials. Okta is also not by any definition a “social network”.

Gaelan 7y ago

My understanding is that putting SIWA first is in their Human Interface Guidelines, which (nominally) are not mandatory. Some apps have been rejected for HIG violations, however, so maybe they'd enforce that (but I doubt it). Plenty of HIG-violating apps make it into the App Store, so they definitely don't enforce all HIG violations.

mithr 7y ago

Apple knows that for most people (unlike this website's audience), the privacy concern is not as important as using That Cool New App, and if this was just another option developers could, but didn't have to implement, many apps would choose not to -- and most people would still download them. The only way to make sure that most users' email/login/usage isn't being sold or used to track them is to force developers to offer Apple's auth option, and make it as easy to use as choosing to log in with Facebook or Google. > I can't even imagine what would happen if Google did the same thing with Google Sign In and the Play store. If Apple made its money by mining its users' data, there would be a big uproar about this announcement, too. But Apple made it very clear that they will not be doing that with this data, and is moving more and more towards establishing itself as the privacy-focused alternative to Google... So this is by and large (and obviously there are many people with reservations, whether about Apple forcing developers' hands, or about trusting a big company in general) being seen as more of a Good Thing.

scarface74 7y ago

Well, maybe if Google didn’t do stuff like trick users into installing privacy invasive apps by using developer certificates that were only suppose to be used for internal apps you might have a leg to stand on....

lern_too_spel 7y ago
Can you point to anyone who was tricked? I signed up for that program myself. It was very clear what I had signed up for. I wasn't tricked into it any more than a Nielsen family is tricked into getting paid to use a Nielsen box.
- scarface74 7y ago
  You’re comparing a Neilson box with installing spyware on your phone that can intercept every piece of information you send across the internet? Not to mention that Google knew that the certificates were meant for internal use only and agreed to the terms.
  - lern_too_spel 7y ago
    > that can intercept every piece of information you send across the internet? Just like a Nielsen box, the app collected clearly specified data, and users were paid for it.
    - scarface74 7y ago
      From the link you posted it wasn’t clear that it could intercept anything. Can a Neilson box intercept my emails? My account details and drain my account?
      - lern_too_spel 7y ago
        > From the link you posted it wasn’t clear that it could intercept anything. That's Apple's fault if the permission screen didn't show that. What the app actually collected was different from what it had OS permission to collect and was clearly described to the user.

antpls 7y ago

To me this is a fair rule and benefetial for the end users, it will give more options to them. It simply says "if there are competitors, you must include us". I'm not an Apple user, but I would expect Apple to provide and guarantee that you can log in any app with your Apple login. Seems fair to me. Also, I'm pretty confident that Google offering a privacy-oriented SSO on Google Play would be appreciated by everyone. Privacy on Android is such a joke : any app can freely read the accounts present on your phone, they don't even need you to sign in to identify you

jeroenhd 7y ago

Google should just add a similar requirement in response. With this rule Apple is forcing their signup method to be taken up across all platforms (web, Android, iOS) because you can't only enable logging in with Apple on one platform. If Google were to implement the same requirement, any cross platform app with Apple's login would also now have a Log in with Google button, making sure that Apple won't be getting any Oauth monopoly any time soon just to keep them in check.