14 ms·

It also gives Apple far more control over the ecosystem. By not providing 3rd parties access to email, Apple makes themselves not only the controllers of the ph

• ddebernardy 7y ago
  > By not providing 3rd parties access to email, Apple makes themselves not only the controllers of the physical devices and also over the full identity of their users. No they're not. They're preventing third parties from accessing your data. You can communicate with your customers just fine; it's just that if you sell their data (or get hacked) the email you get is useless.
  • manigandham 7y ago
    The commenter is saying that Apple controls the email address and forwarding too, so you cant actually communicate with your customer if they don't want you to.
    • ddebernardy 7y ago
      Yes, and that's simply not true (if you want to be communicated with). You can communicate with the address just fine if you configure your email properly. The only "issue" is that there's a shortlist of valid from emails that you as a company need to configure before sending me an email. Dunno about you but insofar as I'm concerned: please f'ing sign me up for the same everywhere else! And just for clarity in case anyone reading thinks I'm some privacy concerned lunatic: I'm a marketer.
      • manigandham 7y ago
        This is not about configuration. Apple provides a proxied email and controls the forwarding. They can disable that and prevent the company from sending anything to a customer. What part of that is not true?
        • ddebernardy 7y ago
          I suspect that GP originally wrote "so you cant actually communicate with your customer", to which I answered in the next minute, and later added "if they don't want you to." (If not, my mistake for misreading.)
        • 8ytecoder 7y ago
          By that logic, Google controls Gmail and they can control access to your email.
          • manigandham 7y ago
            Yes, that's also a problem that people have brought up several times in other stories. Google/Gmail has outsized control, is a major source of spam, and changes or breaks email standards whenever they want. Centralization of communications is not a good thing and it's worth discussing whether we're going in the right direction.
          • bryanrasmussen 7y ago
            As I understand the original commenter's position it is that: 1. when your business is on the app store it can be difficult not doing whatever Apple wants you to do because not doing what they want you to do can come close to destroying your business. This has often been compared to being a hostage of Apple. 2. If you suddenly decide to stop paying the Apple tax or if Apple decides to ban you - cutting you off from new business - it can certainly be problematic and can kill many businesses but you could theoretically keep going because you could have a customer base you inform of your decision and tell them to download your app from your homepage instead of the app store etc. In short - in the event of Apple not liking you anymore you can communicate with your customers. 3. In this new setup if Apple does not like you anymore you cannot tell your customers hey Apple doesn't like me anymore. Thus Apple increases its ability to hold your company hostage and thus I do not believe it is the same logic as Google controls Gmail unless when selling an Android app Google only allows you to do so if your customer has a Gmail account.
    • thegayngler 7y ago
      If you trusted the company enough to give them your email address directly, I'm sure you would've done that. This is a great move. I get so much spam and I'd like to be able to not get it if I don't want it. Long after I've moved on from a service they are still sending me emails to get me back or to do some other transactions with them.
  • baddox 7y ago
    > it's just that if you sell their data (or get hacked) the email you get is useless. The parent commenter is correctly pointing out that Apple would be able to disable the email for other reasons as well.
    • m3kw9 7y ago
      By that logic Apple can disable your iPhone for other reasons etc etc
      • tolmasky 7y ago
        This would be a customer action — it affects one person. Unless you’re implying they’d disable the phone of every user of a certain app or something to that effect. With these emails they could trivially, and surgically, cut off a developer from every customer. It is a one-to-many action that also has no obvious other side effects (unlike bricking users phones). Not sure where I stand with this, but wanting to point out that the added powers this gives Apple are very real and different from the ones they had before (again, maybe this is a good thing, but it’s undeniable that it is a different thing).
      • baddox 7y ago
        I think the concern is that Apple could exert influence over third party apps/networks because they control access to all Apple users. That problem doesn’t really exist when it comes to Apple disabling entire iPhones of certain users.
      • caseysoftware 7y ago
        They absolutely could technically. The more important questions are: - Is there a big enough reason to motivate them to do so? - If given a "legitimate" justification, would they? If either of those are "yes" then the question we need to know is: "Is there any appeal, oversight, etc?"
        • vinay_ys 7y ago
          This is how it starts.
  • saghm 7y ago
    Is that true? If the only email address that a company has for a user is a forwarding address created through Sign In, wouldn't Apple banning the company from the App Store presumably also cause them to get rid of the email forward, meaning that nothing the company sends will actually reach the customer?
    • olliej 7y ago
      If a company is abusing Apple's users I'm sure that they could? But you're right, it does give Apple power, just the same power that has already ceded to Facebook and Google through their logins. The reality is that companies need to understand that user's are sick and tired of being spammed, and are rightly annoyed by needing to provide every company with their email address for no good [to the user] reason.
      • saghm 7y ago
        I think the difference is that with a Facebook or Google login, companies could also easily just require that they get permission to see the user's email address (which isn't super uncommon to see with OAuth logins), so they wouldn't need continual access to OAuth after the first login (unless a user switched to a new email address and stopped checking the old one, which I think is somewhat rare). I totally agree with your point that this is arguably a good thing, though; although I don't personally own or use any Apple products, there are fairly few services I'd want to sign up for that I'd want to ensure that they had my real email, and I'd be happy to make sharing my email address an opt-in choice rather than the default.
  • Someone 7y ago
    ”it's just that if you sell their data (or get hacked) the email you get is useless.” It’s just that whenever Apple decides so, the email you got becomes useless. Apple is judge, jury and executioner, and it makes the laws. That is problematic.
    • jen729w 7y ago
      I think the question is, is it more problematic than the current situation, whereby users wholly distrust companies with their data, because those companies have shown again and again that they can not be trusted with it? I’d say no.
      • Someone 7y ago
        That’s one possible question. Another is whether an even better remedy exists. For example, do we need the ability for Apple to delete the link between a company and all their users in one sweep, or is it sufficient to make it easy for individual users to cut such ties? If the latter, could we remove that giant master switch, or move control of it to a third party? (I haven’t watched the video, so, possibly, that giant switch doesn’t exist. Skimming https://developer.apple.com/sign-in-with-apple/get-started/ https://developer.apple.com/sign-in-with-apple/get-started/ didn’t tell me that, either)
        • gpickett00 7y ago
          If a better remedy exists someone else can build it. Nobody is forcing us to use Apple products/services.
        • cyphar 7y ago
          > That’s one possible question. Another is whether an even better remedy exists. There is, it's called IM2000 where email becomes a pull-based system instead of push-based (so users would have to consent to spam, and spammers have to store their spam to send it in bulk). Unfortunately, despite many attempts to switch over we're still stuck on the current incarnation of SMTP.
  • anbop 7y ago
    Or, you host a video site like YouTube, you’re not aggressive enough in controlling “hate speech,” and Apple boots you from the platform. How, as a user of this app, am I supposed to re-establish control over my account?
• olliej 7y ago
  You're welcome to add non-social logins. The constraint is that if you add any social logins, you also have to support Apple Sign-In. There is no requirement that you only support apple sign-in, you just aren't allowed to require user's to sacrifice their privacy to use your app.
  • the_gipsy 7y ago
    What's a social login, though. At what point is Instagram using facebook a social login or not (it's the same company).
    • BurritoAlPastor 7y ago
      This isn’t a fuzzy abstract line-in-the-sand thing; social logins are specific libraries, and either you’ve got those libraries in your app or you don’t. If Instagram is using https://developers.facebook.com/docs/facebook-login/ https://developers.facebook.com/docs/facebook-login/ with the little “log in with Facebook” button, it’s a social login. If they have their own proprietary way to do it in-house, it’s not, and not subject to Sign In With Apple. That easy.
      • the_gipsy 7y ago
        It's not that easy. Instagram belongs to facebook. So logging in with facebook is not strictly a "social login". Same with Tinder, IIRC they only had facebook login, to piggyback on the fb profile. That's not really social as in "chose one of those providers". If it "chose provider" then yes, apple could shove in their own with the pretense of user privacy, while it is painfully obvious that it's just leveraging their appstore control to grab market. Not even OAuth can be unambiguous. I can have a single OAuth login. That could be myself as provider, or leveraging some other provider, which could be more or less connected to my app.
    • r00fus 7y ago
      I'm guessing olliej meant OAuth provider. FB and Google are the leading ones, so people implement those. Sign in with Apple is one as well. The comment is saying you're free to implement your own auth mechanism using plain ol email or a phone number, but you also have to support Sign in with Apple
• hrktb 7y ago
  It’s a very good point. I think you are right that it will be an issue in the long term if things stay the same. Somewhere I hope this forces the other players in the field to react, to avoid Apple getting too much power. I don’t see anyone else right now that can force app devs to support this scheme (for instance I saw countless signup pages that reject gmail’s + syntax, companies clearly don’t want to be filtered), nor that would be trusted for now by users to not abuse the situation. Perhaps Microsoft could ? barely, as they for instance were sticking ads in their browser. So, in a way I see Apple doing what only them can do, and hope it creates enough precedence for other minor identity managers to step in and being a more sane solution for the long run.
  • inlined 7y ago
    Microsoft already tried a single login platform. They were one of the firsts. It’s a hard product to land. https://en.m.wikipedia.org/wiki/Microsoft_account https://en.m.wikipedia.org/wiki/Microsoft_account
    • davidgould 7y ago
      It's a hard product to land if no-one trusts you.
      • BuckRogers 7y ago
        Maybe, but I trust Microsoft more than Google. The trust list, Apple > Microsoft > Google > Facebook.
    • Nerdfest 7y ago
      It's a pretty easy product to land when you control the hardware, the OS, the developers, and to a large extent, the users.
• jammygit 7y ago
  Could this make accounts less transferable between platforms? Eg, an audio book app account?
  • kshacker 7y ago
    They said "you must implement sign-in with apple if you implement other third party logins". The inference is A) You (app developer) can build your own login - then this is not an issue B) You (user) can switch login - developer has to provide this switch feature, but if they do, it is not an issue
• reaperducer 7y ago
  By not providing 3rd parties access to email, Apple makes themselves not only the controllers of the physical devices and also over the full identity of their users Third party apps don't have to use e-mail for logins. They can use user names. Backers of e-mail based sign-in often call it a "frictionless" method for the users to sign up. What it really is, is a frictionless method for them to collect information about their users.
  • manigandham 7y ago
    As a user, I'd much rather use my email than have to make up a new username for every site. Emails are already public, it's not always some cynical conspiracy.
    • olliej 7y ago
      Uh, email addresses aren't already public - there isn't some magic email directory in the cloud (I mean aside from those aggressively hoarded by trackers, advertisers, and marketers because you had no choice but to use your real address once). But this is also specific to "social" logins - eg ones where you aren't intentionally providing your email address.
      • manigandham 7y ago
        They're a public endpoint designed to intake communications from anybody. Identity is an outcome from people using the same email, and that's a valid reason for using a proxy, but the address itself has always been public. More in-depth article about it: https://www.troyhunt.com/im-sorry-but-your-email-address-is-not/ https://www.troyhunt.com/im-sorry-but-your-email-address-is-...
  • skybrian 7y ago
    If you just have a username and password, what do you do for account recovery after a forgotten password? If not an email address, would a cell phone number be any better? For accounts that really matter (not throwaways), someone needs to know a fair bit about the user's identity to ensure recovery works. It can be delegated (and probably should be), but that moves the identity problem rather than eliminating it. Maybe someday we'll all have two Yubikeys (one for backup) and register with each website using them, but that's not how things work today for most users.
• est31 7y ago
  Apple not only gets more power over the app developers, they also get more power over the users. If you want to leave apple devices behind, you'll now need to change your e-mail addresses for every service.
  • xrisk 7y ago
    You don't need to leave your icloud behind even if you're leaving Apple devices.
  • briandear 7y ago
    You can have and use an Apple ID/email without owning an Apple device.
    • scarface74 7y ago
      And you don’t need an Apple email address to use an Apple ID.
    • est31 7y ago
      Didn't know that, interesting. Thanks.
  • sooheon 7y ago
    If I want to switch away from Gmail or Facebook, it's the same exact process. This is a problem, but not any worse than the alternatives.
• deleted 7y ago
  [deleted]
• gigatexal 7y ago
  Apple holding the ID information and all that that pertains is the only company I would like to hold that data. I can see no reason why Facebook or Google or any company that profits on the sale of information should have my data. I appreciate that advertisers want to maximize their ad spends but ad-tech has gotten so creepy ... Apple’s move here I fully support. I look forward to seeing apps using it more often and perhaps eventually all the apps I use as well so that I can move all my logins via it. Apple sells me thousand dollar phones and services. Until they start selling my data to ad brokers and becoming a Google I’ll support Apple on this going forward.
  • mattigames 7y ago
    The reason it got so "creppy" is because that is how Google makes money; meaning that if this Apple-sign-in or anything else truly messes with their revenue Google will stop accepting Apple email addresses (or any kind of circumvention to their tracking), and they are fully in their right to do so.
    • matwood 7y ago
      Google would be stuck here. Apple users are some of the most valuable users on the internet. Pushing them away would also hurt Google's bottom line.
      • gigatexal 7y ago
        I know. And I’m sure they know it, too. They and the rest of the industry will just have to find new business models that respect privacy. If they can do that and this privacy first kick doesn’t fade out of favor they will be on top still printing money like always but if not they’ll get left behind. I think the thesis that Apple is going with is hardware and paid for services are the future and free to use things like the open web are going out of favor or must if you want to be secure and anonymous online.
  • Nerdfest 7y ago
    Google doesn't sell your data. They sell adds to companies that they show to you. The companies never see your data, and it's effectively Google's most valuable resource. They have far more reason to keep it safe than Apple. Doesn't Apple sell ads as well, btw? Also, you may want to check the news about Apple selling data ...
• pizza 7y ago
  The best solution imo is an open and federated email proxy standard, so that others can self-host an equivalent identity protection layer.
• cglace 7y ago
  You could just ask the user for their “real” email post sign up. Send a test email to make sure it’s real.
  • laughinghan 7y ago
    What information would you gain from sending a test email? Wouldn't test emails sent to Apple's anonymous forwarding email also go through? There's really no such thing as checking for a "real" email address, though lots of sites do blacklist known anonymous email domains like 10minutemail. But nothing can stop you from just signing up for a new Gmail.
    • spacehunt 7y ago
      Senders to Apple's email proxy needs to be pre-registered first (and I highly suspect the generated addresses are scoped to each individual app's whitelist), so no, not everyone can send to those addresses.
      • laughinghan 7y ago
        The sender already is pre-registered. We're talking about users who have successfully Signed In With Apple ID.
    • cglace 7y ago
      After signing up you would request a non proxy email. Hence, the “real” email. You would then test that the user supplied email is legit.
      • laughinghan 7y ago
        But nothing is stopping the user from supplying a proxy email address in your textbox where you ask for a non-proxy email address. Sending a test email doesn't tell you whether the user-supplied email address is a proxy email address or a non-proxy email address, since your test email will go through in either case. That's the whole point of a proxy email address instead of a completely fake email address, is that emails sent to the proxy email address will still go through.
• clay_the_ripper 7y ago
  Yes but as a user I don’t care. If a developer gets booted then it’s probably because the developer didn’t do something that was in the best interest of the user. Probably frustrating for developers, but again, not my problem. I also highly doubt Apple would do this without a good reason, so again, this is pro-user. As a user, I don’t care if it’s annoying to implement some feature or other or computer with onerous requirements. If a developer doesnt want to comply, then shut down the company. I don’t understand this complaining. Everyone who has a business has to deal with these sorts of things. That’s why people pay businesses, so we don’t have to deal with the hassle. This is the essence of running a service, such as developing apps.
  • jacquesm 7y ago
    > that was in the best interest of the user Or in the best interest of Apple.
    • clay_the_ripper 7y ago
      As a user, why should I care if it’s also in the best interest of Apple? As a user, I want to use my phone and use services on that phone. The business position of Apple does not concern me. Users only care about what’s best for them. Apple stopping companies from screwing me over sounds great from my perspective. As far as I’m concerned, Apple can make as much money as they want, it’s no skin off my teeth. “But then Apple will be a monopoly and you’ll get screwed anyway”. Maybe. But no more than I’m already being screwed by every other cable provider, cell phone company, data broker...etc. I like Apple products. I will continue to spend too much money on them. I’d rather be screwed by Apple in exchange for some pro-user policies, than screwed by every other company that’s already screwing me in exchange for...oh right, nothing.
    • sooheon 7y ago
      When the best interests of Apple and the best interests of its customers diverge sufficiently, the customers will leave. This is their entire pitch, so they better get it right. At least people need not worry that advertisers would be Apple's true customers.
  • 7y ago
• bongobongo 7y ago
  I agree that Apple's intentions are not beneficent, but that's also not the point. There is a strong bias in tech/geek culture towards "decentralization" (it's even become something of a marketing buzzword thanks to recent technologies), but decentralization does not always result in more power for the individual. Look at the Android ecosystem. Do you feel like you're in control on your Android device? I used to think that. Maybe 2-3+ years ago. Today? Not so much. I feel like an Android device is just a means for any number of third parties to gain access to the most private details of my life. That does not make me feel like I have power. It makes me feel powerless.
  • skybrian 7y ago
    Rather than complete decentralization, maybe what we're looking for is having opposing large organizations, as popularized by John Kenneth Galbraith? https://en.m.wikipedia.org/wiki/Countervailing_power https://en.m.wikipedia.org/wiki/Countervailing_power
  • thekyle 7y ago
    > Do you feel like you're in control on your Android device? Absolutely. I have hundreds of different independent ROMs to choose from many of which are completely FOSS. I get to add or remove any app I want and don't even have Google Play services installed. The only software I don't control on the device are the proprietary drivers and boot loader. But that's no different from my Linux desktop.
    • izuchukwu 7y ago
      While this is entirely true, it’s not effectively true for the average non-technical user. Balancing control of one’s personal content in a way the average user can take advantage of is something Apple, whether benevolent or not, has been an effective champion of as of late. And I (and many others) would argue that therein lies an important distinction at iPhone scale.
      • givinguflac 7y ago
        I couldn’t agree more. It’s quite easy for more technically adept users to forget how scary and daunting something like custom rom installs can be. Just because something is technically feasible, doesn’t mean it’s accessible to many or even most users.
• clairity 7y ago
  but this is a good next move for us consumers if you think about the overall position and dynamics of the industry relative to privacy. but as you point out, it doesn't mean we can let our guard down. we have to remain vigilant to imbalances of power that threaten our civil liberties (like the right to privacy). once apple starts gaining traction with this feature, it's positioning will inevitably change, possibly for the worse, and then we back another borse who will keep apple in check. unlike on game of thrones, our watch never ends.
• asavadatti 7y ago
  I agree. This is a direct response to Spotify's recent moves
• hanspeter 7y ago
  Why are we calling the service you want register with for the third party? You are the 1st party, the service you want to use is the 2nd party and Apple is the 3rd party.
• floriferous 7y ago
  Just like facebook or google can block your account and prevent you from accessing all those logins you linked ever again. So you better log in with your own email, but of the 3, I’d rather pick Apple as the lesser evil!
  • jadbox 7y ago
    Apple isn't just holding your authentication like Google login, but Apple is also exclusively holding your contact information. This means Apple has a sore authority to completely cut your access to your users: you have zero means to reconnect to them. This is different from other authentication methods where the provider does get an email address where they can use that communication medium to bypass the platform if needed.