4 ms·

Only if the customer wants them to be. If the customer wants to give you their real email address, they are free to do so. If they choose not to give that to yo

Only if the customer wants them to be. If the customer wants to give you their real email address, they are free to do so. If they choose not to give that to you, but you want to contact them anyway because you think you know their desires better than they do, well... that’s exactly why this is needed.

makomk 7y ago
If Apple decides to cut off a developer, it doesn't matter what their customers want. Unless they had the foresight to bypass the default and use their real e-mail, there is no way for users to prove their accounts belong to them without Apple's co-operation. Their access to their accounts is entirely at Apple's mercy and there is (by design) nothing the developers can do to avoid this.
- scarface74 7y ago
  The authentication using OATH and the email forwarding of aliases are two separate but related services. If Apple for some reason doesn’t allow the app maker to use the OATH service, I doubt very seriously that they will cancel the email forwarding without the user specifically turning off the forwarding. At that point both the user and the app provider both have generated email address.
  - Wintereise 7y ago
    > I doubt very seriously that they will cancel the email forwarding without the user specifically turning off the forwarding. Where's this confidence coming from? If Apple sees it fit to prevent you (the developer) from accessing your Apple specific userbase for any reason / violation, other people seem correct in their theorization that there's nothing you can really do as the developer. Not implementing this new "Sign in with Apple" will also probably be interpreted as not being privacy friendly by the users, a developer can't really have that either. Pretty much the definition of being stuck between a rock and a hard place.
    - scarface74 7y ago
      The aliased email address is assigned to the user. Saying that Apple would take away the users email address would be like saying that Apple would delete user data for an app it banned.
      - Wintereise 7y ago
        Whether Apple will exercise the power or not is another debate entirely. I agree with the group that's (rightfully, imo) concerned about handing over this amount of power over their business to any 3rd party. There's a real potential for abuse.
        scarface74 7y ago
        And handing over your users data to known privacy hostile companies like Facebook and Google who have abused their power isn’t?
    - addicted 7y ago
      How is this not completely true of every service? If Facebook sees it fit to prevent you (the developer) from accessing your FB specific user base for any reason / violation there is nothing you can really do. If Google sees it fit to prevent you (the developer) from accessing your Google specific user base for any reason / violation there is nothing you can really do. Worse If Gmail sees it fit to prevent you (the developer) from accessing your Gmail specific user base for any reason / violation there is nothing you can really do. Gmail already does this occasionally by quickly blacklisting non Gmail senders in their spam filters.
      - Wintereise 7y ago
        Not really a completely fair comparison. With FB / Google, most people at least have the hope of migrating away using setting the email / phone (Google provides this, FB doesn't) as username. If Apple tells you to take a hike, and then subsequently disables the email redirect -- you're completely SOL. You'd have no way to reach out to the user anymore, unless you took other identifying bits of info. And if you did that anyway, that defeats the purpose of AppleID to begin with. Most users will probably not even be tracking what autogenerated email they're using, hence you no longer have a way to reliably reconcile what user had which account. Regarding the GMail specific case though, I fully agree. Being banned by GMail is a company ending thing.
- mikeash 7y ago
  Right, there’s nothing the developers can do to avoid this. Because it’s the users making the choice. They choose to give Apple this power, or not. You are essentially arguing that they will choose incorrectly, and that developers should be able to force them to choose correctly because users won’t think it through. By a strange coincidence, the “correct” choice is also the one that allows developers to track and spam users. Here’s a crazy idea: if you don’t want your users giving you a private forwarding address, give them some reason to trust you with their real one, instead of saying they’re idiots who don’t know what’s best for themselves.
  - thaumasiotes 7y ago
    You're advocating for the users to make their choice at the worst possible time. There's no reason to give a new app special trust when you sign up with it. But if you come to trust the app, and Apple excommunicates it, should you need to rely on Apple to help you reestablish your own contact with it? That won't work -- Apple already demonstrated that they don't like that app. That's why makomk's complaint is > there is no way for users to prove their accounts belong to them without Apple's co-operation rather than "I should be able to get customer emails from Apple regardless of what the customers want".
    - mikeash 7y ago
      You could always allow users to provide their real email address later on so they can establish ownership directly.
- jsjohnst 7y ago
  How is that different from signin with FB or Google?
  - lmm 7y ago
    FB and Google allow the app to request the user's email. If the user is happy to provide it, then they can then tie the user's account to that email, and allow the user to log in with that email even if FB or Google cuts the application off.
- wtmt 7y ago
  How is this any different from Google or Facebook or Twitter cutting off access to any site/application? Do you believe the developers in those cases would have a much better chance of resolving the issue than with Apple?

makomk 7y ago

If Apple decides to cut off a developer, it doesn't matter what their customers want. Unless they had the foresight to bypass the default and use their real e-mail, there is no way for users to prove their accounts belong to them without Apple's co-operation. Their access to their accounts is entirely at Apple's mercy and there is (by design) nothing the developers can do to avoid this.

scarface74 7y ago
The authentication using OATH and the email forwarding of aliases are two separate but related services. If Apple for some reason doesn’t allow the app maker to use the OATH service, I doubt very seriously that they will cancel the email forwarding without the user specifically turning off the forwarding. At that point both the user and the app provider both have generated email address.
- Wintereise 7y ago
  > I doubt very seriously that they will cancel the email forwarding without the user specifically turning off the forwarding. Where's this confidence coming from? If Apple sees it fit to prevent you (the developer) from accessing your Apple specific userbase for any reason / violation, other people seem correct in their theorization that there's nothing you can really do as the developer. Not implementing this new "Sign in with Apple" will also probably be interpreted as not being privacy friendly by the users, a developer can't really have that either. Pretty much the definition of being stuck between a rock and a hard place.
  - scarface74 7y ago
    The aliased email address is assigned to the user. Saying that Apple would take away the users email address would be like saying that Apple would delete user data for an app it banned.
    - Wintereise 7y ago
      Whether Apple will exercise the power or not is another debate entirely. I agree with the group that's (rightfully, imo) concerned about handing over this amount of power over their business to any 3rd party. There's a real potential for abuse.
      - scarface74 7y ago
        And handing over your users data to known privacy hostile companies like Facebook and Google who have abused their power isn’t?
  - addicted 7y ago
    How is this not completely true of every service? If Facebook sees it fit to prevent you (the developer) from accessing your FB specific user base for any reason / violation there is nothing you can really do. If Google sees it fit to prevent you (the developer) from accessing your Google specific user base for any reason / violation there is nothing you can really do. Worse If Gmail sees it fit to prevent you (the developer) from accessing your Gmail specific user base for any reason / violation there is nothing you can really do. Gmail already does this occasionally by quickly blacklisting non Gmail senders in their spam filters.
    - Wintereise 7y ago
      Not really a completely fair comparison. With FB / Google, most people at least have the hope of migrating away using setting the email / phone (Google provides this, FB doesn't) as username. If Apple tells you to take a hike, and then subsequently disables the email redirect -- you're completely SOL. You'd have no way to reach out to the user anymore, unless you took other identifying bits of info. And if you did that anyway, that defeats the purpose of AppleID to begin with. Most users will probably not even be tracking what autogenerated email they're using, hence you no longer have a way to reliably reconcile what user had which account. Regarding the GMail specific case though, I fully agree. Being banned by GMail is a company ending thing.
mikeash 7y ago
Right, there’s nothing the developers can do to avoid this. Because it’s the users making the choice. They choose to give Apple this power, or not. You are essentially arguing that they will choose incorrectly, and that developers should be able to force them to choose correctly because users won’t think it through. By a strange coincidence, the “correct” choice is also the one that allows developers to track and spam users. Here’s a crazy idea: if you don’t want your users giving you a private forwarding address, give them some reason to trust you with their real one, instead of saying they’re idiots who don’t know what’s best for themselves.
- thaumasiotes 7y ago
  You're advocating for the users to make their choice at the worst possible time. There's no reason to give a new app special trust when you sign up with it. But if you come to trust the app, and Apple excommunicates it, should you need to rely on Apple to help you reestablish your own contact with it? That won't work -- Apple already demonstrated that they don't like that app. That's why makomk's complaint is > there is no way for users to prove their accounts belong to them without Apple's co-operation rather than "I should be able to get customer emails from Apple regardless of what the customers want".
  - mikeash 7y ago
    You could always allow users to provide their real email address later on so they can establish ownership directly.
jsjohnst 7y ago
How is that different from signin with FB or Google?
- lmm 7y ago
  FB and Google allow the app to request the user's email. If the user is happy to provide it, then they can then tie the user's account to that email, and allow the user to log in with that email even if FB or Google cuts the application off.
wtmt 7y ago
How is this any different from Google or Facebook or Twitter cutting off access to any site/application? Do you believe the developers in those cases would have a much better chance of resolving the issue than with Apple?