12 ms·
Open Letter from the OpenID Foundation to Apple Regarding Sign in with Apple
- frenchman99 7y agoThey basically just asked Apple to give them 15K$, which is the cost of membership for a company of more than 100 employees [0]. Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication ? Does Apple not provide some sort of SDK that makes this easy ? And if so, what is the advantage of "Sign-in with Apple" being interoperable ? [0] https://openid.net/foundation/members/registration https://openid.net/foundation/members/registration
- Bombthecat 7y agoApples reply: lol, no
- thefounder 7y agoI doubt 15k is really an issue for Apple. You could even say that at its scale its Apple's duty to pay that membership and give back contributing to the specifications. Using standards has some advantages like not having to test dozens of authentication systems/clients doing basically the same thing. If you would have read the document you would have found that you can't use standard openID clients due some issues with Apple's implementation. Some of the issues have security implications.
- pjmlp 7y agoNo, you just test slightly different implementations of the same standard, that seem to interoperate until they don't, even among products from same vendor.
- deleted 7y ago[deleted]
- tlrobinson 7y agoIt would be the polite thing to do. $15k is something like 0.000006% of Apple's cash on hand.
- throwaway2048 7y agoFor reference, its like somebody that has 10k in the bank paying 0.6 of a cent
- aiyodev 7y agoFor reference, it’s also about 18 months of salary at median wage.
- andruby 7y agoNot Apple median wages. That would probably be closer to 2~3 months.
- wikibob 7y agoApple Engineering Compensation ranges from ~$150,000 to ~$450,000 per year (including salary, bonus, and stock compensation). $15,000 would be between a week and just over a month of compensation. See https://www.levels.fyi/salary/Apple/ https://www.levels.fyi/salary/Apple/
- thetinguy 7y agoThe most common employees at Apple are not engineers.
- falcolas 7y agoNot all employees working at or directly for Apple make Apple salaries. All the contractors they hire are likely to bring that median down significantly.
- GTP 7y ago
- merb 7y agobtw. you do not need to be member of openid to support openid connect. you just can't advertise it. but being a member is relativly cheap.
- mspnp 7y agoaaa
- souterrain 7y agoIs there something in the OpenID Foundation membership agreement that might raise concerns for Apple?
- mjlee 7y ago> Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication? Not really... For example, the lack of a discovery document means that a lot of the essential configuration cannot be discovered programmatically. The lack of a UserInfo endpoint means that applications which are used to using that will need to get the user info out of the id_token.
- k8_maze 7y agoNo, they laid out several issues with Apple's OpenID Connect implementation with one of them being an actual security-related issue (missing nonce which can enhable replay and csrf attacks). You only have to pay if you certify and even then, 15k is not that much.
- trazire 7y ago$15k is an inconsequential amount for the OpenID Foundation, either. Just based on members listed on their site, they're making around $966 thousand.
- perlgeek 7y agoThey have mainly asked Apple to follow a standard, and not do their own similar-but-not-quite-the-same thing.
- hprotagonist 7y ago$15k feels like so trivial an amount to apple. It’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there. edit: not “no expense report”; i actually meant “you don’t have to ask anyone first (but will have to file a report about it later)”, which is not quite the same thing.
- CydeWeys 7y agoI guarantee you'd have to file an expense report, but that's probably the extent of it.
- Zenbit_UX 7y agoOf course you need to file an expense report, his point was it's such a trivial sum to Apple the person expending it wouldn't need to ask permission.
- jefftk 7y ago> it’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there You're probably joking, but in case you're not this isn't right. If a company had a policy like that they would have difficulty demonstrating to the IRS that all their expenses really were for their business, and they would have a hard time protecting themself from embezzlement. The company needs to be keeping a receipt and a business justification for the expense.
- xenophonf 7y agoThe advantage of "Sign-in with Apple" being interoperable means that networks of relying parties (e.g., national research and education networks) can readily provide Apple customers access to high-integrity services. Both kinds of LOA—identity proofing and identity binding—are really difficult to do without secure hardware, and it could drive Apple product sales if they make LOA easy to do with their stuff (like TouchID or FaceID).
- Sephr 7y ago"Therefore the OpenID Foundation invites Apple to: [...] Join the OpenID Foundation" It's not really an "invitation" if they expect Apple to give them money.
- thefounder 7y agoLet's start a crowdfunding campaign to pay for the Apple's membership. 10k shouldn't be that hard to get given the amount of time we, developers, have to spend on Apple's custom implementation.
- toyg 7y agoHoly sheet - don't give them ideas, man! Apple are skimpy enough as they are...
- Angostura 7y agoIt’s is. I can invite you to buy something from me.
- stevenjohns 7y agoBeyond that, legally, anything you buy needs to have the seller invoke a concept called an invitation to treat[0] which in modern times is usually established at the point of issuing a receipt or tax invoice. Even if someone has paid for something, the seller does not have to recognise that a transaction has taken place and would not have to enter or execute the contract. This is especially important in times where there might be a pricing error or something. [0] https://en.wikipedia.org/wiki/Invitation_to_treat https://en.wikipedia.org/wiki/Invitation_to_treat
- toyg 7y agoI guess (hope?) this is actually as a result of some communication failure or refusal behind the scenes. Otherwise it would look pretty rude. Some sort of accompanying commentary from OIDF people, explaining the reasoning behind the letter, would be appreciated.
- iamnotacrook 7y agoIt looks weird either way. "Use the OpenID Connect Self Certification Test Suite to improve the interoperability and security of Sign In with Apple." Give us a bunch of money and maybe we'll let you join our little group and you can have our mark of quality that you are now secure. Wow, really? Thanks. It's a little like a lot of the spam I get as an Android developer from "marketers" and just general weirdos trying to get rich off my hard work.
- iddan 7y agoUnlike “marketers” a certificate of compatibility is mandatory for many development teams to use an external technology
- icebraining 7y ago> my hard work. But it's mostly not their work - Apple's protocol is basically a bad implementation of OpenID Connect.
- reaperducer 7y agoI expect that if Apple said it "forked" OpenID, then the HN community would be OK with it. It's all about the optics.
- eecc 7y agoIt’s been a couple weeks since I’ve seen this “optics” being thrown around in comments here. Why you keep using this term when the more appropriate one would be “perspective”?
- blue_devil 7y agoThis might answer some questions: https://openid.net/connect/faq/ https://openid.net/connect/faq/ Also >Are there live production deployments of OpenID Connect? Yes. Some examples include Google, Gakunin (Japanese Universities Network), Microsoft, Ping Identity, Nikkei Newspaper, Tokyu Corporation, mixi, Yahoo! Japan and Softbank. There are also mature deployments underway by Working Group participant organizations, such as Deutsche Telecom, AOL, and Salesforce. For an example of OpenID Connect at work, look at Google+ Sign-In, Google’s flagship social-identity offering, which is entirely based on OpenID Connect.
- jrockway 7y agoIs OpenID Connect the one where it issues a JWT that you can then verify and exchange for a session cookie? If so, I love the API. Very easy to use, and easy to integrate multiple sources.
- pas 7y agoYes. It's OAuth2 with some additional formalism/standardization.
- user5994461 7y agoShort answer is yes but long answer is no. OpenID Connect doesn't define anything about the token format or the use of cookies. It's really more of an authentication framework, that leaves a lot to the implementation. Web is always cookies and JWT is getting popular lately.
- unscaled 7y agoOnly partially correct. I think the earliest drafts of OpenID Connect were completely agnostic of JWT, and so is OAuth 2.0, but the final Open ID Connect Core spec is tightly coupled to the JWT standard in multiple places. The first and most important coupling point is the ID Token. There are three types of tokens issued by Open ID Connect: Access Tokens and Refresh tokens are opaque, just as in OAuth 2. ID Tokens, on the other hand, most follow a more-or-less well-defined JWT format (as much as JWT can be well-defined - it is a somewhat wild west of a standard). The rest of the places you could use JWT are in the spec, but I admit I've never seen them in the wild (and I would probably avoid them like the plague if I was trying to implement a _secure_ subset of an OpenID Connect IdP): 1. JWT request signing (and even encryption!) 2. JWT for signing and encrypting any JSON response 3. JWT for client authentication 4. JWT for aggregated claims And I may have missed more things. If you want to implement Open ID Connect without being crazy, forget about all of these and only use/implement the Auth Code flow with a client secret. You should still verify the ID Token according to the spec, but if you fail to verify it's no longer an issue, since this is a value you get directly from the the Authorization Server on an authenticated TLS channel (the same channel you'd trust for getting the ID Token signing keys).
- nereid 7y agoIt is not just ask for money, They are proposing that Apple use the standard and make public they use the standard, It could boost openid as no other could make.
- buboard 7y agoDoesnt google already use it?
- cameronbrown 7y agoYep, Microsoft too. Apple supporting the standard would be a great help to developer adoption.. theoretically, though I think they just prefer strong-arming developers into using their proprietary API anyway, standard irrespective.
- zanny 7y agoTwitter and Facebook are the big two holdouts besides Apple that makes social sign in buttons a PITA. OpenID Connect can already provide MS and Google and also supports Paypal, Yahoo, AOL, etc.
- bzbz 7y agoExactly. The $15k is trivial to either side. This would be comparable to an act of political support.
- ForHackernews 7y agoITT: People who benefit from standard protocols and use OpenIDConnect every single day without realizing it complaining that the world's first trillion dollar company might have to pay 0.000015B.
- patrickmcnamara 7y agoIt wouldn't be this way with other companies. Hackers news will defend Apple no matter what for some reason.
- Octoth0rpe 7y agoExcept their keyboards. And their laptop overheating. And the price of their monitor stands. Or their lack of a <5" screen phone. No, hacker news is happy to bitch about apple all day long and I don't know how one could possibly think otherwise.
- sascha_sl 7y agoI think we've established HN loves to be contrarian.
- alistairSH 7y agoNo we don't.
- gingerlime 7y ago... and USB-C ... and MagSafe ... and lack of headphone jack
- Ensorceled 7y ago... and getting rid of MagSafe and their “walled garden” and the 30% they take.
- IAmEveryone 7y ago
- alt_f4 7y agoI'm surprised how many people seem to have a huge problem with Apple, a 910 billion dollar company, paying 15k towards a membership of an organization that underpins the major ideas in their software implementation. That's, what, a single Mac Pro?
- user5994461 7y agoYou're giving too much credit to the foundation. OpenID was an organic effort on authentication before it became a design by committee, the root would be somewhere at Twitter or other big web companies very long ago. OpenID Connect is not an authentication solution by the way. It's at best a few standard requests and parameters, all of which are optional, that could be used to interconnect authentication systems if that's what you're trying to do. Authentication and most of everything is left to the implementation.
- jchw 7y agoEveryone is obviously focusing on the certification suggestion, but they also went and made a nice document of “bugs.” If Apple does anything, patching some of the larger deviations would be great, just out of sheer convenience. Third-party auth libs already have enough exception cases for specific services...
- huffmsa 7y agoPar for the Apple course isn't it? > Oh, you've all agreed on USB type-c? Well we're going to use thunderbolt. Except for when we don't and our customer have to buy a type-c to thunderbolt adapter. > Two button mouse with a scroll wheel? How about a 1 button mouse that you click with two fingers. > Linux? Sure, but it's called MacOsx and doesn't have a native package manager. They've always done stuff like this.
- abledon 7y agoTried the 1 button mouse in an apple store yesterday, holy S* the page scrolling feature is so bad, you have to 'track pad' it in a limited space on the 3d curved surface. soooo annoying.
- huffmsa 7y agoThe laptop trackpads with 2 finger touch are great. Having to consciously think "I need to click in the bottom right corner to right click" on non-apple laptop is cumbersome. It's never felt as natural on their mice though.
- seba_dos1 7y agoI haven't seen a non-apple laptop where two-finger right click didn't work for years.
- huffmsa 7y agoIt does work but I've yet to encounter one that works as well as the Apple one. Like how the 1 button mouse works, but the two button one works more better. Though I was moreso talking about the OG hockey puck that shipped with the OG iMac.
- seba_dos1 7y agoI'm using Apple touchpad right now (and a non-Apple one too, right next to it) and it's nothing special. The only thing that makes it pleasant to use is the way gestures are implemented in macOS - but it has nothing to do with two-finger click. This works just as well, or even slightly better, on my non-Apple laptop with GNU/Linux and it's been a while since I've encountered a touchpad that would be worse in this regard (they definitely existed many years ago though).
- motohagiography 7y agoBetween lack of a a nonce and an asserted exposure to code injection and replay attacks, the issues in the letter imply a week of vulnerability research could yield a complete takedown of the product - which would suck because an Apple sign-in experience using their TEE is really valuable. I could see someone making the choice where they would elect not to manage a nonce because its permuting effect was achieved by other parts of the protocol. Apple also has keys in a TEE, and a nonce generated and synchronized outside of that could have been interpreted as creating additional attack surface. If the OpenID letter is correct, there are exploitable vulnerabilities in Apples implementation that could be demonstrated. If they are not correct, they could just be angry Apple is leveraging its TEE to assert it doesn't need governance from this standards body because the standard is written for products without a separate hardware keystore.
- empath75 7y agoI don’t think they said there’s a lack of a nonce, it seems to be saying that they’re not allowing the client to set the nonce.
- phs318u 7y agoIf the second part of your sentence is true, could “allowing the client to set the nonce” be considered an increase in the possible attack surface?
- TJSomething 7y agoThe entire point of the nonce is that it can't be predicted by anyone but the client, proving that the client initiated the transaction. This is done by having the client send it over TLS and having the identity provider sign the nonce as cryptographic proof. Also, by my reading, the problem is that the standard requires the nonce parameter to do something and Apple ignores it.
- johnjonesyc 7y agoexactly, this looks like the protocol has been intentionally weakened to provide on the wire access. (state actors / telco) The excuse that they dont want to sign up to the Terms and Conditions holds no water If they are serious about security adopt OpenID in full (they dont have to join just pass the tests) and put fido2 security key functionality on every Apple device Apple have made some smart moves but now the marketing dept need to do the right thing for security standards.
- slics 7y agoIt’s not an issue with $15k or if apple can pay or not. I think it’s the issue of Apple vs. Open in general. Apple’s echo system is closed to the world.
- reaperducer 7y agoI think it’s the issue of Apple vs. Open in general. Apple’s echo system is closed to the world. I think that for people outside of HN, that's OK. Not everyone trusts the open source community, or open source organizations. If something goes wrong with something important, it's normal for people to want something or someone to blame. If that something is Apple, that's useful. If it's some rando on the internet contributing code to a code repository, it's significantly less useful to the ordinary person. For the average person, entrusting Apple with their logins is a better option than using password1234 or some other coping mechanism. People know Apple. Nobody knows OpenID. It's the same reason people used to trust Microsoft (and many still do!) with their personal information. Microsoft is a known quantity. It's like having a neighbor watch your pets while you're on vacation, or signing up with some random service on the internet to watch your pets. Those random services get bonded and insured for the peace of mind of the user. There is no such level of assurance from OpenID other than it uses the word "open" in its name, and as a culture we value the word "open" more than "closed."
- andyroid 7y agoBut this is not an issue of Apple vs. OpenID Connect, but one between Apple’s flawed implementation of the OpenID Connect standard vs. the actual OpenID Connect standard. If they would have just gone with some proprietary implementation I very much doubt the OIDC people would have bothered. That happens pretty much daily after all.
- damnyou 7y agoOne of the big cultural problems in society today, and (antitrust) law in particular, is the focus on consumer welfare above all else. The consumer is not the only thing that matters
- marmada 7y agoIt's interesting to see the pro-Apple bias on Hackernews, if some other company tried to avoid integrating with existing standards, thus hurting interoperability I bet HN would throw a fit.
- dang 7y agoPerceptions of HN bias tend to be in the eye of the beholder. They're mostly an inverse image of what you like: if you like X, HN will seem anti-X; if you dislike it, HN will seem pro-X. In reality, HN is a large dataset that contains all of these things. But we have a cognitive bias to notice more of, and more intensely, what rubs us the wrong way. Pain cuts deeper grooves than pleasure. After a few cases, the unpleasant memory hops to the dataset as a whole, leading to a fixed view of HN. But people with opposite likes have the opposite fixed view. When people tell how they see HN, they're really telling the story of themselves. It's fascinating how solid this principle turns out to be. I'm sure it extends to things that are far less trivial than an internet forum.
- jjtheblunt 7y agoPerhaps Apple has intentionally NOT jumped on the OpenID effort without tweaks, for the following reason? Quoting wikipedia for convenience: "OAuth 2.0 has had numerous security flaws exposed in implementations.[17] The protocol itself has been described as inherently insecure by security experts and a primary contributor to the specification stated that implementation mistakes are almost inevitable.[18][19]".
- jogux 7y agoApple are using OAuth 2.0. The contributor referred to (John Bradley) as saying that OAuth 2.0 implementation mistakes are almost inevitable is one of the authors of the OpenID Connect spec, and if you follow the citation link ( https://mailarchive.ietf.org/arch/msg/oauth/WuT1tmFoxs8S_2v7kYmouF_ZVFo https://mailarchive.ietf.org/arch/msg/oauth/WuT1tmFoxs8S_2v7... ) you'll see him mention that the flaw referred to is fixed in OpenID Connect.
- pyman 7y agoOne of the biggest benefits of building a close platform is that you have the freedom to ignore open letters like this one.
- MaxBarraclough 7y agoSounds like another case of Apple doing things in a nonstandard way for little reason, getting the security wrong, and paying the price. A while back, their iMessage system was found to have rather serious security issues. Same same. 'Not Invented Here syndrome'.