5 ms·

They basically just asked Apple to give them 15K$, which is the cost of membership for a company of more than 100 employees [0]. Is it currently not possible t

They basically just asked Apple to give them 15K$, which is the cost of membership for a company of more than 100 employees [0]. Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication ? Does Apple not provide some sort of SDK that makes this easy ? And if so, what is the advantage of "Sign-in with Apple" being interoperable ? [0] https://openid.net/foundation/members/registration https://openid.net/foundation/members/registration

Bombthecat 7y ago
Apples reply: lol, no
thefounder 7y ago
I doubt 15k is really an issue for Apple. You could even say that at its scale its Apple's duty to pay that membership and give back contributing to the specifications. Using standards has some advantages like not having to test dozens of authentication systems/clients doing basically the same thing. If you would have read the document you would have found that you can't use standard openID clients due some issues with Apple's implementation. Some of the issues have security implications.
- pjmlp 7y ago
  No, you just test slightly different implementations of the same standard, that seem to interoperate until they don't, even among products from same vendor.
deleted 7y ago
[deleted]
tlrobinson 7y ago
It would be the polite thing to do. $15k is something like 0.000006% of Apple's cash on hand.
- throwaway2048 7y ago
  For reference, its like somebody that has 10k in the bank paying 0.6 of a cent
  - aiyodev 7y ago
    For reference, it’s also about 18 months of salary at median wage.
    - andruby 7y ago
      Not Apple median wages. That would probably be closer to 2~3 months.
      - wikibob 7y ago
        Apple Engineering Compensation ranges from ~$150,000 to ~$450,000 per year (including salary, bonus, and stock compensation). $15,000 would be between a week and just over a month of compensation. See https://www.levels.fyi/salary/Apple/ https://www.levels.fyi/salary/Apple/
        thetinguy 7y ago
        The most common employees at Apple are not engineers.
      - falcolas 7y ago
        Not all employees working at or directly for Apple make Apple salaries. All the contractors they hire are likely to bring that median down significantly.
    - GTP 7y ago
      But it's the price for a company, not for a person.
    - deleted 7y ago
      [deleted]
merb 7y ago
btw. you do not need to be member of openid to support openid connect. you just can't advertise it. but being a member is relativly cheap.
- mspnp 7y ago
  aaa
souterrain 7y ago
Is there something in the OpenID Foundation membership agreement that might raise concerns for Apple?
mjlee 7y ago
> Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication? Not really... For example, the lack of a discovery document means that a lot of the essential configuration cannot be discovered programmatically. The lack of a UserInfo endpoint means that applications which are used to using that will need to get the user info out of the id_token.
k8_maze 7y ago
No, they laid out several issues with Apple's OpenID Connect implementation with one of them being an actual security-related issue (missing nonce which can enhable replay and csrf attacks). You only have to pay if you certify and even then, 15k is not that much.
- trazire 7y ago
  $15k is an inconsequential amount for the OpenID Foundation, either. Just based on members listed on their site, they're making around $966 thousand.
perlgeek 7y ago
They have mainly asked Apple to follow a standard, and not do their own similar-but-not-quite-the-same thing.
hprotagonist 7y ago
$15k feels like so trivial an amount to apple. It’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there. edit: not “no expense report”; i actually meant “you don’t have to ask anyone first (but will have to file a report about it later)”, which is not quite the same thing.
- CydeWeys 7y ago
  I guarantee you'd have to file an expense report, but that's probably the extent of it.
  - Zenbit_UX 7y ago
    Of course you need to file an expense report, his point was it's such a trivial sum to Apple the person expending it wouldn't need to ask permission.
- jefftk 7y ago
  > it’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there You're probably joking, but in case you're not this isn't right. If a company had a policy like that they would have difficulty demonstrating to the IRS that all their expenses really were for their business, and they would have a hard time protecting themself from embezzlement. The company needs to be keeping a receipt and a business justification for the expense.
xenophonf 7y ago
The advantage of "Sign-in with Apple" being interoperable means that networks of relying parties (e.g., national research and education networks) can readily provide Apple customers access to high-integrity services. Both kinds of LOA—identity proofing and identity binding—are really difficult to do without secure hardware, and it could drive Apple product sales if they make LOA easy to do with their stuff (like TouchID or FaceID).

Bombthecat 7y ago

Apples reply: lol, no

thefounder 7y ago

I doubt 15k is really an issue for Apple. You could even say that at its scale its Apple's duty to pay that membership and give back contributing to the specifications. Using standards has some advantages like not having to test dozens of authentication systems/clients doing basically the same thing. If you would have read the document you would have found that you can't use standard openID clients due some issues with Apple's implementation. Some of the issues have security implications.

pjmlp 7y ago
No, you just test slightly different implementations of the same standard, that seem to interoperate until they don't, even among products from same vendor.

deleted 7y ago

[deleted]

tlrobinson 7y ago

It would be the polite thing to do. $15k is something like 0.000006% of Apple's cash on hand.

throwaway2048 7y ago
For reference, its like somebody that has 10k in the bank paying 0.6 of a cent
- aiyodev 7y ago
  For reference, it’s also about 18 months of salary at median wage.
  - andruby 7y ago
    Not Apple median wages. That would probably be closer to 2~3 months.
    - wikibob 7y ago
      Apple Engineering Compensation ranges from ~$150,000 to ~$450,000 per year (including salary, bonus, and stock compensation). $15,000 would be between a week and just over a month of compensation. See https://www.levels.fyi/salary/Apple/ https://www.levels.fyi/salary/Apple/
      - thetinguy 7y ago
        The most common employees at Apple are not engineers.
    - falcolas 7y ago
      Not all employees working at or directly for Apple make Apple salaries. All the contractors they hire are likely to bring that median down significantly.
  - GTP 7y ago
    But it's the price for a company, not for a person.
  - deleted 7y ago
    [deleted]

merb 7y ago

btw. you do not need to be member of openid to support openid connect. you just can't advertise it. but being a member is relativly cheap.

mspnp 7y ago
aaa

souterrain 7y ago

Is there something in the OpenID Foundation membership agreement that might raise concerns for Apple?

mjlee 7y ago

> Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication? Not really... For example, the lack of a discovery document means that a lot of the essential configuration cannot be discovered programmatically. The lack of a UserInfo endpoint means that applications which are used to using that will need to get the user info out of the id_token.

k8_maze 7y ago

No, they laid out several issues with Apple's OpenID Connect implementation with one of them being an actual security-related issue (missing nonce which can enhable replay and csrf attacks). You only have to pay if you certify and even then, 15k is not that much.

trazire 7y ago
$15k is an inconsequential amount for the OpenID Foundation, either. Just based on members listed on their site, they're making around $966 thousand.

perlgeek 7y ago

They have mainly asked Apple to follow a standard, and not do their own similar-but-not-quite-the-same thing.

hprotagonist 7y ago

$15k feels like so trivial an amount to apple. It’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there. edit: not “no expense report”; i actually meant “you don’t have to ask anyone first (but will have to file a report about it later)”, which is not quite the same thing.

CydeWeys 7y ago
I guarantee you'd have to file an expense report, but that's probably the extent of it.
- Zenbit_UX 7y ago
  Of course you need to file an expense report, his point was it's such a trivial sum to Apple the person expending it wouldn't need to ask permission.
jefftk 7y ago
> it’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there You're probably joking, but in case you're not this isn't right. If a company had a policy like that they would have difficulty demonstrating to the IRS that all their expenses really were for their business, and they would have a hard time protecting themself from embezzlement. The company needs to be keeping a receipt and a business justification for the expense.

xenophonf 7y ago

The advantage of "Sign-in with Apple" being interoperable means that networks of relying parties (e.g., national research and education networks) can readily provide Apple customers access to high-integrity services. Both kinds of LOA—identity proofing and identity binding—are really difficult to do without secure hardware, and it could drive Apple product sales if they make LOA easy to do with their stuff (like TouchID or FaceID).