4 ms·

Would "Sign In With Apple" be considered a "Privileged Third Party" if they make sure it works but break other Single Sign On providers as an "Unintended Impact

Would "Sign In With Apple" be considered a "Privileged Third Party" if they make sure it works but break other Single Sign On providers as an "Unintended Impact"?

eridius 7y ago
I'm not sure what you mean by this; WebKit Tracking Prevention doesn't break third-party login. Third-party login works by handing a token back to the first party, who then stores it directly and validates it on the backend. After the initial login with the third party, the third party isn't involved anywhere that the browser can see. And the initial login happens in a browser window that's navigated directly to the third party, making them the first party for the login form (and therefore able to access any saved login data from previous logins). In fact, this WebKit Tracking Prevention Policy explicitly states that third-party login is implied consent for the third party to identify the user as having the same identity in these multiple places.
- geofft 7y ago
  TBH a browser prevents Medium from showing a Google iframe in the top-right corner with "Hi geofft, I know your name is geofft, please click the login button geofft," that would be delightful....
  - saagarjha 7y ago
    I’m not quite sure about this, but I think Safari will prevent cross-site tracking in this case until you interact with the thing.
  - the8472 7y ago
    You can achieve that with firefox containers or - if you want a bigger hammer - first-party isolation.
  - om2 7y ago
    If you logged into Medium with that account, then Medium would know, and could tell the I frame. But if you didn’t, then the iframe shouldn’t know your user ID unless you click and allow access, at least in Safari.
om2 7y ago
Sign In With Apple has the same level of access as any other OAuth-based federated login scheme. The popular login services from Facebook and Google work fine in Safari. As others have mentioned, the way they are built does not require cross site tracking.

Would "Sign In With Apple" be considered a "Privileged Third Party" if they make sure it works but break other Single Sign On providers as an "Unintended Impact"?

eridius 7y ago

I'm not sure what you mean by this; WebKit Tracking Prevention doesn't break third-party login. Third-party login works by handing a token back to the first party, who then stores it directly and validates it on the backend. After the initial login with the third party, the third party isn't involved anywhere that the browser can see. And the initial login happens in a browser window that's navigated directly to the third party, making them the first party for the login form (and therefore able to access any saved login data from previous logins). In fact, this WebKit Tracking Prevention Policy explicitly states that third-party login is implied consent for the third party to identify the user as having the same identity in these multiple places.

geofft 7y ago
TBH a browser prevents Medium from showing a Google iframe in the top-right corner with "Hi geofft, I know your name is geofft, please click the login button geofft," that would be delightful....
- saagarjha 7y ago
  I’m not quite sure about this, but I think Safari will prevent cross-site tracking in this case until you interact with the thing.
- the8472 7y ago
  You can achieve that with firefox containers or - if you want a bigger hammer - first-party isolation.
- om2 7y ago
  If you logged into Medium with that account, then Medium would know, and could tell the I frame. But if you didn’t, then the iframe shouldn’t know your user ID unless you click and allow access, at least in Safari.

om2 7y ago

Sign In With Apple has the same level of access as any other OAuth-based federated login scheme. The popular login services from Facebook and Google work fine in Safari. As others have mentioned, the way they are built does not require cross site tracking.