23 ms·
How Popular Is “Sign in with Apple”?
- alexhayes 7y agoDoes anyone have any thoughts on the security (or other) implications of all your email for services in which you sign up using Apple SignIn now being relayed through Apple's mail servers? It seems like a great way for Apple to hoover up a heap information they probably don't need. I also wonder how they are going to combat bounces and send back a usable error message. While they can perhaps do useful things with say a mailbox full bounce they are probably going to have to hide or at least obfuscate some other kinds of bounces.
- toasterlovin 7y ago> It seems like a great way for Apple to hoover up a heap information they probably don't need. This is not intended as a Platonic ideal of what authentication should be. Rather, it's intended as a better alternative to being forced to log in with Google/FB/Twitter, since those companies for sure aggregate and monetize your private information, whereas Apple probably does not.
- danielrhodes 7y agoI wonder if this is due to brand/trust, that they only request an email, or the sign in flow is a popover as opposed to going to another app.
- cptskippy 7y agoSocial Sign-On has a low barrier to entry, you click a button and the necessary Authentication Context is transmitted by your Identity Provider (IdP) to the Service Provider (SP). An SP can't implicitly trust an email address and must ask for a corresponding password and also verify you control the email. In this case Social wins out for a lower barrier to entry. Unfortunately the downside of Social is that the SP can request additional information about you from the IdP. And when the IdP is a SP, ask for permissions to interact on the IdP's platform on your behalf. Sometimes these requests are transparent to the user, often the user does not understand what's being asked and permits requests for access. Social Login also allows the IdP to track your interactions across sites, and enables the SP to uniquely identify you across their own properties. An SP can also do the later via Email Authentication. Sign in with Apple prevents both IdP and SP tracking across properties. It also completely cuts out the IdP. I think a lot of people are more privacy conscious today and/or have been burned by Social Sign-On. Sign in with Apple addresses those concerns and others that come with sharing your email address with an SP.
- deleted 7y ago[deleted]
- jrochkind1 7y ago> It’s utterly private, where signing in with Google or Facebook is not at all, yet far more convenient than signing up with your email address. What is different in the privacy design of 'sign in with apple'?
- Dragonai 7y agoHere's a link for ya: https://support.apple.com/en-us/HT210318 https://support.apple.com/en-us/HT210318 In essence, Apple generates a unique email address through their relay service that forwards to (and thus hides) your actual email address. It was widely considered a pretty major step in the right direction for user privacy.
- smlacy 7y agoHow does account recovery work?
- corylulu 7y agoIf you signed in the Apple, it would be through Apple's recovery process.
- ISL 7y agoSounds like it is good for privacy, unless Apple decides to snoop?
- corylulu 7y agoWell, as is any online service. I think the idea is the site you sign up with doesn't know your actual email address.
- acdha 7y agoIf you're using iOS or macOS, Safari, etc. you're already trusting them significantly. This avoids introducing a third-party who otherwise would not be involved in the session.
- 7y ago
- ir77 7y agounfortunately there are very few apps so far that allow signing in with apple even though i see them offer email, google and facebook options. i think out of all of the apps that i use only adobe lightroom allowed me to sign up with apple.
- m3kw9 7y agoBecause those app devs also wants to know more about you
- dave5104 7y agoIt will be mandatory to be on the app store at some point, so that won't be a valid excuse for app developers.
- K0nserv 7y agoAs I understand it Apple will make it mandatory for any app that offers social logins of any kind at some point.[0] Shameless plug, I work for Skyscanner and we've had it since iOS 13 launch. 0: https://www.macrumors.com/guide/sign-in-with-apple/ https://www.macrumors.com/guide/sign-in-with-apple/
- ascagnel_ 7y agoMy understanding is that "Sign in With Apple" is still officially in beta; once it launches in full, all iOS apps that offer third-party sign ins (like the Google & Facebook options) will be mandated to also offer Apple's OAuth sign-in -- and must give it more prominent placement than third-party services.
- snowron6 7y ago>will be mandated to also offer Apple's OAuth sign-in -- and must give it more prominent placement than third-party services. That seems like an abuse of monopoly power.
- frenchyatwork 7y ago
- pgkyc 7y agoI've spent the last +18 months building a product that does this with even more privacy than Apple. It's called idvpn.ca and we assign a virtual ID (pseudonym) to you for each app/vendor you connect to. This way if they're breached, you don't care and they don't care, yet we can meet any compliance requirements the app/vendor has such as age checking, sanction list checking, anti-money laundering, counter terrorist financing etc. We're eagerly looking for vendors interested in beta testing our service, as we have a working product (using OIDC, and/or we easily integrate with Wordpress) and are looking for the MVP/business model now.
- gibolt 7y agoSounds like you should have started your last step 18 months ago. Getting it integrated on a scale large enough to warrant regular people using it and having it in more than one app they use will be the biggest challenge you'll face. Focus as much percentage of your resources as possible there.
- adamlett 7y agoI don’t understand how that is more private than what Apple offers? To my understanding, “Sign in with Apple” optionally also hides your true identity (ie. email address).
- randyrand 7y agoHow does sign in with apple work when switching to android? or using a windows PC?
- deleted 7y ago[deleted]
- asadlionpk 7y agoit doesn't
- capableweb 7y agoMaybe in the future refrain from commenting if A) it's a low-effort post and B) you're not 100% sure of the answer. Also, if you're not sure, please state that at least.
- asadlionpk 7y agook boomer.
- dang 7y agoCould you please stop posting unsubstantive comments to Hacker News? You've been doing it a lot, and we ban that sort of account. The idea here is: if you have a substantive point to make, make it thoughtfully; if you don't, please don't comment until you do. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- ReverseCold 7y agohttps://support.apple.com/en-us/HT210318 https://support.apple.com/en-us/HT210318 Sign in with your Apple account basically. It works nowhere near as well as on iOS or other Apple platforms, but I'm surprised they made it work.
- capableweb 7y agoYou get a username + password dialog to write your Apple ID and password in. Source: started integrating "Sign in with Apple" last week, I'm the developer and I'm using Ubuntu at work.
- fetus8 7y agoI've seen "Sign in with Apple" exactly once since iOS 13 launched. I am kind of surprised it's not being rolled out more widely. The first app I've seen and used it with was Byte (the Vine successor) over this past weekend.
- jonlucc 7y agoI'm not sure I'd notice if it rolled out to a lot of the apps I use, though. I mostly stay logged in for things that don't require login every use (lastpass, banks, etc).
- judge2020 7y agoTurns out it's only required if you already exclusively use FB/Google sign in (I thought it would also apply to your-app-auth+FB+G but I guess not) https://developer.apple.com/app-store/review/guidelines/#sign-in-with-apple https://developer.apple.com/app-store/review/guidelines/#sig...
- sixstringtheory 7y agoHuh, that was not my understanding, and your link goes on to state: > not required if...Your app exclusively uses your company’s own account setup and sign-in systems. So there’s no official guidance on the both/and case?
- stefano 7y agoI interpret that as: - If you only have social logins, you must implement apple sign in. - If you only have your own login, you don't need to implement apple sign in. - If you have both apple sign and your own login, you must implement apple sign in.
- sixstringtheory 7y agoI think you meant > If you have both social logins and your own login, you must implement apple sign in. which is my understanding as well! Would be nice if they explicitly handle this case as it's probably the majority.
- mistrial9 7y agoit appears that Craigslist has implemented some version of this 'psuedo-random email in the middle' setup ?
- cptskippy 7y agoYes, optionally, as a way to protect users from harassment. Like Apple, they can act as an intermediary to hide identities.
- ajford 7y agoCraigslist has used their psuedo-random email relay since at least early 2013. https://web.archive.org/web/20121215193303/https://www.craigslist.org/about/help/email-relay https://web.archive.org/web/20121215193303/https://www.craig...
- cbsks 7y agoI have a similar setup for signing up for services. I set up a custom domain with Fastmail with a wildcard alias that forwards all emails to my inbox. I can then sign up for services with a custom email like "hn-cbsks@myemail.example". If a service leaks my email, I'll know immediately and I'll be able to blacklist that address.
- corylulu 7y agoYeah, I have the same setup for my self-hosted server. It's only a pain when I don't save the login info and need to go dig it up (or if I'm on mobile). If only I could make a custom "Sign in with" button on every site that tracked all that for me, while remaining self hosted, I'd be in heaven.
- tempsy 7y agoPersonally prefer it when I see it, but have only seen it twice so far. Much faster too since it’s native.
- qzx_pierri 7y agoApp Devs probably want to soak up as much user info while they can. I don't think I would ever use it, seeing as I'm trying to slowly migrate out of the Apple ecosystem.
- celeritascelery 7y agoNot sure I follow your point. The whole point of “sign in with Apple” is to fight app devs getting more user info then they need.
- habosa 7y agoI tried to do a Sign in with Apple integration on Android (wanted the app to have the same options across platforms). Testing on Android was next to impossible. To test I needed an Apple ID with 2FA. But SMS 2FA was not good enough, you need the hardware-based 2FA. To get that you need a recent macOS or iOS device. As an Android developer I have no reason to own either of those. Eventually I just had a friend who owns an iPhone try my app a few times. Besides that, the Apple interface guidelines are nearly impossible to follow on Android because Apple doesn't provide the logo or font assets you need to comply. There is no SDK whatsoever, just a spec. Seems like a nice sign-in option for iPhone owners but it's a portability disaster.
- sehugg 7y agoDoing it through Firebase might be easier: https://firebase.google.com/docs/auth/ios/apple https://firebase.google.com/docs/auth/ios/apple
- ehsankia 7y agoApple continues to not give any care whatsoever to anything outside their walled garden. For the longest time you couldn't even preview songs on iTunes store without having iTunes. Want to watch their biggest WWDC live? Had to use Safari until last year. Obviously iMessage and FaceTime are complete no-gos outside their walled garden too. This is how they keep people in. They have to close down their walls as tightly as possible, to force people in. And once you're in, they make it as hard as possible to leave.
- deleted 7y ago[deleted]
- arvinaminpour 7y agoI've noticed it makes sign ups super easy which is great if you're building a new service and want to get users fast. But what I wrestled with is the verification of the user on the server side after they've signed up (Apple suggests doing a daily verification of each user that uses Sign in with Apple) and also the annoyance of setting up trusted domains to be able to email your users. Overall, it's great for users and for privacy but gosh it's a nightmare to setup for developers. Hopefully, Apple can somehow make it more seamless for developers in the future.
- thedingwing 7y agoWhile I always prefer email/password sign-in when available, I've used Sign in with Apple exactly once. It's on a website that only offers "Sign in with <Google, Facebook, Yahoo, Microsoft, Apple>". Given that you don't need to log in to use 99% of this site's functionality, and this site serves a niche market with a small development team, I respect their decision to not try to roll their own authentication. I'd rather they use oAuth than blunder their own implementation and risk a breach.
- cptskippy 7y agoWe have an on-going issue with Apple's protections going back almost a decade to when they started mucking about with 3rd Party Cookies. This isn't entirely their fault, blame also lies with the vendor we've chosen and our architecture for SSO. That being said, there are valid use cases for tracking users across websites. I work for a nonprofit that does fundraising using every imaginable PaaS or SaaS platform as well as quite a few in-house developed tools. We offer an SSO experience across all of these various platforms and integration is a nightmare. OpenIDC, OAuth, SAML, ADFS, and lots of custom APIs. It works for the most part everywhere except Safari where a few of our integrations just cannot and will not work due to their use of 3rd Party Cookies. Fortunately the way we've had to structure our solution, Sign in with Apple won't be much if any disruption to the status quo. It won't however help matters either.
- zchrykng 7y agoDefinitely a situation of non-nefarious uses getting nuked along with the nefarious ones. Not sure I would really blame Apple as much as all the horrible people who made it necessary for Apple to build this. They probably should allow more fine grained controls, something like "I know and trust these websites, don't nuke their cookies all the time" setting.
- cptskippy 7y ago> Not sure I would really blame Apple I don't. They have their users best interests at heart and their solutions have always left the functionality we needed there but that still doesn't mean they haven't been a thorn in my side by evolving their platforms.
- frenchyatwork 7y agoI don't know about the plaforms you're working with, but I'm pretty sure 3rd party cookies shouldn't be necessary for OpenIDC. They certainly weren't for OpenID. If it's a problem, it's probably because of the specific platform intentionally did things in a way that was bad for user's privacy. Unfortunately, non-profits I've seen tend to be really bad at privacy because they need to a) keep things cheap and b) have a significant presence on advertisement platforms.
- drywater 7y agoI just tried to register a new account at Wordpress but it's not working. Any other sites that you know?
- withinboredom 7y agoI work at WordPress, what wasn’t working?
- drywater 7y agoI click the "Use Apple" button and it takes me back at the same page with "you need a valid email account". This is on the ro.wordpress.com. Maybe it matters.
- withinboredom 7y agoThat doesn't sound right :( Did you use an "anonymous" email through Apple or your real email address?
- booleanbetrayal 7y agoThe rollout for Sign in with Apple was a disaster when it came to email deliverability. They seem to have given zero thought to people who used third party email services like CustomerIO or Sendgrid, indicating that they "weren't supported," leaving those providers to scramble to meet the strict DKIM / SPF / Return-Path requirements. Not only that, but if you were sending from an appropriately aligned and verified domain, in the first couple of weeks, deliverability might take in upwards of 12 hours for receipt. I believe they've since improved on the deliverability and the third-party email providers have accommodated appropriately, with Apple even providing brief integration tips for the most popular ones, but it left a pretty horrible taste in our mouths as we were jumping through all the integration hoops. EDIT: This is referring to email deliverability when attempting to contact private Apple relay addresses.
- tusharsoni 7y agoDeveloper of a recently launched app with Sign in with Apple here. I watched the keynote where they launched Sign in with Apple and was honestly surprised at how easy the implementation was. I thought it was a no-brainer to add it to my app. So, I follow their (severely lacking) docs and the keynote and get a solution working. Once the user logs in, their APIs hand you a token that you can then send to the server. Then, I thought, how do I verify this token on the server? While they do have docs on it [1], they simply omitted it from the keynote to make their example "just work". I would be very surprised if everyone was verifying the token on their servers. Not doing so seems like a loophole for many apps. [1] https://developer.apple.com/documentation/signinwithapplerestapi/verifying_a_user https://developer.apple.com/documentation/signinwithappleres...
- Andrex 7y agoWhat are the security implications of this?
- tusharsoni 7y agoThe biggest one is that you're essentially trusting data that the client is providing (Apple gives user id to the client and the client sends it to the server). Unless you can verify the token and exchange it for your own session id, you're opening up your users to be easily impersonated (if they get a hold of the user id). Other than that, Apple also provides server-side verification for the validity of the token. Without that, the client could send a random string and the server wouldn't know the difference.
- ec109685 7y agoWhy would someone be more likely to get a user id compared to your session id?
- pflats 7y agoIt depends on what the app does and how it does it. The first step (authenticating) returns a token with your app id, user email address, a unique user id, an expiration time 5m from issuance, and various other info. Suppose the token is not verified. If the app only uses the email to identify a client, then a malicious/compromised user could pass your app a forged token to access another user's account. If the app uses email and id, but not the other fields, then a replay attack is possible on a compromised user: the eavesdropper could simply send along an intercepted token to identify as the compromised user. If the timestamp is checked, this gets harder but is still doable. The other benefit: once you have verified the token, you can also refresh it in the future (1/day max) to silently re-verify the user. If you instead "re-"verify by repeating the initial credential issuance process, the user will be prompted for 2FA verification.
- eyesbear 7y agoApple forced some of the companies that rely on Apple’s platform iOS or MacOS to implement this feature, how is that not anti-trust?
- toasterlovin 7y agoBecause A) this is good for consumers, and B) Apple doesn't have the market position to force consumers or other vendors to do anything. There is plenty of choice and competition in the smartphone market.
- deleted 7y ago[deleted]
- celeritascelery 7y agoBecause no one has to use it. You can still use any other sign in option including good old email if you want.
- pwinnski 7y agoNot true. If you use any other social media signing, you must also support Sign In With Apple. You can, however, continue to use good old email alone.
- celeritascelery 7y agoDevelopers have to implement it, But users don’t have to use it.
- pwinnski 7y agoApple forced nobody to implement this feature UNLESS they were already using another social media login option. It is possibly an antitrust issue in an alternate universe in which our government still cares about antitrust issues, but since it's a net win for users, it might be a tough case to make.
- deleted 7y ago
- Tepix 7y agoAs a user, won't i a) share my data with Apple (i.e. they get to know every time i sign in) and b) makes me dependent on Apple (what happens to my account when i sell all my Apple devices?) ?
- tusharsoni 7y agoAs a developer, it's our responsibility to provide users with at least 2 options. While Sign in with Apple is convenient and seems to be fairly popular, users should be in control of their data. Some stats from my app where users have the option to either Sign in with Apple or use their phone number: 73% use Sign in with Apple and the rest using their phone number. If it was a privacy issue, wouldn't people rather trust Apple than an indie developer?
- OrgNet 7y agoI wish I could signup with just username and password (no email)... because gmail knows everything now (I don't mind having no password recovery option in many cases)
- crooked-v 7y ago> what happens to my account when i sell all my Apple devices? Apple ID doesn't depend on having Apple devices, and you can associate it with arbitrary email addresses.
- toasterlovin 7y ago> a) share my data with Apple (i.e. they get to know every time i sign in) They're only requiring this when there are other social login options available. It's not a bid to get access to your private information. It's designed to make it so you're not forced to share your information with Google/FB/Twitter. This existing is strictly better for users.
- vvG94KbDUtRa 7y agoUmmm it's also strictly better for apple. They do get to know every time you sign in, instead of another company getting that. It's certainly not better for users than creating a separate account tied to a separate email for every service without a big company in between.
- buboard 7y agoout of the 3 (google, fb , and apple) , having a fake FB profile is probably the best for my privacy. While FB may have tracked me they probably dont know my real name, while for apple it's mandatory, and most people probably have used their CC details with google at some point, plus these companies have my realtime location data as well. None of these systems are really private and it is a lie to tell our users that it is. That said, SSO logins are replacements for passwords, not usernames. You should always ask users for their email afterwards if you don't want to be bound to the service's whims who may decide to block you from their service or impose weird terms in the future, like how FB requires various forms of verification / interrogation to continue using their platform.
- FBLOLBOT 7y ago> While FB may have tracked me they probably dont know my real name It is highly likely they know exactly who you are via the huge amount of metadata you and those around you leak. I would be impressed if your "opsec" was good enough to evade Facebook.
- jedberg 7y agoI’ve only looked at the docs and not implemented it, but my impression was that if they leave the Apple ecosystem they lose access to your app. I suppose this is similar to any other “Sign in with” option, but it just seems more likely people will ditch Apple before they ditch gmail or Facebook, since they can keep those around pretty easily without using them or paying for them. For Apple you need to pay money and actively use it to stay in the ecosystem.
- samcat116 7y agoI mean if you sign into something with Google and then delete your google account you end up with the same result no?
- Xavdidtheshadow 7y agoYes, but deletion of a Google account (for a lot of people, the core of their whole internet experience) has way different probability than getting a new, non-apple phone.
- jedberg 7y agoYeah, but like I said, it doesn't cost much to keep a Google account around that you aren't using. It costs a lot to maintain yourself in the Apple ecosystem.
- pdimitar 7y agoI use it absolutely in every app I can find. Plus the email obfuscation option of course. No clue how popular it is but I quite like the idea.
- withinboredom 7y agoIt’s nice until you need to contact support when your apple account gets hacked and tell me your email is pdimitar at example dot com and I can’t verify that you’re a customer.
- netcyrax 7y agoSure, it helps with privacy with regards to the services that you login. But all the emails are forwarded by Apple. So if you don't trust the big player (i.e. Apple) this is not privacy-friendly at all.
- chrisseldo 7y agoSign in w/ Apple has been a great user experience. Something that always stuck in the back of my head when downloading and signing up for a new app was the stupid email confirmation.
- mtm7 7y agoFrom a user's perspective, I tried "Sign in with Apple" for the first time the other day on Dom Hoffman's new app Byte, and I'm really happy with it. Some benefits: 1. I don't need to remember a password to sign in 2. My real email is never shared with the service I'm signing up for 3. I had a new account in like 3 seconds without providing any personal information If any Apple employees are reading this, you guys did a great job!
- asveikau 7y agoI feel like it isn't all that meaningful to compare Apple vs. Google vs. Facebook auth if the data is coming from a community that already has a favorable view of the Apple ecosystem, eg. the crowd that reads Daring Fireball. The majority of the global market at large is not using Apple devices and Apple sign-in is not going to resonate so strongly or even be a possibility. If you are developing an iOS or Mac app, sure, that's a meaningful data point and feature suggestion. It won't be equally important for everyone.
- ianamartin 7y ago1.5 billion active devices with all of them tied to an easy payment method is very meaningful. Also, the wealthiest 1.5 billion and the most willing to spend money on tech/app purchases. This is a big deal. If you're trying to sell an app instead of trying to sell ads, Apple users is your target market, even if your app is web, native Windows, or Android.
- mikelpr 7y ago"I kept waiting for the “confirm your email address” email to arrive but it never did" really John? you expected a confirmation email to arrive? also, Google and Facebook don't require a confirmation email either
- aeyes 7y agoImplementing this was a huge pain, had to turn off DKIM to get it to work. Almost no documentation and when your mails bounce there is no information whatsoever what went wrong.
- Krasnol 7y agoAfter the bad reputation from the "security" story recently now 3 Apple ads on front page. Back in business on HN! Good job.
- simple-login 7y agoDisclaimer: I'm the founder of this service. I wouldn't trust a closed-source solution to be the privacy-focused identity provider. And with "Apple Search Ads", Apple could also be considered as an advertising company. I have actually started out to create a privacy-focused SSO solution named "Sign In with SimpleLogin" [1] before "Sign in with Apple" was announced. The solution is from the beginning meant to be open source and even self-hostable. It's superior than "Sign in with Apple" in several ways: - The dev experiences is far better - The random email part is customized - Name, avatar could also be customized If you visit the home page, you would notice that it's talking mainly about the email alias part as the SimpleLogin button is not implemented on popular websites yet, which hopefully will come soon. [1]: https://simplelogin.io/developer https://simplelogin.io/developer