5 ms·

> Another issue is Sign in with Apple’s “Hide My Email” feature. With this feature, if you create an account with us, Apple will generate a special email addres

> Another issue is Sign in with Apple’s “Hide My Email” feature. With this feature, if you create an account with us, Apple will generate a special email address just for that account. So rather than your email address being john.doe@icloud.com, we will see your email address as something like dpdcnf87nu@privaterelay.appleid.com. Ironically, this is also why I use Sign Up with Apple at every opportunity I can

renewiltord 6y ago
How is this ironic? It is by design and obviously they know why people do it because the very next sentence says that. Why on Earth would you'd want to use a list-sharing app that uses email as the addressing system and then not share your email.
- swagonomixxx 6y ago
  The anonymous e-mail that Sign-In with Apple generates forwards to the e-mail used to set up your Apple ID. So it's not like it's a random e-mail that acts as a /dev/null. This is by far the biggest selling point of Sign-In with Apple for me and I will continue to use it, and continue to not use apps that don't support it. I have plenty of e-mail aliases, but having an alias auto-generated for you is very convenient, and not having to generate a secure password is also very convenient. The day AnyList gets hacked (not saying it will - but it's highly likely, the way security has taken a backseat due to "features") then at least my personal e-mail and password won't be there for every hacker on Earth to see and try to spam passwords to get into all of my other accounts.
  - ajhurliman 6y ago
    Small nit: Potential hackers would only have access to your email, provider id and whatever other details they pass along (preferred name, profile picture URL, etc.). Social login doesn't provide consumers (AnyList in this case) with your password.
    - swagonomixxx 6y ago
      Agreed, social login like Facebook et. al do not provide passwords to consumers, but e-mail is already contentious enough. Most people use the same e-mail for every single account they have. A large majority of these users use the same password for all of their accounts. (Just want to clarify that I do neither of these things - I have a large set of e-mail aliases and have a unique & secure password for each account I have to set up manually). If you'll grant me that fact, then all I need is your e-mail from a dump of AnyList's users table, and look up that e-mail in my already vast database of dumped tables, and see that your password was "hunter2". Now I have access to your bank account, because you used the same e-mail and password for that account as well. This is a bit of a contrived example, but in general, any personal information that is leaked (e-mail included) is bad - full name, address, and the like, which many websites ask for, is even worse, because crackers have even a better shot at guessing a lot of your personal information, and at that point, the ball is in their park.
      - JAlexoid 6y ago
        FYI: Getting a hold of someones' email isn't particularly hard.
  - renewiltord 6y ago
    Perhaps you don't use AnyList? It doesn't make sense to use with a private mail relay because they use email as an addressing system. And honestly, few users will go look up their per-app address and tell people to add them.
    - swagonomixxx 6y ago
      Ah, I wasn't aware that e-mail was used as an addressing system within AnyList. Do users not have any usernames associated with their e-mails? Still, I think in this day and age, having a requirement in your product that says "e-mail that is provided should be the one the user uses the most" is pretty naive. In general, it's true, but when it comes to 3rd party authentication providers like Facebook, Google, and now Apple, this kind of requirement is not really useful and will likely cause issues for you down the line, which is why usernames are better for addressing people within apps (e.g, Instagram handles).
      - renewiltord 6y ago
        It is rather unusual, honestly. Even Venmo uses just an app-specific name. That's probably a lesson in product design: have your own usernames.
        crooked-v 6y ago
        I'd personally for for the method used by Blizzard and Discord where a randomly generated ID is the actual unique value, while the username is just a display setting.
        renewiltord 6y ago
        I get all the advantages of that but for some reason it's so hard when you get into a game and you're trying to get everyone there into a discord. Riot does this with Valorant too and the implementation is a nightmare.
    - KeepFlying 6y ago
  - Aeolun 6y ago
    So you say you are using your email as the unique identifier instead of the password? If you use a unique password for every service, what would you need a unique email for?
    - ogre_codes 6y ago
      > If you use a unique password for every service, what would you need a unique email for? Because then you control when the flow of marketing or "Service" related email stops. And you can tell which vendor leaked your email either deliberately or by accident.
- TheArcane 6y ago
  It's ironic because anylist cites that as a reason to stop supporting that very feature. That would only reduce my desire to Sign Up for that app.
  - JAlexoid 6y ago
    As a reminder - us privacy aware technical people aren't remotely relevant anymore. So... You're not their target audience.
    - GoblinSlayer 6y ago
      Apparently Apple makes privacy by default their PR strategy. So it's kinda relevant, at least in Apple garden.
Smoosh 6y ago
The article also implies that if anyone can guess your email address, they can send you/share with you a list. I wonder what anti-spam measures AnyList implements?
- floatingatoll 6y ago
  Sign In With Apple would require that AnyList enable SPF protections on any outbound domain registered with Apple for SIWP use: To send emails to users with private email addresses, you must register your outbound emails or email domains and use Sender Policy Framework (SPF) to authenticate your outbound emails.
- Aeolun 6y ago
  I assume they rely on the fact that sharing a random list with a random person a thousand times is pointless.
  - Smoosh 6y ago
    What if the list contains/is itself advertising, and the random person is everyone on a huge list of active email accounts?
    - Aeolun 6y ago
      Why would you go through the trouble of sharing a list when you can just email them directly?
jackson1442 6y ago
If they really needed a user ID, just have account holders create a username after the Apple sign-in flow. Most people have a go-to username, and those are easy enough to remember and give to a support associate.

renewiltord 6y ago

How is this ironic? It is by design and obviously they know why people do it because the very next sentence says that. Why on Earth would you'd want to use a list-sharing app that uses email as the addressing system and then not share your email.

swagonomixxx 6y ago
The anonymous e-mail that Sign-In with Apple generates forwards to the e-mail used to set up your Apple ID. So it's not like it's a random e-mail that acts as a /dev/null. This is by far the biggest selling point of Sign-In with Apple for me and I will continue to use it, and continue to not use apps that don't support it. I have plenty of e-mail aliases, but having an alias auto-generated for you is very convenient, and not having to generate a secure password is also very convenient. The day AnyList gets hacked (not saying it will - but it's highly likely, the way security has taken a backseat due to "features") then at least my personal e-mail and password won't be there for every hacker on Earth to see and try to spam passwords to get into all of my other accounts.
- ajhurliman 6y ago
  Small nit: Potential hackers would only have access to your email, provider id and whatever other details they pass along (preferred name, profile picture URL, etc.). Social login doesn't provide consumers (AnyList in this case) with your password.
  - swagonomixxx 6y ago
    Agreed, social login like Facebook et. al do not provide passwords to consumers, but e-mail is already contentious enough. Most people use the same e-mail for every single account they have. A large majority of these users use the same password for all of their accounts. (Just want to clarify that I do neither of these things - I have a large set of e-mail aliases and have a unique & secure password for each account I have to set up manually). If you'll grant me that fact, then all I need is your e-mail from a dump of AnyList's users table, and look up that e-mail in my already vast database of dumped tables, and see that your password was "hunter2". Now I have access to your bank account, because you used the same e-mail and password for that account as well. This is a bit of a contrived example, but in general, any personal information that is leaked (e-mail included) is bad - full name, address, and the like, which many websites ask for, is even worse, because crackers have even a better shot at guessing a lot of your personal information, and at that point, the ball is in their park.
    - JAlexoid 6y ago
      FYI: Getting a hold of someones' email isn't particularly hard.
- renewiltord 6y ago
  Perhaps you don't use AnyList? It doesn't make sense to use with a private mail relay because they use email as an addressing system. And honestly, few users will go look up their per-app address and tell people to add them.
  - swagonomixxx 6y ago
    Ah, I wasn't aware that e-mail was used as an addressing system within AnyList. Do users not have any usernames associated with their e-mails? Still, I think in this day and age, having a requirement in your product that says "e-mail that is provided should be the one the user uses the most" is pretty naive. In general, it's true, but when it comes to 3rd party authentication providers like Facebook, Google, and now Apple, this kind of requirement is not really useful and will likely cause issues for you down the line, which is why usernames are better for addressing people within apps (e.g, Instagram handles).
    - renewiltord 6y ago
      It is rather unusual, honestly. Even Venmo uses just an app-specific name. That's probably a lesson in product design: have your own usernames.
      - crooked-v 6y ago
        I'd personally for for the method used by Blizzard and Discord where a randomly generated ID is the actual unique value, while the username is just a display setting.
        renewiltord 6y ago
        I get all the advantages of that but for some reason it's so hard when you get into a game and you're trying to get everyone there into a discord. Riot does this with Valorant too and the implementation is a nightmare.
  - KeepFlying 6y ago
- Aeolun 6y ago
  So you say you are using your email as the unique identifier instead of the password? If you use a unique password for every service, what would you need a unique email for?
  - ogre_codes 6y ago
    > If you use a unique password for every service, what would you need a unique email for? Because then you control when the flow of marketing or "Service" related email stops. And you can tell which vendor leaked your email either deliberately or by accident.
TheArcane 6y ago
It's ironic because anylist cites that as a reason to stop supporting that very feature. That would only reduce my desire to Sign Up for that app.
- JAlexoid 6y ago
  As a reminder - us privacy aware technical people aren't remotely relevant anymore. So... You're not their target audience.
  - GoblinSlayer 6y ago
    Apparently Apple makes privacy by default their PR strategy. So it's kinda relevant, at least in Apple garden.

Smoosh 6y ago

The article also implies that if anyone can guess your email address, they can send you/share with you a list. I wonder what anti-spam measures AnyList implements?

floatingatoll 6y ago
Sign In With Apple would require that AnyList enable SPF protections on any outbound domain registered with Apple for SIWP use: To send emails to users with private email addresses, you must register your outbound emails or email domains and use Sender Policy Framework (SPF) to authenticate your outbound emails.
Aeolun 6y ago
I assume they rely on the fact that sharing a random list with a random person a thousand times is pointless.
- Smoosh 6y ago
  What if the list contains/is itself advertising, and the random person is everyone on a huge list of active email accounts?
  - Aeolun 6y ago
    Why would you go through the trouble of sharing a list when you can just email them directly?

jackson1442 6y ago

If they really needed a user ID, just have account holders create a username after the Apple sign-in flow. Most people have a go-to username, and those are easy enough to remember and give to a support associate.