9 ms·

Obfuscation of the email address is an explicit choice by the user when using Sign in with Apple. It’s not something forced by the service. If users are choosin

by AnonC 6y ago

Obfuscation of the email address is an explicit choice by the user when using Sign in with Apple. It’s not something forced by the service. If users are choosing to do that, it says something about the lack of trust the users have with whatever they’re signing up for.

rattray 6y ago
There's two kinds of "obfuscation" at play with Sign In With Apple. One is true obfuscation - "hide my email". That would be a poor choice for use with any app you hope to have an ongoing relationship with, I'd think. The other is just the use of iCloud email addresses, detailed in the post, which seemed like a very good and concerning point. It's also much less likely to be a problem with FB or Google login.
- crooked-v 6y ago
  Your primary iCloud email address is meant to just be your main email address, including non-Apple email addresses.
  - imron 6y ago
    "Meant to" doesn't mean "is", and even if 99% of people do what they are "meant to", that still leaves millions of people doing it the "wrong" way.
    - Firehawke 6y ago
      Yep. I rarely run into people who use their iCloud email, and that goes for both the technically inclined and the average users. Locking things down like this seems to have some serious negatives that Apple needs to reconsider their approach for.
      - gemvox 6y ago
        But you don't need to have your iCloud mail set as the primary mail for your AppleID. You don't even need to create an iCloud mail when you create an iCloud/AppleID account, it's an optional step. I recently created another iCloud test account and it's also not shoved in your face or anything, it's a small little button called "Don't have an email address?" somewhere. So I don't even really understand how people get into this situation.
- bradleybuda 6y ago
  I can have an ongoing relationship with an app without that app’s developer having an ongoing relationship with my inbox.
  - JAlexoid 6y ago
    Sure you can. But they explain why it's not applicable for their use case. And I would literally blow up at Apple, if they forced this on TripIt... Sharing trip information is done using registered email. And iCloud email is crap.
    - jessaustin 6y ago
      Sharing trip information is done using registered email. Could you provide any details? How is such "registered" email different than any other email?
      - CiaranMcNulty 6y ago
        "by using the email account you registered with"
        whynaut 6y ago
        not GP but like, ok, why can’t that be sent from any other email (user-provided or otherwise)?
        thomaslord 6y ago
        My guess is that it's being send to the email the user registered with. And requiring them to provide a separate email from the one they registered with completely defeats the purpose of obfuscating the email in the first place, so I think it'd be unreasonable to ask a developer to implement a whole second place to put an email just to work around Apple denying access to that information in the first place. At the very least Sign in with Apple needs to support a request for the user to enter the real email they want to use to be contacted by the app after-the-fact for cases where someone obfuscates their email but then wants access to functionality that explicitly requires their real email.
untog 6y ago
I dunno about that. I literally choose it every time, because why not? It's my default.
sudoit 6y ago
Not necessarily. I have an app with 1,000 users, and about 99% of them choose to obfuscate. My app isn’t untrustworthy at all either. It’s an experimental app which attempts to let users create an iOS app on iOS. My suspicion is that people choose to obfuscate because it’s what’s selected by default.
- meristem 6y ago
  Most likely. Never underestimate the power of defaults
- moksly 6y ago
  This is anecdotal but if I could chose not to share my email with things I sign up for, I wouldn’t have a gmail address used solely for signing up to things. I can’t think of a single thing that I’ve ever signed up for that I actually wanted to have my email. So sure, it’s default, but unless I’m unique some people will see the default and go “why isn’t every 3rd party login like that?”.
- vladvasiliu 6y ago
  I agree with the sibling in that defaults are powerful. However, I've never built anything directly used "by the public", nor am I very familiar with how Apple Sign in works. So I'm wondering, as the developer of a trustworthy app, what's the drawback in the user giving an obfuscated address? Is it not possible for you to contact the user using this address? Does the user have to manually allow getting mail to this address or somehow jump through some hoops to read it?
  - tigershark 6y ago
    As explained in the article a lot of people use the iCloud mail for their apple account and they don’t check it because they use another provider main mail address. Furthermore if they contact them from their email for support they have no way to associate it with the mail registered in the system, so they can’t help them. If you ask me they seem both very valid points.
    - 6y ago
thaway757383884 6y ago
The biggest problem is that Apple insists on tying the fake email with your iCloud email, which the vast majority of people don’t use. If they tied it instead to what people’s normal mail was, a lot of issues would be averted.
- hn_check 6y ago
  Your iCloud email can be any email service you want... Apple will create one for you on theirs but that is only an option.
- kemayo 6y ago
  They tie it to whatever your Apple ID primary email is. This is only your iCloud email if you've deliberately made one, which isn't the default.
neltnerb 6y ago
So... I'm having a bit of a hard time as seeing this as not a problem with Apple more than this app company. Apple is obfuscating your email address by default (great!) but is then forwarding that obfuscated email address to an address that they select without asking the user. It seems like this entire complaint would be solved if Apple prioritized "obfsucated email works for our paying users" (i.e. deliver mail to an address they select) over "create a strong incentive to use our email service if they want to get their precious emails". I use obfuscated emails all the time, everywhere, by default. But I selected what email address they forward to when I set it up. How does an app maker get the blame for Apple not doing this? Edit: Now, the app relying on un-obfuscated email addresses for finding contacts I have less sympathy for. There are many other good options for this, and they should work with obfuscated email address IMO. Seems like everyplace I use has no trouble with usernames...

by AnonC 6y ago

rattray 6y ago

There's two kinds of "obfuscation" at play with Sign In With Apple. One is true obfuscation - "hide my email". That would be a poor choice for use with any app you hope to have an ongoing relationship with, I'd think. The other is just the use of iCloud email addresses, detailed in the post, which seemed like a very good and concerning point. It's also much less likely to be a problem with FB or Google login.

crooked-v 6y ago
Your primary iCloud email address is meant to just be your main email address, including non-Apple email addresses.
- imron 6y ago
  "Meant to" doesn't mean "is", and even if 99% of people do what they are "meant to", that still leaves millions of people doing it the "wrong" way.
  - Firehawke 6y ago
    Yep. I rarely run into people who use their iCloud email, and that goes for both the technically inclined and the average users. Locking things down like this seems to have some serious negatives that Apple needs to reconsider their approach for.
    - gemvox 6y ago
      But you don't need to have your iCloud mail set as the primary mail for your AppleID. You don't even need to create an iCloud mail when you create an iCloud/AppleID account, it's an optional step. I recently created another iCloud test account and it's also not shoved in your face or anything, it's a small little button called "Don't have an email address?" somewhere. So I don't even really understand how people get into this situation.
bradleybuda 6y ago
I can have an ongoing relationship with an app without that app’s developer having an ongoing relationship with my inbox.
- JAlexoid 6y ago
  Sure you can. But they explain why it's not applicable for their use case. And I would literally blow up at Apple, if they forced this on TripIt... Sharing trip information is done using registered email. And iCloud email is crap.
  - jessaustin 6y ago
    Sharing trip information is done using registered email. Could you provide any details? How is such "registered" email different than any other email?
    - CiaranMcNulty 6y ago
      "by using the email account you registered with"
      - whynaut 6y ago
        not GP but like, ok, why can’t that be sent from any other email (user-provided or otherwise)?
        thomaslord 6y ago
        My guess is that it's being send to the email the user registered with. And requiring them to provide a separate email from the one they registered with completely defeats the purpose of obfuscating the email in the first place, so I think it'd be unreasonable to ask a developer to implement a whole second place to put an email just to work around Apple denying access to that information in the first place. At the very least Sign in with Apple needs to support a request for the user to enter the real email they want to use to be contacted by the app after-the-fact for cases where someone obfuscates their email but then wants access to functionality that explicitly requires their real email.

untog 6y ago

I dunno about that. I literally choose it every time, because why not? It's my default.

sudoit 6y ago

Not necessarily. I have an app with 1,000 users, and about 99% of them choose to obfuscate. My app isn’t untrustworthy at all either. It’s an experimental app which attempts to let users create an iOS app on iOS. My suspicion is that people choose to obfuscate because it’s what’s selected by default.

meristem 6y ago
Most likely. Never underestimate the power of defaults
moksly 6y ago
This is anecdotal but if I could chose not to share my email with things I sign up for, I wouldn’t have a gmail address used solely for signing up to things. I can’t think of a single thing that I’ve ever signed up for that I actually wanted to have my email. So sure, it’s default, but unless I’m unique some people will see the default and go “why isn’t every 3rd party login like that?”.
vladvasiliu 6y ago
I agree with the sibling in that defaults are powerful. However, I've never built anything directly used "by the public", nor am I very familiar with how Apple Sign in works. So I'm wondering, as the developer of a trustworthy app, what's the drawback in the user giving an obfuscated address? Is it not possible for you to contact the user using this address? Does the user have to manually allow getting mail to this address or somehow jump through some hoops to read it?
- tigershark 6y ago
  As explained in the article a lot of people use the iCloud mail for their apple account and they don’t check it because they use another provider main mail address. Furthermore if they contact them from their email for support they have no way to associate it with the mail registered in the system, so they can’t help them. If you ask me they seem both very valid points.
  - 6y ago

thaway757383884 6y ago

The biggest problem is that Apple insists on tying the fake email with your iCloud email, which the vast majority of people don’t use. If they tied it instead to what people’s normal mail was, a lot of issues would be averted.

hn_check 6y ago
Your iCloud email can be any email service you want... Apple will create one for you on theirs but that is only an option.
kemayo 6y ago
They tie it to whatever your Apple ID primary email is. This is only your iCloud email if you've deliberately made one, which isn't the default.

neltnerb 6y ago

So... I'm having a bit of a hard time as seeing this as not a problem with Apple more than this app company. Apple is obfuscating your email address by default (great!) but is then forwarding that obfuscated email address to an address that they select without asking the user. It seems like this entire complaint would be solved if Apple prioritized "obfsucated email works for our paying users" (i.e. deliver mail to an address they select) over "create a strong incentive to use our email service if they want to get their precious emails". I use obfuscated emails all the time, everywhere, by default. But I selected what email address they forward to when I set it up. How does an app maker get the blame for Apple not doing this? Edit: Now, the app relying on un-obfuscated email addresses for finding contacts I have less sympathy for. There are many other good options for this, and they should work with obfuscated email address IMO. Seems like everyplace I use has no trouble with usernames...