7 ms·

> Nowadays any iOS app that doesn’t support logging in with Apple makes me think twice about whether I really need the app. I agree. I only create accounts for

> Nowadays any iOS app that doesn’t support logging in with Apple makes me think twice about whether I really need the app. I agree. I only create accounts for things reluctantly. Because 1. Why do you want my email address, or DOB, or whatever else? I don't want your marketing, and 2. I can't be bothered, I downloaded your app because I have something I want to get done.

pjerem 5y ago
> Why do you want my email address Because Apple's SSO will not be eternal and nobody wants to have a tier as a proxy on an important account credential. Apple SSO is ok for throwaway account where your account has no "sentimental value" that you can't recreate easily. But the author of this post maintains a social network : nobody wants to be locked out a social network. I have active accounts on websites that existed back when Apple was fighting not to die and I would have totally lost access to them if I had to sign-in to them through my Lycos account.
- wokwokwok 5y ago
  You’ve got to be kidding. Don’t use apple SSO because apple might not exist one day? You may as well argue not signup to anything using gmail because, heck, google might go out of business. There is no benefit to users in giving your “real” details to service providers; the benefit is entirely on their side. You can argue that Apple is harming the opportunities for 3rd party developers, sure, taking advantage of them? Sure. …but let’s not try to frame this as somehow “pro consumer” to give your email away so people can spam you with notifications and offers to lift their engagement rates. That is pure BS.
  - simion314 5y ago
    >Don’t use apple SSO because apple might not exist one day? >You may as well argue not signup to anything using gmail because, heck, google might go out of business. I assume OP point is that Apple or Google could still exists but your accounts might not exist, maybe you get banned or just decide you don't want to use Apple/Google/FB anymore.
  - ascar 5y ago
    I don't think your tone is warranted and in the spirit of this community. I don't agree with GP's fear of Apple SSO vanishing without a transition period to something else, but the general premise that this form of login is not eternal but rather short lived in the grand scheme of things is reasonable and doesn't warrant your aggressiveness. Also you might get locked out of your Apple account for a number of reasons and will then lose access to much more than just Apple services.
    - imwillofficial 5y ago
      And this is a risk for the user to take on, night a choice that should be left to a petty developer.
    - user-the-name 5y ago
      It is also not really a valid argument here, given that the service we are talking about was offering Facebook and Google login options, which share the exact same issue, but with the added privacy violations of those platforms.
      - j2bax 5y ago
        Facebook and Google login were options in addition to standard email sign up.
        user-the-name 5y ago
        And Sign in with Apple is another option in addition to those.
      - cesarb 5y ago
        From what I understood from these discussions, that is not an issue with Facebook and Google logins because they reveal the true user email address, so even if they no longer exist one day, that email address could be used to recover the user accounts (using a password recovery flow through email); while Apple SSO does not reveal the true user email address, only a proxy through Apple's systems, so if it no longer exists one day, there's no way to use the email address to recover the user accounts.
  - oriolid 5y ago
    > Don’t use apple SSO because apple might not exist one day? There might be a day when Apple is not _my_ cell phone platform. Even now I have an Android phone and iPad and I prefer to have access to same services from both.
    - gowld 5y ago
      No Apple cell phone required. https://firebase.google.com/docs/auth/android/apple https://firebase.google.com/docs/auth/android/apple
      - oriolid 5y ago
        Looks more complicated than just not using Apple ID.
    - elzbardico 5y ago
      You can still have an apple ID even if you never ever had even a single app device.
      - oriolid 5y ago
        Technically true, the best kind of true.
  - pjerem 5y ago
    > You may as well argue not signup to anything using gmail because, heck, google might go out of business. I personally avoid to do it, but that's not the point. Every other third party allows account recovery by mail : if you want to stop using FB or Google's SSO, you can ask the website to send you a mail to prove the account ownership. If Apple's SSO stopped working (because Apple stopped it, banned you, because you dont have Apple devices anymore so you are locked out of their proprietary 2FA), none of those websites could send you a recovery email. > That is pure BS. I don't feel like I've been insulting, so please don't be either.
    - nyuszika7h 5y ago
      > because you dont have Apple devices anymore so you are locked out of their proprietary 2FA They have SMS as a fallback. I know it's insecure and I'd rather they support TOTP, but let's not pretend having an Apple device is the only way to receive 2FA codes for your Apple ID.
      - pjerem 5y ago
        > let's not pretend I pretend nothing, I just didn't knew it since I had an iPhone for years.
      - imwillofficial 5y ago
        > let’s not pretend This line is unwarranted and in violation of HN rules. Be cool. I learned something today. I didn’t know you could get SMS codes for Apple 2FA.
  - webmobdev 5y ago
    > Don’t use apple SSO because apple might not exist one day? Yes. And more to the point, because that Apple service may not exist in the future. Or Apple may determine that a particular app or service can no longer use its service for whatever reason, and you as a user will not have any choice in that manner. It's all been done before.
    - pjerem 5y ago
      And it makes me think : what happens to the "proxy emails" affected to your application when Apple decides to ban your app from the App Store ? Are your users still reachable ? Is there any information on this ? Given an alternative storyline where Epic Games allowed users to create account with relayed apple mails, wouldn't all those accounts suddenly became unusable today ?
      - jackson1442 5y ago
        Epic actually did allow users to use SWA since they have about 5 other IdPs they allow. Apple didn't suspend their access to SWA at any point, though there were stories about it at the time.
  - fmajid 5y ago
    Apple is not going anywhere, but they can terminate your account on a whim: https://appleinsider.com/articles/21/04/20/man-sues-apple-for-terminating-apple-id-with-24k-worth-of-content https://appleinsider.com/articles/21/04/20/man-sues-apple-fo... So has Google, and presumably the other platforms as well.
    - nyuszika7h 5y ago
      Exactly, the same thing can happen with Google, so are you suggesting that users should not use direct email signup with Gmail either?
      - fmajid 5y ago
        Yes, or at least not with a @gmail.com domain. Running Google Apps with a custom domain you own and Google can't snatch away is fine (well, apart from the privacy implications of giving Google free rein to read your emails, of course). That means not using Google as your registrar, obviously.
- martimarkov 5y ago
  Sign In with Apple allows you to share your email so you are incorrect. If I decide to hide my email and be locked out - my choice. Developers and companies are greedy for data. Why do we have the expectation that emails should be shared? I constantly say don’t send me marketing and some services send. On my part I report them as spam every time so that algos start blocking them as they are breaking our contract and are malicious. For every service I’ve built allow the user to create an account with email, Google, Microsoft, Apple, Twitter, Facebook and to later untie their account and move to email. Also if they ever get locked out from their oauth account they can use the email to create a password and login via the normal way.
  - pjerem 5y ago
    > Also if they ever get locked out from their oauth account they can use the email to create a password and login via the normal way. This is exactly my point ! You can't recover your account if you don't know the mail used for registration. Even if you remembered it, no check could be made if Apple stopped to proxy the mails for one or another reason. With other providers, you could always recover an account because your email address would let you prove the ownership of the account.
    - gowld 5y ago
      What if my email address stops getting mail for one or another reason?
      - dkdbejwi383 5y ago
        Then it loses marketing value and data hungry companies no longer care
        Redoubts 5y ago
        The point is Apple relay goes under is the same risk as gmail goes under.
- Nextgrid 5y ago
  Apple's SSO may not be eternal but it's also very unlikely to disappear overnight. If it is indeed going to be phased out you will have advance notice of this and a transition period. I agree that in a perfect world you'd provide your real email address and solve this problem. But developers and companies have repeatedly proven themselves to not be trustworthy and the majority will misuse any contact details for spam which users do not want. In fact there wouldn't be a business case (nor appeal to end-users) for Sign in with Apple if this wasn't a real problem.
  - jjav 5y ago
    > Apple's SSO may not be eternal but it's also very unlikely to disappear overnight. If it is indeed going to be phased out you will have advance notice of this and a transition period. They may well offer notice and time when they cancel the service in some future. They won't offer any of that if they happen to erase your account just because though, as has happened to many people.
- fmajid 5y ago
  Don't forget in your threat model that Apple can cancel your account at any time for any reason whatsoever. They've even done it to security researchers using Apple's own bug bounty program. If that happens, you are stranded with those accounts effectively inaccessible to you forever. https://appleinsider.com/articles/21/04/20/man-sues-apple-for-terminating-apple-id-with-24k-worth-of-content https://appleinsider.com/articles/21/04/20/man-sues-apple-fo...
  - Redoubts 5y ago
    How does this threat model compare to using gmail or hotmail for your account access?
  - nyuszika7h 5y ago
    So? Google can also cancel your account at any time for any reason whatsoever, and good luck getting it back unless you're a celebrity with connections or manage to make a big enough fuss about it on social media. Using the same logic, you should not use Gmail then.
    - pjerem 5y ago
      Exactly, you should not use Gmail then. But that's off-topic.
      - LadyCailin 5y ago
        It isn’t though, because the developer had no problem offering that as a social login.
    - cesarb 5y ago
      > Google can also cancel your account at any time for any reason whatsoever [...] Using the same logic, you should not use Gmail then. Actually, under that logic it's only that you shouldn't use the @gmail.com domain; it should be fine to use Gmail with your own domain, since that allows you to recover if your Google account is canceled (just change the MX to another email provider). Another thing you can do is to never use your Google account for anything other than email; that should reduce the chances of the account being canceled for no obvious reason. For instance, it's been reported that, if you used your Google account for Youtube, and Google decided your real name was not your real name (which it wanted due to the Google Plus integration with Youtube), your whole Google account could be canceled; that risk could be avoided by just never logging into Youtube with your Google account.
- jclardy 5y ago
  Then your issue isn't with Apple's SSO, it is with all SSO providers. Facebook/Google login are not eternal. The only difference is the proxy, which can be disabled. Any website offering SSO options would have a sunset period to move it over if a provider went under...and if they don't, they are likely defunct at that point anyways...
- elzbardico 5y ago
  Apple may not be eternal, but probably will still be around for many decades after your app is completely forgotten. I still have the same IBM and Oracle accounts from the 90's. Big enterprises tend to stick around for a friggin long time.

pjerem 5y ago

> Why do you want my email address Because Apple's SSO will not be eternal and nobody wants to have a tier as a proxy on an important account credential. Apple SSO is ok for throwaway account where your account has no "sentimental value" that you can't recreate easily. But the author of this post maintains a social network : nobody wants to be locked out a social network. I have active accounts on websites that existed back when Apple was fighting not to die and I would have totally lost access to them if I had to sign-in to them through my Lycos account.

wokwokwok 5y ago
You’ve got to be kidding. Don’t use apple SSO because apple might not exist one day? You may as well argue not signup to anything using gmail because, heck, google might go out of business. There is no benefit to users in giving your “real” details to service providers; the benefit is entirely on their side. You can argue that Apple is harming the opportunities for 3rd party developers, sure, taking advantage of them? Sure. …but let’s not try to frame this as somehow “pro consumer” to give your email away so people can spam you with notifications and offers to lift their engagement rates. That is pure BS.
- simion314 5y ago
  >Don’t use apple SSO because apple might not exist one day? >You may as well argue not signup to anything using gmail because, heck, google might go out of business. I assume OP point is that Apple or Google could still exists but your accounts might not exist, maybe you get banned or just decide you don't want to use Apple/Google/FB anymore.
- ascar 5y ago
  I don't think your tone is warranted and in the spirit of this community. I don't agree with GP's fear of Apple SSO vanishing without a transition period to something else, but the general premise that this form of login is not eternal but rather short lived in the grand scheme of things is reasonable and doesn't warrant your aggressiveness. Also you might get locked out of your Apple account for a number of reasons and will then lose access to much more than just Apple services.
  - imwillofficial 5y ago
    And this is a risk for the user to take on, night a choice that should be left to a petty developer.
  - user-the-name 5y ago
    It is also not really a valid argument here, given that the service we are talking about was offering Facebook and Google login options, which share the exact same issue, but with the added privacy violations of those platforms.
    - j2bax 5y ago
      Facebook and Google login were options in addition to standard email sign up.
      - user-the-name 5y ago
        And Sign in with Apple is another option in addition to those.
    - cesarb 5y ago
      From what I understood from these discussions, that is not an issue with Facebook and Google logins because they reveal the true user email address, so even if they no longer exist one day, that email address could be used to recover the user accounts (using a password recovery flow through email); while Apple SSO does not reveal the true user email address, only a proxy through Apple's systems, so if it no longer exists one day, there's no way to use the email address to recover the user accounts.
- oriolid 5y ago
  > Don’t use apple SSO because apple might not exist one day? There might be a day when Apple is not _my_ cell phone platform. Even now I have an Android phone and iPad and I prefer to have access to same services from both.
  - gowld 5y ago
    No Apple cell phone required. https://firebase.google.com/docs/auth/android/apple https://firebase.google.com/docs/auth/android/apple
    - oriolid 5y ago
      Looks more complicated than just not using Apple ID.
  - elzbardico 5y ago
    You can still have an apple ID even if you never ever had even a single app device.
    - oriolid 5y ago
      Technically true, the best kind of true.
- pjerem 5y ago
  > You may as well argue not signup to anything using gmail because, heck, google might go out of business. I personally avoid to do it, but that's not the point. Every other third party allows account recovery by mail : if you want to stop using FB or Google's SSO, you can ask the website to send you a mail to prove the account ownership. If Apple's SSO stopped working (because Apple stopped it, banned you, because you dont have Apple devices anymore so you are locked out of their proprietary 2FA), none of those websites could send you a recovery email. > That is pure BS. I don't feel like I've been insulting, so please don't be either.
  - nyuszika7h 5y ago
    > because you dont have Apple devices anymore so you are locked out of their proprietary 2FA They have SMS as a fallback. I know it's insecure and I'd rather they support TOTP, but let's not pretend having an Apple device is the only way to receive 2FA codes for your Apple ID.
    - pjerem 5y ago
      > let's not pretend I pretend nothing, I just didn't knew it since I had an iPhone for years.
    - imwillofficial 5y ago
      > let’s not pretend This line is unwarranted and in violation of HN rules. Be cool. I learned something today. I didn’t know you could get SMS codes for Apple 2FA.
- webmobdev 5y ago
  > Don’t use apple SSO because apple might not exist one day? Yes. And more to the point, because that Apple service may not exist in the future. Or Apple may determine that a particular app or service can no longer use its service for whatever reason, and you as a user will not have any choice in that manner. It's all been done before.
  - pjerem 5y ago
    And it makes me think : what happens to the "proxy emails" affected to your application when Apple decides to ban your app from the App Store ? Are your users still reachable ? Is there any information on this ? Given an alternative storyline where Epic Games allowed users to create account with relayed apple mails, wouldn't all those accounts suddenly became unusable today ?
    - jackson1442 5y ago
      Epic actually did allow users to use SWA since they have about 5 other IdPs they allow. Apple didn't suspend their access to SWA at any point, though there were stories about it at the time.
- fmajid 5y ago
  Apple is not going anywhere, but they can terminate your account on a whim: https://appleinsider.com/articles/21/04/20/man-sues-apple-for-terminating-apple-id-with-24k-worth-of-content https://appleinsider.com/articles/21/04/20/man-sues-apple-fo... So has Google, and presumably the other platforms as well.
  - nyuszika7h 5y ago
    Exactly, the same thing can happen with Google, so are you suggesting that users should not use direct email signup with Gmail either?
    - fmajid 5y ago
      Yes, or at least not with a @gmail.com domain. Running Google Apps with a custom domain you own and Google can't snatch away is fine (well, apart from the privacy implications of giving Google free rein to read your emails, of course). That means not using Google as your registrar, obviously.
martimarkov 5y ago
Sign In with Apple allows you to share your email so you are incorrect. If I decide to hide my email and be locked out - my choice. Developers and companies are greedy for data. Why do we have the expectation that emails should be shared? I constantly say don’t send me marketing and some services send. On my part I report them as spam every time so that algos start blocking them as they are breaking our contract and are malicious. For every service I’ve built allow the user to create an account with email, Google, Microsoft, Apple, Twitter, Facebook and to later untie their account and move to email. Also if they ever get locked out from their oauth account they can use the email to create a password and login via the normal way.
- pjerem 5y ago
  > Also if they ever get locked out from their oauth account they can use the email to create a password and login via the normal way. This is exactly my point ! You can't recover your account if you don't know the mail used for registration. Even if you remembered it, no check could be made if Apple stopped to proxy the mails for one or another reason. With other providers, you could always recover an account because your email address would let you prove the ownership of the account.
  - gowld 5y ago
    What if my email address stops getting mail for one or another reason?
    - dkdbejwi383 5y ago
      Then it loses marketing value and data hungry companies no longer care
      - Redoubts 5y ago
        The point is Apple relay goes under is the same risk as gmail goes under.
Nextgrid 5y ago
Apple's SSO may not be eternal but it's also very unlikely to disappear overnight. If it is indeed going to be phased out you will have advance notice of this and a transition period. I agree that in a perfect world you'd provide your real email address and solve this problem. But developers and companies have repeatedly proven themselves to not be trustworthy and the majority will misuse any contact details for spam which users do not want. In fact there wouldn't be a business case (nor appeal to end-users) for Sign in with Apple if this wasn't a real problem.
- jjav 5y ago
  > Apple's SSO may not be eternal but it's also very unlikely to disappear overnight. If it is indeed going to be phased out you will have advance notice of this and a transition period. They may well offer notice and time when they cancel the service in some future. They won't offer any of that if they happen to erase your account just because though, as has happened to many people.
fmajid 5y ago
Don't forget in your threat model that Apple can cancel your account at any time for any reason whatsoever. They've even done it to security researchers using Apple's own bug bounty program. If that happens, you are stranded with those accounts effectively inaccessible to you forever. https://appleinsider.com/articles/21/04/20/man-sues-apple-for-terminating-apple-id-with-24k-worth-of-content https://appleinsider.com/articles/21/04/20/man-sues-apple-fo...
- Redoubts 5y ago
  How does this threat model compare to using gmail or hotmail for your account access?
- nyuszika7h 5y ago
  So? Google can also cancel your account at any time for any reason whatsoever, and good luck getting it back unless you're a celebrity with connections or manage to make a big enough fuss about it on social media. Using the same logic, you should not use Gmail then.
  - pjerem 5y ago
    Exactly, you should not use Gmail then. But that's off-topic.
    - LadyCailin 5y ago
      It isn’t though, because the developer had no problem offering that as a social login.
  - cesarb 5y ago
    > Google can also cancel your account at any time for any reason whatsoever [...] Using the same logic, you should not use Gmail then. Actually, under that logic it's only that you shouldn't use the @gmail.com domain; it should be fine to use Gmail with your own domain, since that allows you to recover if your Google account is canceled (just change the MX to another email provider). Another thing you can do is to never use your Google account for anything other than email; that should reduce the chances of the account being canceled for no obvious reason. For instance, it's been reported that, if you used your Google account for Youtube, and Google decided your real name was not your real name (which it wanted due to the Google Plus integration with Youtube), your whole Google account could be canceled; that risk could be avoided by just never logging into Youtube with your Google account.
jclardy 5y ago
Then your issue isn't with Apple's SSO, it is with all SSO providers. Facebook/Google login are not eternal. The only difference is the proxy, which can be disabled. Any website offering SSO options would have a sunset period to move it over if a provider went under...and if they don't, they are likely defunct at that point anyways...
elzbardico 5y ago
Apple may not be eternal, but probably will still be around for many decades after your app is completely forgotten. I still have the same IBM and Oracle accounts from the 90's. Big enterprises tend to stick around for a friggin long time.