6 ms·

You’ve got to be kidding. Don’t use apple SSO because apple might not exist one day? You may as well argue not signup to anything using gmail because, heck, g

You’ve got to be kidding. Don’t use apple SSO because apple might not exist one day? You may as well argue not signup to anything using gmail because, heck, google might go out of business. There is no benefit to users in giving your “real” details to service providers; the benefit is entirely on their side. You can argue that Apple is harming the opportunities for 3rd party developers, sure, taking advantage of them? Sure. …but let’s not try to frame this as somehow “pro consumer” to give your email away so people can spam you with notifications and offers to lift their engagement rates. That is pure BS.

simion314 5y ago
>Don’t use apple SSO because apple might not exist one day? >You may as well argue not signup to anything using gmail because, heck, google might go out of business. I assume OP point is that Apple or Google could still exists but your accounts might not exist, maybe you get banned or just decide you don't want to use Apple/Google/FB anymore.
ascar 5y ago
I don't think your tone is warranted and in the spirit of this community. I don't agree with GP's fear of Apple SSO vanishing without a transition period to something else, but the general premise that this form of login is not eternal but rather short lived in the grand scheme of things is reasonable and doesn't warrant your aggressiveness. Also you might get locked out of your Apple account for a number of reasons and will then lose access to much more than just Apple services.
- imwillofficial 5y ago
  And this is a risk for the user to take on, night a choice that should be left to a petty developer.
- user-the-name 5y ago
  It is also not really a valid argument here, given that the service we are talking about was offering Facebook and Google login options, which share the exact same issue, but with the added privacy violations of those platforms.
  - j2bax 5y ago
    Facebook and Google login were options in addition to standard email sign up.
    - user-the-name 5y ago
      And Sign in with Apple is another option in addition to those.
  - cesarb 5y ago
    From what I understood from these discussions, that is not an issue with Facebook and Google logins because they reveal the true user email address, so even if they no longer exist one day, that email address could be used to recover the user accounts (using a password recovery flow through email); while Apple SSO does not reveal the true user email address, only a proxy through Apple's systems, so if it no longer exists one day, there's no way to use the email address to recover the user accounts.
    - user-the-name 5y ago
      Apple asks the user whether they want to reveal their email or not. If you do not receive a real email address for Sign in with Apple, it is because the user did not want to give it to you. I fail to see any problem with this.
oriolid 5y ago
> Don’t use apple SSO because apple might not exist one day? There might be a day when Apple is not _my_ cell phone platform. Even now I have an Android phone and iPad and I prefer to have access to same services from both.
- gowld 5y ago
  No Apple cell phone required. https://firebase.google.com/docs/auth/android/apple https://firebase.google.com/docs/auth/android/apple
  - oriolid 5y ago
    Looks more complicated than just not using Apple ID.
- elzbardico 5y ago
  You can still have an apple ID even if you never ever had even a single app device.
  - oriolid 5y ago
    Technically true, the best kind of true.
pjerem 5y ago
> You may as well argue not signup to anything using gmail because, heck, google might go out of business. I personally avoid to do it, but that's not the point. Every other third party allows account recovery by mail : if you want to stop using FB or Google's SSO, you can ask the website to send you a mail to prove the account ownership. If Apple's SSO stopped working (because Apple stopped it, banned you, because you dont have Apple devices anymore so you are locked out of their proprietary 2FA), none of those websites could send you a recovery email. > That is pure BS. I don't feel like I've been insulting, so please don't be either.
- nyuszika7h 5y ago
  > because you dont have Apple devices anymore so you are locked out of their proprietary 2FA They have SMS as a fallback. I know it's insecure and I'd rather they support TOTP, but let's not pretend having an Apple device is the only way to receive 2FA codes for your Apple ID.
  - pjerem 5y ago
    > let's not pretend I pretend nothing, I just didn't knew it since I had an iPhone for years.
  - imwillofficial 5y ago
    > let’s not pretend This line is unwarranted and in violation of HN rules. Be cool. I learned something today. I didn’t know you could get SMS codes for Apple 2FA.
webmobdev 5y ago
> Don’t use apple SSO because apple might not exist one day? Yes. And more to the point, because that Apple service may not exist in the future. Or Apple may determine that a particular app or service can no longer use its service for whatever reason, and you as a user will not have any choice in that manner. It's all been done before.
- pjerem 5y ago
  And it makes me think : what happens to the "proxy emails" affected to your application when Apple decides to ban your app from the App Store ? Are your users still reachable ? Is there any information on this ? Given an alternative storyline where Epic Games allowed users to create account with relayed apple mails, wouldn't all those accounts suddenly became unusable today ?
  - jackson1442 5y ago
    Epic actually did allow users to use SWA since they have about 5 other IdPs they allow. Apple didn't suspend their access to SWA at any point, though there were stories about it at the time.
fmajid 5y ago
Apple is not going anywhere, but they can terminate your account on a whim: https://appleinsider.com/articles/21/04/20/man-sues-apple-for-terminating-apple-id-with-24k-worth-of-content https://appleinsider.com/articles/21/04/20/man-sues-apple-fo... So has Google, and presumably the other platforms as well.
- nyuszika7h 5y ago
  Exactly, the same thing can happen with Google, so are you suggesting that users should not use direct email signup with Gmail either?
  - fmajid 5y ago
    Yes, or at least not with a @gmail.com domain. Running Google Apps with a custom domain you own and Google can't snatch away is fine (well, apart from the privacy implications of giving Google free rein to read your emails, of course). That means not using Google as your registrar, obviously.

simion314 5y ago

>Don’t use apple SSO because apple might not exist one day? >You may as well argue not signup to anything using gmail because, heck, google might go out of business. I assume OP point is that Apple or Google could still exists but your accounts might not exist, maybe you get banned or just decide you don't want to use Apple/Google/FB anymore.

ascar 5y ago

I don't think your tone is warranted and in the spirit of this community. I don't agree with GP's fear of Apple SSO vanishing without a transition period to something else, but the general premise that this form of login is not eternal but rather short lived in the grand scheme of things is reasonable and doesn't warrant your aggressiveness. Also you might get locked out of your Apple account for a number of reasons and will then lose access to much more than just Apple services.

imwillofficial 5y ago
And this is a risk for the user to take on, night a choice that should be left to a petty developer.
user-the-name 5y ago
It is also not really a valid argument here, given that the service we are talking about was offering Facebook and Google login options, which share the exact same issue, but with the added privacy violations of those platforms.
- j2bax 5y ago
  Facebook and Google login were options in addition to standard email sign up.
  - user-the-name 5y ago
    And Sign in with Apple is another option in addition to those.
- cesarb 5y ago
  From what I understood from these discussions, that is not an issue with Facebook and Google logins because they reveal the true user email address, so even if they no longer exist one day, that email address could be used to recover the user accounts (using a password recovery flow through email); while Apple SSO does not reveal the true user email address, only a proxy through Apple's systems, so if it no longer exists one day, there's no way to use the email address to recover the user accounts.
  - user-the-name 5y ago
    Apple asks the user whether they want to reveal their email or not. If you do not receive a real email address for Sign in with Apple, it is because the user did not want to give it to you. I fail to see any problem with this.

oriolid 5y ago

> Don’t use apple SSO because apple might not exist one day? There might be a day when Apple is not _my_ cell phone platform. Even now I have an Android phone and iPad and I prefer to have access to same services from both.

gowld 5y ago
No Apple cell phone required. https://firebase.google.com/docs/auth/android/apple https://firebase.google.com/docs/auth/android/apple
- oriolid 5y ago
  Looks more complicated than just not using Apple ID.
elzbardico 5y ago
You can still have an apple ID even if you never ever had even a single app device.
- oriolid 5y ago
  Technically true, the best kind of true.

pjerem 5y ago

> You may as well argue not signup to anything using gmail because, heck, google might go out of business. I personally avoid to do it, but that's not the point. Every other third party allows account recovery by mail : if you want to stop using FB or Google's SSO, you can ask the website to send you a mail to prove the account ownership. If Apple's SSO stopped working (because Apple stopped it, banned you, because you dont have Apple devices anymore so you are locked out of their proprietary 2FA), none of those websites could send you a recovery email. > That is pure BS. I don't feel like I've been insulting, so please don't be either.

nyuszika7h 5y ago
> because you dont have Apple devices anymore so you are locked out of their proprietary 2FA They have SMS as a fallback. I know it's insecure and I'd rather they support TOTP, but let's not pretend having an Apple device is the only way to receive 2FA codes for your Apple ID.
- pjerem 5y ago
  > let's not pretend I pretend nothing, I just didn't knew it since I had an iPhone for years.
- imwillofficial 5y ago
  > let’s not pretend This line is unwarranted and in violation of HN rules. Be cool. I learned something today. I didn’t know you could get SMS codes for Apple 2FA.

webmobdev 5y ago

> Don’t use apple SSO because apple might not exist one day? Yes. And more to the point, because that Apple service may not exist in the future. Or Apple may determine that a particular app or service can no longer use its service for whatever reason, and you as a user will not have any choice in that manner. It's all been done before.

pjerem 5y ago
And it makes me think : what happens to the "proxy emails" affected to your application when Apple decides to ban your app from the App Store ? Are your users still reachable ? Is there any information on this ? Given an alternative storyline where Epic Games allowed users to create account with relayed apple mails, wouldn't all those accounts suddenly became unusable today ?
- jackson1442 5y ago
  Epic actually did allow users to use SWA since they have about 5 other IdPs they allow. Apple didn't suspend their access to SWA at any point, though there were stories about it at the time.

fmajid 5y ago

Apple is not going anywhere, but they can terminate your account on a whim: https://appleinsider.com/articles/21/04/20/man-sues-apple-for-terminating-apple-id-with-24k-worth-of-content https://appleinsider.com/articles/21/04/20/man-sues-apple-fo... So has Google, and presumably the other platforms as well.

nyuszika7h 5y ago
Exactly, the same thing can happen with Google, so are you suggesting that users should not use direct email signup with Gmail either?
- fmajid 5y ago
  Yes, or at least not with a @gmail.com domain. Running Google Apps with a custom domain you own and Google can't snatch away is fine (well, apart from the privacy implications of giving Google free rein to read your emails, of course). That means not using Google as your registrar, obviously.