3 ms·

Similar to how in-app purchase/subscription fees of 30% just _does not work_ for certain kinds of business with certain kinds of margin, Sign in with Apple has

Similar to how in-app purchase/subscription fees of 30% just _does not work_ for certain kinds of business with certain kinds of margin, Sign in with Apple has limitations far beyond other social sign-in systems that mean it is a complete non-starter for certain businesses. Like us. We have Facebook sign in (appropriate for our market), but couldn't integrate Sign in with Apple because the email private relay limits how you can send email to it so much, and we use the email address as a fraud signal for some payment providers. It comes down to the fact that we share email addresses and Apple have stopped that from working. They see it as stopping advertising and spam, but in our case they're preventing certain payment options, delivery notifications, refund notifications, all the sorts of emails that users tell us again and again are very important to them. We're not sharing emails without consent, we're doing it where users know what's being shared and why, and want these features. Edit: I wrote up a bunch of these issues at the time it was launched: https://danpalmer.me/2019-07-02-on-signing-in-with-apple/ https://danpalmer.me/2019-07-02-on-signing-in-with-apple/

user-the-name 5y ago
If your users actually value those emails, they will share their email with you. If they do not share your email, that means they do not actually value your emails as much as you seem to think.
WesolyKubeczek 5y ago
Can you present your users with explanation that "increased privacy provided by Apple" comes with a price in the form of degraded customer experience? Sorry, but you can't both have your cake and eat it, too? I might believe your intentions are noble, but for one of you there are hundreds if not thousands of bad apples, so to speak, and the controls Apple is giving me as the user help mitigate it somewhat. And there are initially good apples that turn bad after a while — as their authors are desperately seeking ways to get into black, or just sell their apps to some unscrupulous businesses.
drclau 5y ago
But you can still ask the user to provide the email address (and I think I've seen this already in some apps), even if the user signs in with Apple w/ hidden email, right? Since you say you are already asking for permission to share the email address, why would this be a problem? You now have to ask for the email and the permission to share it. A negative answer from the user would mean you are not allowed to share it anyway, so why have the email address in the first place then? Or am I missing something?
- collaborative 5y ago
  That wouldn't fly past App Review
Nextgrid 5y ago
> we use the email address as a fraud signal for some payment providers This is not in the interest of the user. As a user I do not want yet another company getting my details and assembling a profile on me under the excuse of fraud prevention, especially when my bank offers 3D-Secure which shifts all fraud liability back to the bank. > all the sorts of emails that users tell us again and again are very important to them According to every company every single one of their spams is important. It's not up to you to decide. If the users want your notifications they will find a way to receive them (as far as I know the Apple relay email address does just forward emails, so unless you're breaking a - presumably reasonable - rate limit it shouldn't be a problem).
- danpalmer 5y ago
  > As a user I do not want yet another company getting my details and assembling a profile on me under the excuse of fraud prevention This is only done after an explicit opt-in when using just that payment method. It's actually done as part of a credit check and those have to be very explicit.
  - kowbell 5y ago
    If the user already has to manually opt-in to it, could you throw in an extra “we need your real email” step for Apple ID users? Then users still get privacy-by-default and you still get the email needed for this feature.
  - djrogers 5y ago
    That’s when you explicitly ask the user for their real email address. This is not difficult unless you want to make it so for the purpose of raging at apple.
    - danpalmer 5y ago
      There are unfortunately a lot of problems with this – some that matter for the user and some that are more business concerns, but it's sadly not this easy. - Do users understand the fact that they have not given us their email address? Our email turns up in their inbox after all. Our customers are not necessarily tech-savvy of even that comfortable with email. - Do users know, months after signing up, that they didn't give us their email address. - Many users don't actually read information longer than ~5 words unless they're seeking out FAQs or something. They mostly pattern-match to things they know and/or expect. - Interrupting a checkout flow to explain all of this and capture a real email address will significantly reduce conversion. Is it overall better accounting for the hopeful improvement from Sign in with Apple? Very hard to say, even with testing, and we've tested things like this in the past. - Will Apple allow it? Open question, they don't explicitly say either way but there's plenty of evidence to suggest they don't want it being done. > This is not difficult unless you want to make it so for the purpose of raging at apple There's a difference between raging and critique. I'm critical of what I see as poorly designed systems and policies, particularly where it seems like there are industries/business models that are blind spots to Apple, intentional or otherwise. Saying that I'm raging at Apple is funny to me because I lead our project to introduce an iOS app at my current company, I've worked at an indie Mac software company, I have used macOS for many years. Hell, I even liked Objective-C. In many ways I'm just yet another Apple fanboy. Constructive criticism is important in moving platforms forward. Right now, Apple SSO doesn't work for us for well defined UX and business reasons. If those are solved then it will likely align well with how we want to treat our users and we'll likely introduce it.
mrweasel 5y ago
> we use the email address as a fraud signal for some payment providers. I'm sorry, I understand that that is not your point, but an email address is a terrible fraud signal. Also, if anything having the email go through an Apple relay, means that the user have an iCloud account, which seem no more risky that a random Gmail account.
- nyuszika7h 5y ago
  I agree. If you use an email address as a fraud signal, you need to seriously reevaluate your decisions. I've met a site that blocked my Gmail address as "spam" once, but another Gmail address works just fine. In my case it was just a nickname, but using an email as fraud signal also feeds into racism. People who don't have an average white American-looking name will suddenly be flagged for fraud.
- danpalmer 5y ago
  I'm over-simplifying "fraud signal" here, but it's a component of one of our payment provider's signal, mostly around "friendly fraud" where people might just have lots of overdue payments or not be responding to payment requests. It's less about signal about addresses and more about the same address being re-used on multiple stores. Edit: being super clear... The payment method is a pay-later service, it's literally a loan. The email is used to look up to see if the person has paid their loan balances off late before and other factors like that. "Fraud" was probably the wrong term to use here.

user-the-name 5y ago

If your users actually value those emails, they will share their email with you. If they do not share your email, that means they do not actually value your emails as much as you seem to think.

WesolyKubeczek 5y ago

Can you present your users with explanation that "increased privacy provided by Apple" comes with a price in the form of degraded customer experience? Sorry, but you can't both have your cake and eat it, too? I might believe your intentions are noble, but for one of you there are hundreds if not thousands of bad apples, so to speak, and the controls Apple is giving me as the user help mitigate it somewhat. And there are initially good apples that turn bad after a while — as their authors are desperately seeking ways to get into black, or just sell their apps to some unscrupulous businesses.

drclau 5y ago

But you can still ask the user to provide the email address (and I think I've seen this already in some apps), even if the user signs in with Apple w/ hidden email, right? Since you say you are already asking for permission to share the email address, why would this be a problem? You now have to ask for the email and the permission to share it. A negative answer from the user would mean you are not allowed to share it anyway, so why have the email address in the first place then? Or am I missing something?

collaborative 5y ago
That wouldn't fly past App Review

Nextgrid 5y ago

> we use the email address as a fraud signal for some payment providers This is not in the interest of the user. As a user I do not want yet another company getting my details and assembling a profile on me under the excuse of fraud prevention, especially when my bank offers 3D-Secure which shifts all fraud liability back to the bank. > all the sorts of emails that users tell us again and again are very important to them According to every company every single one of their spams is important. It's not up to you to decide. If the users want your notifications they will find a way to receive them (as far as I know the Apple relay email address does just forward emails, so unless you're breaking a - presumably reasonable - rate limit it shouldn't be a problem).

danpalmer 5y ago
> As a user I do not want yet another company getting my details and assembling a profile on me under the excuse of fraud prevention This is only done after an explicit opt-in when using just that payment method. It's actually done as part of a credit check and those have to be very explicit.
- kowbell 5y ago
  If the user already has to manually opt-in to it, could you throw in an extra “we need your real email” step for Apple ID users? Then users still get privacy-by-default and you still get the email needed for this feature.
- djrogers 5y ago
  That’s when you explicitly ask the user for their real email address. This is not difficult unless you want to make it so for the purpose of raging at apple.
  - danpalmer 5y ago
    There are unfortunately a lot of problems with this – some that matter for the user and some that are more business concerns, but it's sadly not this easy. - Do users understand the fact that they have not given us their email address? Our email turns up in their inbox after all. Our customers are not necessarily tech-savvy of even that comfortable with email. - Do users know, months after signing up, that they didn't give us their email address. - Many users don't actually read information longer than ~5 words unless they're seeking out FAQs or something. They mostly pattern-match to things they know and/or expect. - Interrupting a checkout flow to explain all of this and capture a real email address will significantly reduce conversion. Is it overall better accounting for the hopeful improvement from Sign in with Apple? Very hard to say, even with testing, and we've tested things like this in the past. - Will Apple allow it? Open question, they don't explicitly say either way but there's plenty of evidence to suggest they don't want it being done. > This is not difficult unless you want to make it so for the purpose of raging at apple There's a difference between raging and critique. I'm critical of what I see as poorly designed systems and policies, particularly where it seems like there are industries/business models that are blind spots to Apple, intentional or otherwise. Saying that I'm raging at Apple is funny to me because I lead our project to introduce an iOS app at my current company, I've worked at an indie Mac software company, I have used macOS for many years. Hell, I even liked Objective-C. In many ways I'm just yet another Apple fanboy. Constructive criticism is important in moving platforms forward. Right now, Apple SSO doesn't work for us for well defined UX and business reasons. If those are solved then it will likely align well with how we want to treat our users and we'll likely introduce it.

mrweasel 5y ago

> we use the email address as a fraud signal for some payment providers. I'm sorry, I understand that that is not your point, but an email address is a terrible fraud signal. Also, if anything having the email go through an Apple relay, means that the user have an iCloud account, which seem no more risky that a random Gmail account.

nyuszika7h 5y ago
I agree. If you use an email address as a fraud signal, you need to seriously reevaluate your decisions. I've met a site that blocked my Gmail address as "spam" once, but another Gmail address works just fine. In my case it was just a nickname, but using an email as fraud signal also feeds into racism. People who don't have an average white American-looking name will suddenly be flagged for fraud.
danpalmer 5y ago
I'm over-simplifying "fraud signal" here, but it's a component of one of our payment provider's signal, mostly around "friendly fraud" where people might just have lots of overdue payments or not be responding to payment requests. It's less about signal about addresses and more about the same address being re-used on multiple stores. Edit: being super clear... The payment method is a pay-later service, it's literally a loan. The email is used to look up to see if the person has paid their loan balances off late before and other factors like that. "Fraud" was probably the wrong term to use here.