3 ms·

My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's j

by atonse 4y ago

My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's just no way in hell I'm paying the $60 a year or whatever they're asking to listen to a couple songs every now and then. In a normal setting, she'd add her login to her 1password and I'd be able to use Calm.com, and who knows, I would've grown to love it, and gotten myself a second subscription. But since this experience has been so confoundingly annoying, Calm.com won't get a penny from me. (Not even sure I want to blame them... but rather how it's impossible for my wife to just "share" that credential with me even if she wanted to) Not being able to share a certain type of login (for this kind of family sharing scenario) has really soured me on the more personal use cases for these technologies, even though they are really solid from the tech side. Like people often say, most products are competing with Word, Excel, and email, authentication is competing with me just being able to tell a human my username and password. Again, there are many instances where being able to share these credentials seamlessly between non-power users is totally legit. When I sit with my dad to help her log in to his patient portal to get some medical info. Or when my mom wants help to review her Verizon cell phone bill. Or when I get my wife's credentials to cancel a hotel reservation. How are they going to solve the totally legitimate sharing use cases? Using PKI actually gives you a wonderful set of tools to do this (underlying implementation could be that we generate a temp cert that expires in 24 hours, signed by her original credential certificate saying it's a shared credential, etc) I really hope these are the use cases that get more fleshed out before these technologies reach mainstream.

biztos 4y ago
Is that not a use-case for Family Sharing? Apple says you can "download content" bought by other family members[0], but I guess this doesn't work for subscriptions? That's a real missed opportunity. I would expect them to at least allow the app developer to opt in to sharing. Selling two licenses into a household has to be pretty rare, whereas having happy-family customers is great word of mouth. "My wife uses FooApp and now I use it too!" [0]: https://support.apple.com/en-us/HT201085 https://support.apple.com/en-us/HT201085
- zippergz 4y ago
  The app developer has to specifically support Family Sharing if they want to allow people to share subscriptions.
- Someone1234 4y ago
  Most IAPs and non-Apple subscriptions don't work with Family Sharing, and the few that do there's no way to tell before you buy. Family Sharing is set up in such a way that you're punished for creating child Apple accounts as Apple recommends, because you'll need to repurchase MOST IAPs several times over. Apple's subscriptions are the exception rather than the rule, but they like to promote it in such a way as you'd think all Subscriptions/IAPs are shared when they're not.
ZetaZero 4y ago
> How are they going to solve the totally legitimate sharing use cases? According to their Terms, there are no legitimate sharing use cases. "You agree that you won’t disclose your Account password to anyone". That said, Calm has a family plan (6 users) for only $30/year more.
teeray 4y ago
This sounds like exactly the dark pattern Netflix will be clamoring for. “Oh gee, looks like you can’t share passwords anymore…”
neill 4y ago
For a business, implementing FIDO in this case seems like a win. They get more lockout of password sharing, and have to explicitly work to enable shared logins (if that's something they want). Of course it's nice for an end user to be able to share credentials, but I think long term outlook will be towards businesses and applications pushing to improve their user management tooling. Anecdotally, in the instance you described they net the same $60/yr regardless of wether you use your wife's login, so they're getting more stringent access controls (though you could always use the device in question, too) in line with their terms of service. (Would also note that my response does not cover your latter points on helping users manage their accounts with their presence, but without their device presence, which I agree is a valid concern)
- lsaferite 4y ago
  You also ignored the point that perhaps they'd have gotten to like the service enough to get a subscription for themselves, but refusing out of spite now.
deleted 4y ago
[deleted]
WorldMaker 4y ago
"Sign in with Apple" does have a very bare-bones OIDC flow in the browser on non-Apple devices/browsers. That flow takes you through a typical Apple Cloud login flow with Apple ID email and password and usual 2FA if it's the first time on that browser/device. To meet bare minimum requirements sites like Calm.com often only show the "Sign In with Apple" button for iOS and iPadOS user agents. You can sometimes fake an iOS/iPadOS user agent and get the buttons to show up and then switch the User Agent back to get the boring in-browser OIDC flow. As an iOS/iPadOS but Windows PC user I find it frustrating how many websites intentionally hide that button in other browsers, just when dealing with my own accounts. I feel like Apple could maybe do a better job of education here: "please don't hide the button on non-iOS/iPadOS user agents". I hope Apple has strong developer education plans for Passkey.
wfhordie 4y ago
Consider paying the developers and artists for their work. It’s hard out there and it’s about to get a lot worse for both.

by atonse 4y ago

biztos 4y ago

Is that not a use-case for Family Sharing? Apple says you can "download content" bought by other family members[0], but I guess this doesn't work for subscriptions? That's a real missed opportunity. I would expect them to at least allow the app developer to opt in to sharing. Selling two licenses into a household has to be pretty rare, whereas having happy-family customers is great word of mouth. "My wife uses FooApp and now I use it too!" [0]: https://support.apple.com/en-us/HT201085 https://support.apple.com/en-us/HT201085

zippergz 4y ago
The app developer has to specifically support Family Sharing if they want to allow people to share subscriptions.
Someone1234 4y ago
Most IAPs and non-Apple subscriptions don't work with Family Sharing, and the few that do there's no way to tell before you buy. Family Sharing is set up in such a way that you're punished for creating child Apple accounts as Apple recommends, because you'll need to repurchase MOST IAPs several times over. Apple's subscriptions are the exception rather than the rule, but they like to promote it in such a way as you'd think all Subscriptions/IAPs are shared when they're not.

ZetaZero 4y ago

> How are they going to solve the totally legitimate sharing use cases? According to their Terms, there are no legitimate sharing use cases. "You agree that you won’t disclose your Account password to anyone". That said, Calm has a family plan (6 users) for only $30/year more.

teeray 4y ago

This sounds like exactly the dark pattern Netflix will be clamoring for. “Oh gee, looks like you can’t share passwords anymore…”

neill 4y ago

For a business, implementing FIDO in this case seems like a win. They get more lockout of password sharing, and have to explicitly work to enable shared logins (if that's something they want). Of course it's nice for an end user to be able to share credentials, but I think long term outlook will be towards businesses and applications pushing to improve their user management tooling. Anecdotally, in the instance you described they net the same $60/yr regardless of wether you use your wife's login, so they're getting more stringent access controls (though you could always use the device in question, too) in line with their terms of service. (Would also note that my response does not cover your latter points on helping users manage their accounts with their presence, but without their device presence, which I agree is a valid concern)

lsaferite 4y ago
You also ignored the point that perhaps they'd have gotten to like the service enough to get a subscription for themselves, but refusing out of spite now.

deleted 4y ago

[deleted]

WorldMaker 4y ago

"Sign in with Apple" does have a very bare-bones OIDC flow in the browser on non-Apple devices/browsers. That flow takes you through a typical Apple Cloud login flow with Apple ID email and password and usual 2FA if it's the first time on that browser/device. To meet bare minimum requirements sites like Calm.com often only show the "Sign In with Apple" button for iOS and iPadOS user agents. You can sometimes fake an iOS/iPadOS user agent and get the buttons to show up and then switch the User Agent back to get the boring in-browser OIDC flow. As an iOS/iPadOS but Windows PC user I find it frustrating how many websites intentionally hide that button in other browsers, just when dealing with my own accounts. I feel like Apple could maybe do a better job of education here: "please don't hide the button on non-iOS/iPadOS user agents". I hope Apple has strong developer education plans for Passkey.

wfhordie 4y ago

Consider paying the developers and artists for their work. It’s hard out there and it’s about to get a lot worse for both.