Apple Sign In

https://techcrunch.com/2019/06/03/apple-sign-in-privacy/

by ikarandeep • 7 years ago

1145 514 7 years ago

techcrunch.com

minimaxir2• 7 years ago

Per a screenshot in the Keynote, Sign in with Apple will also work on the Web, which will be interesting.

oh_hello• 7 years ago

They already offer Apple Pay on the web. I imagine the experience will be similar here.

minimaxir2• 7 years ago

True, although that would imply Sign in with Apple would be Safari-only, which might be a hard sell.

mjlee• 7 years ago

Disposable, anonymous email forwarding is a massive step forward for privacy. I know we've all been doing it for a while, but this on a consumer level is fantastic.

pmart123• 7 years ago

I wonder how many poorly designed database schemas this will break that used email as a primary key/id.

saagarjha6• 7 years ago

I think the email is consistent for each app, so there should only be a problem if the user wants to change their email, right? Plus, apps would have to opt-in to support this.

not_kurt_godel• 7 years ago

Why would this break any databases? Accounts will still have valid emails. The difference is just that there won't be data for that email in third-party tracking databases, which is a good thing.

dmix• 7 years ago

I don't think you'll find much sympathy for someone who's software would break on such a change. That sounds broken already.

albertgoeswoof7• 7 years ago

If you don’t use apple, I just built this as a stand-alone product: https://idbloc.co

nextos2• 7 years ago

There is also spamgourmet, which is free and has been around for 20 years.

bglusman• 7 years ago

This looks a lot like 33mail (https://33mail.com/) which I've been using pretty happily for 4-5 years now (and paying I think $10-15 a year for, so a lot less than this on a per month basis, but they're not strictly unlimited)

golem142• 7 years ago

From the web page, I cannot tell what pricing is going to be - looks like you go out of your way to not scare off potential users. I can't find pricing information at all via Google searches, either.

That's something I really dislike. Perhaps it's a necessary evil.

jiveturkey4• 7 years ago

the super annoying "can i help you?" popup after 10s is revolting. i closed the tab immediately without learning more. it's cheesy, pushy, and seems antithetical to a service that offers privacy. i recommend you turn that thing off.

sxates• 7 years ago

Great! I used a service like this many years ago and they shut down after a few years. Have been looking for the same thing for years but seems like nobody's been doing it, or at least not in a user friendly way. Will give this a try.

bestnameever• 7 years ago

I like it! how long have you been around? Do you think Apple's product might bring more awareness to yours?

snarf21• 7 years ago

I agree that it is great. I'm not sure how we convince people to not signup on sites that don't offer this SSO option. I've always struggled with the question of 'How do we convince people to care about privacy when they post their location and meal to a public social media every hour?'.

hprotagonist2• 7 years ago

My rule, and it is a semi-idiotic one, is "i don't impulse buy from independent merchant websites that don't support apple pay at checkout".

I usually email them after, too. "I actually clicked through your instagram ad, looked at some clothes that looked nice, and didn't buy anything because I was on my phone and didn't want to make a new account and add credentials to my password manager. Have you considered adding apple pay support to your shopify account?"

I have no idea if i'm helping or not.

Nextgrid• 7 years ago

Convenience. This feature is good even if you don’t care about privacy.

Password management is a big problem for non-technical users. Even for people who don’t know/care about security and reuse the same password everywhere, it presents a huge issue when their preferred password doesn’t meet the website’s requirements. They are then forced to make one up which they’ll never remember so it’s gonna be a headache down the line when they need to sign in again.

When they learn that the magic “Sign in with Apple” button allows them to avoid all that, they’ll want it even if they don’t care about privacy.

anbop2• 7 years ago

And being done by Apple, most services can’t just reject these the way they do with Mailinator addresses, since it would be throwing away a giant chunk of their revenue. Apps with huge consumer demand like Uber or Facebook could get away with it, but not the vast majority of apps.

jiveturkey4• 7 years ago

I think this will be proven wrong. Do you think that the folks using Mailinator are strictly non-Apple users? As an Apple user that signs up with a mailinator ID, if rejected I either move on or use a more palatable address, as the case may be depending on my desire to use that service. The same will hold true for any private appleid address.

_bxg12• 7 years ago

Right. One of the big things about Apple getting into something, even if it's been done before, is that they carry enough influence to strongarm other companies into respecting their paying customers. It's great.

pluffycat4• 7 years ago

I’m tired of gmail and hotmail forcing me to sign up using my personal cell phone number. Finally I can create throwaway emails without resorting to gmail!

taytus3• 7 years ago

My first thought was: Bye bye mailinator.com

throaway55335• 7 years ago

I use mailinator to have some privacy from my email provider.

jacquesm2• 7 years ago

As if everybody uses Apple.

CharlesColeman2• 7 years ago

My first thought was: Bye bye mailinator.com

Mailinator can be pretty hard to use, since so many sites can detect the addresses and block their use.

I've pretty much given up on it, and use Fastmail's very easy aliasing features with my domain. It's not quite as private, but it's a lot more reliable.

nothrabannosir2• 7 years ago

In case anyone needs something similar today: Outlook already allows you to create ephemeral top-level aliases, i.e. XXXX@outlook.com. You can use this to sign up, then delete the alias. It can't be traced back to your account and nobody blocks @outlook.com.

https://account.live.com/names/Manage

(not to take away from this announcement at all; just to provide some context. it's an often overlooked feature which people here might appreciate.)

throaway55335• 7 years ago

I switched to Outlook because of this.

I also like how you can set it so only a specific email can login. That way if your alias is compromised, your account won’t be.

ocdtrekkie• 7 years ago

Microsoft's email management has some neat perks here: You can change which one's the primary as well. It's entirely possible for you to change the email address of your Microsoft account, by adding an alias, making it primary, and then deleting the original. In fairness, there are some quirks with this, my old email address would still get sent some receipts or some newsletters because the configuration for service A, B, or C was buried somewhere else in the account. But generally speaking, it works pretty well.

As someone who changed their name but had to keep their Google account with the old one because of how much Google account data/purchases can't be moved to a new account, this felt positively revolutionary. Google accounts can only have one Gmail address for their entire lifetime.

iwasakabukiman• 7 years ago

Apple also lets you do this with your Me/iCloud address as well.

basch16• 7 years ago

I dont think thats quite the same thing as an Identity Service, its just a component. In Microsoft's world im either using my Microsoft Account to sign in OR using throwaway email addresses, not both.

Apple can get way ahead of the competition by combining about 3 things.

1) Ephemeral email addresses

2) OAuth or apples equivalent tokens

3) Keychain autogenerate and auto-populate

If all those products are integrated correctly, this becomes the SINGLE sign on of single sign ons. If a service supports Apple OAuth, your name is hidden, and you only have one Apple password to remember. If the service doesnt support Apple Tokens, then apple fills in a private email address and a random password, and abstracts away the fact that the service doesnt support Apple Tokens. The user experience is nearly the same regardless. Tokens and randomly generated passwords should be managed from the same interface, allowing you to either revoke access (token) or cycle the key (both.)

I've felt it for a while, but the banking industry needs to arrive at something similar. Chase, BoA, WF, and Citi should turn Zelle into a banking OAuth Identity Service.

maxheadroom3• 7 years ago

It can't be traced back to your account...

I'm sure there's logging or other AD property (think something like sidHistory[0]) to keep track of this.

Companies don't like being liable for not being able to provide data under order[s].

[0] https://docs.microsoft.com/en-us/windows/desktop/ADSchema/a-...

vilhelmen• 7 years ago

I'm so mad I missed the window where you were supposedly able to merge email accounts. If I want to merge existing separate accounts now I have to terminate the old account, wait like a 9 months/a year(??) for it to expire and be purged, and then add it as an alias, assuming MS doesn't hold the expired account name >:C

Pym2• 7 years ago

I've been trying for some time to explain to my friends and family how a unique email/password + 2FA strategy is the best thing to do and how it would allow them to cut one in case it gets leaked. I guess I will just tell everybody about "Sign in with Apple" now, it will be easier.

damnyou6• 7 years ago

Will you also tell that to your Android or Windows using friends?

notlukesky• 7 years ago

Take a look at SAASPASS Authenticator & Password Manager. It might meet your criteria of usability and security.

buildbuildbuild2• 7 years ago

They also have pretty strict whitelisting requirements around who can send emails to these privacy addresses.

"In order to send email messages through the relay service to the users’ personal inboxes, you will need to register your outbound email domains. All registered domains must create Sender Policy Framework (SPF) DNS TXT records in order to transit Apple's private mail relay. You can register up to 10 domains and communication emails."

https://help.apple.com/developer-account/#/devf822fb8fc

moduspol2• 7 years ago

Neat. It sounds like this extra step prevents a situation where, for example, a dev's server-side database gets hacked and the users' relay e-mail addresses are exposed.

The attacker wouldn't even be able to send e-mail messages to the users. He'd also need to compromise the registered domain's mailservers, or their DNS servers (to modify the SPF records), or their Apple dev account to add their own registered domain.

aasasd2• 7 years ago

I was wondering why all the popular ‘private’ email services don't seem to have such a feature.

ljm• 7 years ago

Apple is evolving and adapting in a way the rest of the industry can’t follow.

And, they have the money to do it.

For as long as Android has google ownership... they will never, ever be able to compete on the level of privacy that Apple is now buying into.

codezero2• 7 years ago

Totally agree. I set this up for myself to have a anything@mytrowawaydomain.com and it's great to see when folks sell your email :)

So far it's only happened once, actually, when Keen.io got bought by a PE firm, I got a bunch of spam, so they clearly sold off my email address.

It's a system that would be hard to operate as a "normal" person, so this is a great step.

josephwegner• 7 years ago

As a former (pre-sale) Keen employee, this makes me sad. I'm very sorry.

kukabynd• 7 years ago

Agreed, I think it’s the most important part of the demo today.

gnicholas2• 7 years ago

Does this require that every device you'd wish to use to sign into the service be an Apple device?

That is, if you're signing up for Netflix with this, would you be able to access your account from a Roku box?

gkoberger• 7 years ago

I imagine you'd have to get the private email from your iPhone, similar to how 1Password works.

gnicholas2• 7 years ago

And it appears from the image that the private email would be a bear to type into another device.

pletnes• 7 years ago

This is a natural step that I’ve been waiting for for years. This can almost remove the need for password typing, as you don’t even need one to unlock the device anymore. Let’s hope Microsoft does the same, and integrates with apple’s solution. A lot of people are on iOS+Win10 for laptops.

empath75• 7 years ago

Finally an excuse to delete my Facebook account completely. SSO was the only reason I was still using it.

I do wonder how many sites will actually implement it.

driverdan• 7 years ago

Why do you need SSO? Password managers make it easy to manage accounts.

ben509• 7 years ago

PMs don't make it easy, they make it reliable and central. The default password generation usually doesn't work, and a web form doesn't capture everything, but I'm never clicking and guessing even when I haven't used an account in years.

But SSO wins on mobile, because the PM is clunky even with a custom keyboard. Even then, I keep a dummy entry in my PM just so I'm tracking it.

onlyrealcuzzo• 7 years ago

Couldn't you just use Gmail for that?

krsdcbl• 7 years ago

Isn't your reason not to use Facebook an even greater reason to not use their sso?

Jare• 7 years ago

Didn't Facebook originally implemented something similar to this email obfuscator in their SSO, and later removed it?

grenoire• 7 years ago

"This domain is not allowed."

r00fus• 7 years ago

Is this a current issue you're having or your expected industry response?

keymone• 7 years ago

yeah, and say goodbye to your app on app store and hundreds millions users.

chrisshroba• 7 years ago

While websites do blacklist temporary email providers like Mailinator, I think Apple has more power here; blocking the domain can be pegged as more of an anti-privacy move than blocking Mailinator, which is more anti-spam.

bxio• 7 years ago

Google's + and . trick on a dummy-proof, invisible, consumer level. Nice!

jeroenhd• 7 years ago

Will this service be available on the web? I get the feeling that this will only be available on iOS, meaning that you lose access to all your accounts if you decide to switch to Android.

malloreon• 7 years ago

ios, macos, web, all announced.

nwsm3• 7 years ago

What's the incentive for apps to offer it? Now they don't get user data.

dthedev• 7 years ago

Convenience and access to Apple's user base who partake in the service. Those are the main reasons I used Google and Facebook sign-in on my website.

the_watcher2• 7 years ago

There are plenty of applications that don't actually care about the additional data they could arguably get from a Google/Facebook login, and only offer it because one click sign-up/login drives more signups.

nwsm3• 7 years ago

In cases of a trustworthy third party, what is the concern of linking to Google/Facebook account compared to an Apple account that doesn't offer any data? I don't think I've seen any instances of Facebook integration credentials being hacked/stolen.

nihonde8• 7 years ago

They still get user data. They just can’t tie it to a real person outside the scope of their app.

nwsm3• 7 years ago

That is what I meant by user data.

busymom04• 7 years ago

I develop apps myself and I am 100% onboard with using this instead of offering the signup with google or facebook buttons. I might even push users slightly to use this instead of others as it give my apps a bit of extra trust worthiness imo.

hk__2• 7 years ago

I can already see devs implementing things such as `if email domain ends in privaterelay.appleid.com reject the email address and ask for a "real" one`, like what already exists for yopmail and others.

chinhodado• 7 years ago

The difference is Apple is too big of a player to ignore.

Tomte• 7 years ago

But now they block "normal users", not nerds. And there are many of normal users.

I'm not sure if they could sustain such a policy.

moduspol2• 7 years ago

Such a dev would likely just not implement "Sign in with Apple".

This is for the devs that specifically want the minimal-friction sign-in.

dcbadacd4• 7 years ago

Some screenshots display that it also works on the web, I'd love to find out how exactly but I ain't buying an Apple device and a developer license for that.

cal5k• 7 years ago

The difference here is that Apple can reject apps that do this from the App Store.

pishpash• 7 years ago

Some sites now seem to check whether an address is valid from some database or heuristic, because a random email with a valid domain is still rejected.

kyboren• 7 years ago

There is definitely a phenomenon of checking for prohibited email domains. However, absent extra-functional motivations like user data collection, smart developers don't bother with heuristics for email addresses much beyond the presence of an '@' character.

If you want to know if a purported email address is deliverable, try to deliver email to it.

ycombonator• 7 years ago

This is awesome news for developers ! They should have done this years ago.

dyarosla3• 7 years ago

Can’t services just disallow/block this address?

Fun thing is, Apple themselves block name+addon@gmail.com addresses when using their dev console. You can bet that some companies will disallow Apple’s signature private passwords similarly if they can, in the name of ‘security’ or what have you.

Or am I being too cynical? Feel free to CMV.

EDIT: best response addressing this seems to be ‘The addresses are only generated from the "Sign In With Apple" workflow that a developer has to enable in the first place’

wvenable• 7 years ago

No, you're clearly correct. But Apple pushing this does give it a sense of legitimacy and blocking signups from this service might just cause less signups than actually forcing people to use their real address.

If Apple makes this extremely user friendly and quick to use than blocking it will cause a loss of signups.

dyarosla3• 7 years ago

Devils advocate:

‘Error: We love Apple and anonymity but we require a real email address to prevent fraud and to properly secure your account. Please enter your real email address.’

gowld2• 7 years ago

Yes. Back when Google+ oauth launched, "sharing user identity info" was the carrot that incentivized developers to build the integration. Otherwise, devs preferred Facebook so they could get user info.

untog3• 7 years ago

Presumably such services won't implement Sign In With Apple in the first place. People will accept it because they want the sheer quantity of users Apple provides.

The useful thing about Apple is that they can force people to do things they don't particularly want to do, like accept anonymous e-mail addresses or stop using Flash. (unfortunately this is also the bad thing about Apple)

bichiliad• 7 years ago

One other thing that seems powerful is that users that use Sign In With Apple have some guarantee of quality; with Apple using FaceId to authenticate, there's some amount of guarantee that you're not a bot.

dfabulich2• 7 years ago

"[Sign In with Apple] will be required as an option for users in apps that support third-party sign-in when it is commercially available later this year." https://developer.apple.com/news/?id=06032019j

sturgill8• 7 years ago

Or they already rely on FB login and are now _obligated_ by Apple to implement this feature. I work for a company that has allowed people to create accounts with FB login (meaning we don’t have an internal password associated with them). This change would ostensibly require us to also allow Apple Sign In _even if we don’t want to_ just to continue to service existing users.

There really isn’t much choice here for us. Leave Apple / iOS? Abandon FB login and piss off thousands of people? Implement Apple Sign In regardless of its tech stack / requirements?

ckuhl• 7 years ago

Companies could absolutely disallow / block it.

However they most likely won't for the same reason that people who are upset about Apple's 30% App Store cut still develop apps for iOS: they have their customers spend far more on average than other phone / OS users.

tinus_hn5• 7 years ago

So a company would put a sign in with Apple button in their app, but disallow you from using it?

jdminhbg6• 7 years ago

The addresses are only generated from the "Sign In With Apple" workflow that a developer has to enable in the first place, so it wouldn't make any sense to do that and then reject the addresses.

donkeyd• 7 years ago

Sure, they really could. But for me, it could be a reason to pick Lyft over Uber for example. I hope they add support to the App Store description, that would really help filter apps.

la_barba2• 7 years ago

But in return for that, the services that choose to employ this will get a soft guarantee that the person signing up is unique/real. Its a way to get real-name/real-id with some amount of privacy.

saltminer• 7 years ago

Apple IDs cannot guarantee a real or unique user - users can have multiple accounts (some users will create a second account by mistake, others have a separate work account, etc), users can share accounts (especially ones tied to generic email addresses), and there are people selling app store reviews, so some bad actors definitely have a lot of accounts.

colechristensen• 7 years ago

Facebook is trending downwards and privacy concerns with Google are trending up.

Critical mass might be achieved where if you don't include Apple Sign-In you might lose more users than whatever benefit you see from having more identifiable personal information.

forrestthewoods• 7 years ago

It will be a battle of public relation.

If Apple users use Apple Sign-In en masse then any services which blocks it will face harsh negative publicity. If enough people use it then services will have no choice but to acquiesce.

mrtksn• 7 years ago

They surely can do whatever they want, they can definitely choose to deny service to users that are traditionally high spenders and limit the fake accounts to professional scammers that use account farms from Asia.

mystcb• 7 years ago

Is that block a recent thing? It might be different as for my on GSuite account I can add the name+addon@mydomain.com - it might just be a difference between the "public" Gmail system vs the Gsuite Gmail system. In which case, my question is completely invalid and feel free to ignore ;)

Note: This comes from my own developer account having 3 name+addon@ accounts live, and working with things like ApplePay etc for testing.

nexuist• 7 years ago

Developer with a name+addon@gmail.com Apple ID here. No idea what OP is talking about, I was able to generate my Apple ID and sign up for the dev console no problem.

astrange2• 7 years ago

My Apple ID is email+something@gmail.com and it works.

SN76477• 7 years ago

they can block it but when you have 90million people using it, why would you?

ramon• 7 years ago

I loved the concepts! Cannot wait to see the site with the SDKs and all.

AJRF• 7 years ago

Someone who is not apple should do this and charge for it. I'd pay $10 for something like that

gowld2• 7 years ago

You would pay, but no one would build a company for the $1M total revenue this would bring in

danShumway3• 7 years ago

Don't Fastmail aliases already work the same way?

That's $5 a month for 600 private email addresses, which (for me at least) is more than enough to cover all of the services I use.

Unless they're easier to re-associate with your main account for some technical reason I'm not aware of?

r2ut3u• 7 years ago

check out maskmail.net it's basically the same thing

olliej• 7 years ago

How long until sites start blocking the cloaked addresses? (although of course Apple can just churn those address patterns)

JustSomeNobody2• 7 years ago

How long until those sites cease to exist?

zenbane• 7 years ago

I'd like to have something similar for actual physical mailing addresses, perhaps UPS or Fedex could offer this.

lumens• 7 years ago

Shyp tried to do this ~4 years ago. Very challenging problem.

ChicagoBoy11• 7 years ago

My local UPS office in NY can accept packages on my behalf for a very small sum of money. Do you mean something more extensive than that?

ceejayoz• 7 years ago

PO boxes?

lghh• 7 years ago

What is forcing the sites that I'd want to use a fake email address with to use this? It wouldn't be in their interest to. They will just stick with their current SSO setup of Google/Facebook/whatever and never touch this, if they have SSO at all. I LOVE LOVE LOVE the idea, I just don't know if it will be useful and successful.

jdminhbg6• 7 years ago

Nothing is forcing them to, and lots probably won't. The carrot is the much lower friction for sign up for users. It's similar to Apple Pay, where you don't get credit card info, but you do get a much easier user flow that will get you more signups.

DuskStar3• 7 years ago

But will it be lower friction than login with Google or Facebook? It feels like it's more common for someone to have an account from one of those two than from Apple, and so "sign on with Apple" will never be able to be the only SSO option, while Google or Facebook could be.

If the better (for the site) SSO options also have near-universal market penetration, what's the incentive to add Apple?

jdminhbg6• 7 years ago

Update to the above, since it's too late to edit: It looks like Apple is in fact forcing you to support this sign in method, if you also support Google/FB/etc.: https://9to5mac.com/2019/06/03/sign-in-with-apple-requiremen...

simonhamp• 7 years ago

This is the ultimate way to manage your incoming email - I’ll be filtering everything based on the `to:` address when this rolls out and my life will be wonderful again

buboard4• 7 years ago

So this is only for mac/iphone users? That's not a large enough segment to warrant adding a sign in option for most sites. Would be nice if Mozilla had done something similar with Persona.

ilikehurdles• 7 years ago

Something like 58% of site visits are from mobile browsers, and mobile Safari makes up over half of all mobile browsers. Of course, your mileage may vary, but that's a pretty large segment.

buboard4• 7 years ago

So its like 25% of Americans and much less everyone else. Plus you will be at the mercy of apple if they decide to remove your app, plus if you need an actual usable email, you have to ask for a second email. Sounds a bit confusing, they shouldnt have tied this to email address.

jbeckham• 7 years ago

Maybe I'm cynical, but this looks more like a data hording scheme than a protect my privacy enhancement. If I use Google to sign in, Google and the app has that data and can monetize it.

Now if I sign in using Apple, they are going to have the data to monetize. They may keep the app from getting my information, but that means that their data is better than someone else's data, so it is more valuable. Also, they are getting app usage statistics that I may have opted out of at the OS level, but they now have due to having the sign in history.

prdonahue• 7 years ago

Who do you trust more _not_ to do sketchy stuff with your data, Apple or Google? For me it's unequivocally Apple.

peeters2• 7 years ago

Problem is, today I agree, 10 years ago it would've been a tossup, and 5 years from now, who knows? These "trusted central broker" privacy models are nicer than giving your info to dozens of individual actors (when you trust that central broker more than anyone else), but they also become a single point of attack/failure.

beat2• 7 years ago

The company that did not deliberately remove the phrase "Don't be evil" from their values.

y4mi• 7 years ago

Neither would be the only sane choice. Multinational corporations will always screw individual customers for profit.

And the issue with trusting any entity with data isn't really what it will do with it today. The bigger problem is what the entity will do with it tomorrow - under new leadership.

It might also be interesting to know that Apple is also in the business of selling "relevant adds". Its a tiny amount if compared to Google, but gives them the same incentives if the platform ever became the most used one around the globe. That danger is basically nonexistent considering the pricing of Apple devices but makes most claims of apples trustworthiness pretty hollow.

Some of Apple's services use end-to-end encryption. That makes them better from a privacy angle than Google for example... But still... Don't trust multinational corporations. That can never end well

throwayEngineer3• 7 years ago

For me, Apple.

Google isn't outwardly evil.

Apple being anti consumer and anti developer really show you who Apple works for.

Yetanfou2• 7 years ago

How about 'neither of them'? Trusting Google with your data is like trusting a fox with guarding your hen house, trusting Apple with your data is trusting a fox which claims it turned vegetarian.

Run your own mail server and you'll have all the addresses you care to use, using any scheme you might think off. I've been doing this for decades now and it just plain works. A day or so to get the thing setup, 8 hours of maintenance per year and you're done. Use Google-free Android devices in your pocket, Linux or *BSD on your lap and in the server/broom cupboard and those foxes can claim to be vegans for all I care.

nickdandakis• 7 years ago

Except Google is an advertising company and Apple is a consumer electronics and software company. Their objectives are different, and historically, Apple has been one of the most privacy-focused tech companies.

Not saying Apple can't use your data, but as far as auth providers go, I'd rank Apple higher than all the other Big Tech Cos.

falcolas• 7 years ago

Apple doesn't, to the best of my knowledge, monetize data, either through ads or selling it to third parties. I'd welcome a clarification if I'm wrong.

alex_young• 7 years ago

Yet

ipsum2• 7 years ago

https://searchads.apple.com/

They're monetizing user data/behavior.

One example, I didn't search very hard.

User response is an important signal of ad relevance. If customers don’t tap on an ad, Apple Search Ads will stop showing it to them.

zepto• 7 years ago

Only if you think Apple is lying.

slim• 7 years ago

they also have all your emails coming from that app

toyg3• 7 years ago

The difference is that one is a hardware company making services to sell devices; the other is an advertising company making services to get more data for ads. One of them can live without your data, the other cannot.

kevin_b_er• 7 years ago

Companies already massive dislike fake/temporary emails. Go find a throwaway email service and you'll find many many websites blacklist them. I'll actually be angry if Apple succeeds, because it'll just mean I can only have private email address as an apple customer and not anywhere else. Many companies might make an exception for Apple, but not anyone else.

crooked-v• 7 years ago

On the other hand, if Apple succeeds, this gives a clear route to push for other services that work the same way.

thrill4• 7 years ago

This is neither a fake nor a temporary email. It is unique, made specific by the combination of the user's appleid and the target app/website, and permanent in that it will remain the same. The ability of the user to automatically discard/block content sent to the email address doesn't change this, as it's no different other than (probably) more convenient than setting up a bunch of spam filter rules for those "services" that refuse to remove your address.

Xelynega• 7 years ago

It says in the article that it's a 'unique, random address', so I don't know where you're getting the 'combination of the user's appleid and the target app/website' from. The purpose of the service is the same as other temporary email services, to anonymize signing up for services by providing a fake email.

dpq5• 7 years ago

Sounds like a good time to remind people about Telegram having a similar function for quite some time now. And just yesterday they announced a feature to simplify logging into web sites using TG bots: https://telegram.org/blog/privacy-discussions-web-bots

It might be a personal choice, but for stuff when privacy is really important I'd definitely pick Telegram over Apple, no matter how much the latter claims to keep me safe from three-letter agencies as well as marketers.

saagarjha6• 7 years ago

I'd definitely pick Telegram over Apple

Why?

eitland5• 7 years ago

Works everywhere with the devices and OS you have like (or can afford): Android, Linux desktop, Mac, iOS, Windows and more.

dpq5• 7 years ago

For a start, I don't own, and don't want Apple devices.

Also, stories about FISA overreach, PRISM, the rest of the alphabet soup plus gag orders do not particularly inspire confidence.

w3rhn2j34oh5o5• 7 years ago

Telegram is unencrypted by default. All standard messages are stored on the server. Telegrams secret chat mode (end-to-end encryption) uses home made cryptography, and has been panned by experts in past. All group chat is in the clear and stored on the server. This is not the case with imessage. Comparing Telegram to iMessage, telegram is not in the same league as Apple. I don't trust either from TLA's or well funded adversaries.

golergka• 7 years ago

All standard messages are stored on the server.

It's a feature: history synchronization between different devices and fast search through hundreds of thousands of messages is, for most uses and users, more important than concerns that Telegram or nation-state level attackers (one capable of silently breaching Telegram infrastructure) would choose to read your chats.

Tepix2• 7 years ago

It‘s not homemade crypto. It‘s just not the latest and greatest modern crypto but it has no glaring weakness.

dpq5• 7 years ago

Plain wrong. It's not end-to-end encrypted by default, that's true. But all chats are encrypted with key portions distributed between different jurisdictions in case some country gets funny ideas.

Chat archives are stored encrypted, not in plain text. Please cite your sources if you claim otherwise.

schaum• 7 years ago

If they implement it in OIDC they basically randomize the mail address for every application? What about the other scopes?

https://auth0.com/docs/scopes/current/oidc-scopes

ruffrey• 7 years ago

We've been thinking about this for Mailsac.com. It is already possibly but clunky. Considered making browser plugins to make it easier to create and route disposable addresses, and "black hole" disposable email addresses once it's clear they've been resold to advertisers.

baxtr• 7 years ago

Sounds promising, because this is where Apple is really got at: taking something “at the fringes” and taking it to the mainstream.

Scrantonicity• 7 years ago

Doesn't this also lock in users to Apple? Will I still be able to use these apps on other devices?

inapis• 7 years ago

If Apple discloses the generated email id. But the given examples seem very tedious to type.

jiveturkey4• 7 years ago

How will this be different that anon.penet.fi? (Besides the data being held in the US, where it is very much in reach of the authorities; Apple isn't going to shut down the service to uphold some privacy principle vs a government authority.)

mrb• 7 years ago

I love that TC chose a picture of "fc452bd5ea@privaterelay.appleid.com" to illustrate the article. When was the last time you saw a service that could be described by a single "word"?

buboard4• 7 years ago

Why do they resort to hexadecimal usernames instead of using the entire alphabet for shorter names?

ignoramous2• 7 years ago

If I showed it to my mom, she still wouldn't know what was up. The genius would be in to make the UX frictionless and disposable addresses the default. Let's see how Apple executes this. They do absolutely pull UX stuff off from time to time. So, that's there.

thrill4• 7 years ago

I updated my AppleID since I haven't used it in years (have other devices) in anticipation of implementing this as soon as it's available on a site I'm working on. It appeared they offered two-factor authentication to get away from those 1990's type of security questions. Ah, not so fast - 2FA is only enabled with Apple devices. Poor play there, Apple. This service looks like something sorely needed - bring the rest of the flock into the fold and let everyone plug in their Yubi key.

Tepix2• 7 years ago

FIDO U2F or TOTP. On the other hand it‘s perfectly understandable that they use his to sell their hardware.

thrill4• 7 years ago

Google doesn't limit who can login by their device manufacturer, but the supposed privacy focused company does?

NN88• 7 years ago

Apple is ahead of the game officially.

throaway55335• 7 years ago

Outlook.com has allowed email aliases for a really long time.

Justsignedup• 7 years ago

While I like this for privacy purpose this is pretty nafarious.

There is no mechanism by which you can use this sign-on without Apple. That means you are stuck with these specialized accounts you would need to re-setup once you leave apple. Just another lock-in.

This is definitely not the first time apple does anything like this. If apple really cared they would make a tool for any device or operating system to enable this. But they will not.

Aaronn• 7 years ago

... if you looked at the screenshot of the app they showed it also had sign up without using Apple Sign in and just using a email address.

danShumway3• 7 years ago

You might be misunderstanding what the poster was talking about -- it's not that you'll need an Apple ID to sign up for a site, it's that once you sign up with an Apple ID, you might not have a way to link your account to a different email address. That effectively means that you'd need to recreate your account when you move away from Apple.

Of course, the other side of that is that sites are probably going to have ways to link accounts, and it likely won't be a huge deal. They certainly have no motivation to help Apple with lock in. It's not going to be any different from the process that exists today for moving associating an email with an account you created through Google/Github signin.

Still, it would be nice to have a way to use this without an iPhone, or it will be a (small) extra piece of friction you just have to deal before moving ecosystems, rather than piecemeal after getting a new phone.

Also note that the same exact concerns exist with Google/Facebook sign in, it's just that they aren't tied to a physical device so you only need to worry about losing them if you're making a conscious decision to delete your account.

judge20202• 7 years ago

This is something solvable by the service provider. Services can allow you to sign up with Apple, but hopefully they also allow you to link other social accounts and/or set up a password for login without IDP.

masnick• 7 years ago

For a while now I’ve been using “someservice.com@account.mydomain.me” when signing up for accounts.

I use FastMail for my email hosting, and they allow you to turn on wildcards for any custom domain. I don’t get any spam because it’s at a subdomain — never enable *@mydomain.me because you will get a mountain of spam to admin@, webmaster@, etc.

beenBoutIT2• 7 years ago

When Apple users use this to commit fraud/trolling/stalking/etc. and get tracked down it's going to make Apple look bad.

busymom04• 7 years ago

Not really. It's still linked transparently behind the scenes to your Apple ID. The connection won't be visible to the developers but the fraud etc will already be taken care of when signing up for your Apple ID.

beenBoutIT2• 7 years ago

The reality is that it won't do much to protect users privacy or prevent tracking, although it will make it easier for users to avoid spam filling up their inboxes.

mindgam37• 7 years ago

This is a huge move. Apple striking at the core of Facebook's play to own your identity, which they had with Facebook Connect but have completely fudged out with countless breaches of user privacy and trust. I used to be the biggest fanboy of facebook connect, but now I have to say: Go Apple.

basch16• 7 years ago

Apple ID as SSO, iMessage Profile, Memoji, and Apple Pay. Apple is near FB Messenger parity, now that it functions as an account for external services. It's an extremely strong move on Apple's part, especially considering how close to it they have been for a while. They sure like taking their time sometimes.

mindgam37• 7 years ago

True. Apple definitely playing the long game here, effectively. When iMessage came out I totally didn't see it ever becoming a viable identity play. But with all these privacy concerns, now it feels like the one to beat.

noelsusman3• 7 years ago

They're close to parity with a giant exception that it's not available to the overwhelming majority of Facebook users.

MRD852• 7 years ago

I've been anti-Apple since I was a high school kid in the 90's. Those big colourful Mac's looked dumb. They're close to winning me over and I'm probably buying a new laptop within 12 months

mindgam37• 7 years ago

I highly recommend buying a 2015 Macbook Pro, if you can find someone willing to part with theirs. Apple laptop hardware started going off the rails after they shipped that one with touch bar + keyboard shenanigans.

busymom04• 7 years ago

I develop apps myself and I am 100% onboard with using this instead of offering the signup with google or facebook buttons (can offer those as secondary options). I might even push users slightly to use this instead of others as it gives my apps a bit of extra trust worthiness imo.

Only question I have is if it's possible to integrate this on websites and for non-apple products too? Because I would like my app which is available on Android too to be able to use this.

EDIT: Apple's site says it will be available on websites too. Let's hope it's available on non-apple devices too:

Apple is introducing a new, more private way to simply and quickly sign into apps and websites.

https://www.apple.com/ca/newsroom/2019/06/apple-previews-ios...

atticmanatee• 7 years ago

On the presentation they said it would be available on web and android.

busymom04• 7 years ago

Thanks, I was reading the docs and apparently it will be available for websites too and comes with a JS library which will let me use it on Android too. I am quite excited for this as a developer.

gigatexal2• 7 years ago

This single feature shown off today at WWDC has solidified my forever lock-in on all things Apple and especially iOS: no longer will my email be sold needlessly or be spammed and my logging into to different web properties sold to marketers and ad networks and data aggregators. I trust Apple a whole lot more becaUe they charge and arm-and-a-leg for high end hardware and soon services because the products and services are the products not their users.

basch16• 7 years ago

As soon as Keychain can abstract away passwords completely (rando generation, never need to show the user the password), so an end user cant tell if a site supports Apple SSO or if Apple is just emulating SSO, Apple deserves to be crowned the Identity Winner.

gigatexal2• 7 years ago

This would be amazing.

pat2man2• 7 years ago

There is a session on WebAuthN on Thursday.

Angostura2• 7 years ago

Actually - does it lock you in, in a more literal way.

If I sign up for a service using Apple Sign In, is then possible to sign into my account from a Windows etc machine subsequently?

karmelapple• 7 years ago

There appears to be a web API for this, which would be cross compatible.

If you have used Apple's service - which is completely opt-in - you could always go into an account and change the email you associated with it if they let you do that. And if you don't, this would be in the ballpark of switching email providers - yup, you'll need to change some accounts, because you've decided to no longer pay for the service from the Apple email forwarding.

piokoch• 7 years ago

Am I correct that TechCrunch page violates GDPR? I don't see any option to opt-out from being tracked. There is OK button and manage option link, but I can't manage anything, I can only agree for tracking...

parliament32• 7 years ago

I'm not an Apple user, and don't own any of their products, but this is a great step forward for privacy. I'm happy to see companies prioritizing privacy for users.

That being said, any company that actually cares about collecting users' identities (you know, the ones you'd actually want to use this for) will definitely block @privaterelay.appleid.com from being used. Apple would've been better off using a well-known domain and having both private and non-private addresses on it, like @me.com .

buboard4• 7 years ago

So what if in the future apple decides they dont want to allow your website to use it anymore (because e.g. it violates their UX guidelines)?

fenbielding• 7 years ago

If anyone needs this right now, we've been offering this for a while with https://www.faircustodian.com

Lots more planned for the future of personal privacy protection too.

yalogin• 7 years ago

Emails from companies already have a unsubscribe button. So if I unsubscribe they shouldn't send me emails. That is not changing with the new Apple Sign In feature. Emails will still have the unsubscribe feature. The only reason for devs to push for a real email is to sell it to advertisers. They are not deleting the email once I unsubscribe. So giving them an ankoymized email is good. I hope this succeeds.

tartuffe78• 7 years ago

Many spam emails I get these days from companies say things like "Unsubscribe from this list" so for example I have to unsubscribe from their "Daily Digest", "Weekly Digest", "Recommendations", etc. all one at a time.

SOLAR_FIELDS• 7 years ago

And there's no guarantee how many of those "lists" you are on with some softwares. You might have a one-click unsubscribe, but you just one-click unsubscribed from the first of 100 lists you were placed on for that company.

ashtonian2• 7 years ago

Orr you could buy a domain, and use a catch all email rule and then use an unique rmail address per site. Like mybank@mydomain, yourepamsite@mydomain ect.. I've never had any security problems.

danShumway3• 7 years ago

How would that help with tracking? The domain you buy will be a unique identifier that's owned only by you.

What tracking will this defeat that couldn't also be thwarted by putting dots and plus modifiers in a Gmail address?

ashtonian2• 7 years ago

Wish all the cc companies would do this with their numbers. Some do.

buildbuildbuild2• 7 years ago

It seems you must first have an *OS app in order to use Apple Sign In on the web, a $100/year barrier to entry for web developers verses Google/Facebook auth.

"To configure web authentication, you must create a Services ID and associate your website to an existing primary iOS, macOS, tvOS, or watchOS App ID enabled for Sign In with Apple."

Source: https://help.apple.com/developer-account/#/dev1c0e25352

rezz• 7 years ago

Sounds like a great SAAS opportunity.

gameguy43• 7 years ago

This is neat. But I'd have thought the lower-hanging fruit anti-spam wise for Apple would've been to add a "mark as spam" button next to push notifications so users can start reporting all the apps that abuse push notifications to send them advertisements.

ricardobeat2• 7 years ago

Whoa. Apple is picking up where Mozilla’s ball dropped, but with a massively better chance of success.

Cheers to whoever is running this show.

loceng• 7 years ago

Tim Cook and the Board of Directors, no? Of course there will be other who initiated and are spearheading the effort to include in the cheers.

move-on-by2• 7 years ago

Mozilla dropped the ball on this? They never had an opportunity to do this. Apple will only succeed by bulling developers that want to stay in the AppStore. Mozilla doesn’t have the market share or financial leverage to do anything like this.

ricardobeat2• 7 years ago

https://en.wikipedia.org/wiki/Mozilla_Persona

Mozilla doesn’t have the market share or financial leverage to do anything like this

Precisely. There was very little incentive for websites to adopt it at the time; Apple has a lot more power.

sdan• 7 years ago

Is this Safari only or for all browsers?

ChrisMarshallNY• 7 years ago

I'll use it.

maxheadroom3• 7 years ago

This is a great idea but it kind of falls short.

Elaboration with example: LinkedIn is notarious for swiping up any data points that it can find. Your carrier, your GPS location, etc.

As long as there are two or more data points to successfully tie you to that id, it's already game over. It'll just be added to your "targeted advertising profile" and, given the wrong company getting ahold of it (looking at you, Equifax), sold/traded on the advertising market to third-party advertisers to build better profiles because... ...advertising dollars?

Anyways, the premise is cool but I think - without addressing the dragnet that is targeted advertising - it'll just be a minor inconvenience, which will be conquered over time with the collection of enough data points to tie it back to the "you" that they already know.

...unless you start-off with a brand new phone (new IMEI) and don't associate any old accounts with it, that is.

minhazm2• 7 years ago

Apple doesn't allow you access the IMEI or even Mac address. And they announced at WWDC today that they're locking down people scanning for wifi access points + bluetooth beacons to determine location also.

The purpose of this isn't to make you anonymous. It's just to make sign on a little simpler and for apps that you think might not be super trustworthy or apps that don't actually need your email address you can choose to give them this proxied one. Obviously social accounts and other applications that will ask for your real name will know who you are.

pluffycat4• 7 years ago

It’s a step in the right direction. One step at a time.

groovybits• 7 years ago

This is similar to Abine's Blur service, which provides a throwaway phone number, and (seemingly) infinite throwaway emails addresses that can forward to your own personal email address.

https://www.abine.com

dooglius• 7 years ago

Does this effectively kill the ability for services to have sign-up promo codes?

pndy• 7 years ago

Isn't there a flaw? What does stop service provider/application vendor from banning this relay domain and force users to provide real email address for data-mining purposes aka "ensuring that service/app will work"? Unless of course that Apple would deal with those who would go for this

stirner• 7 years ago

I used to do something similar when I ran my own mail server. Whenever I created an account for a new service, I would add an entry to /etc/aliases e.g.

    news.ycombinator.com: stirner

and sign up for the service as news.ycombinator.com@mydomain.com. If I ever left a service, I would just remove the corresponding alias and restart Postfix.

I eventually got tired of the work required to avoid spam filters and switched to iCloud Mail, so I’m glad to see this feature built in.

plonkus• 7 years ago

I like that you can use the feature on the web too, but it appears you need a paid developer account to generate the client id/secret

https://developer.apple.com/documentation/signinwithappleres...

ngcc_hk• 7 years ago

Great. I guess also you need to use apple machines to remember the email address and any password for you. Sometimes they ask for it.

bound008• 7 years ago

Free disposable forwarding email addresses that you can turn off. Built on the startup bus years ago: http://boun.cr

MailGun ( a YC company ) was providing their API for free, until another company came along and offered to take over the project. All of the code and design was built on a bus from CA to ATX.

(and one of the team members met their co-founder on that (StartupBus) trip and went through YC. I believe they are a unicorn now)

tschwimmer• 7 years ago

This is really good for consumers, but I'm afraid that many websites simply won't bother to implement this. Apple just doesn't have the unique marketshare that Google and FB have. The set of users that would use such a thing is the union of privacy focused users and users with an Apple ID and not a Facebook or Google account. This set is heavily overrepresented on HN but is relatively small overall.

If I run foo dot com, is that set of users attractive enough to me that I'll spend the engineering time to implement this? I can't think of many instances where it would be.

dantheman0207• 7 years ago

Might be true. Certainly it’s true that Apple represents a smaller user base then, say, Google or Facebook.

But Apple users represent a disproportionately large subset of the users that spend money.

countbackula• 7 years ago

"Apple says it can authenticate a user using Face ID on their iPhone without turning over any of their personal data to a 3-p company."

So is this feature exclusive to Face ID and iPhone? Would users, Face ID enabled or not, be able to use it with only their iCloud email/ID? And would older iPhone models incapable of FaceID still be eligible?

These may be just questions of a skeptical mind, but I really hope Apple isn't using a pro-user, pro-privacy feature to phase users out of older models.

dcbadacd4• 7 years ago

Unfortunately there's no way to implement this as a OAuth2 flow and without having an Apple device. Seems unreasonable to require an Apple dev account just for providing sign up - it can be tested without installing apps or just borrowing an iPhone.

cfarm• 7 years ago

Google and FB will likely copy this asap.

xalava• 7 years ago

In order to read this article you must redeem your privacy to more than a dozen companies or go through five screens with a confusing UX to change parameters. Oh Irony

jedikv2• 7 years ago

Great feature, shame it's tied to apple hardware - making it inaccessible to those who cannot afford it.

shaneos• 7 years ago

Seems like a direct copy of MaskMail.net

Nice to have the product validated, but never fun when a giant just duplicates your business

polutropos• 7 years ago

According to the App Store review guidelines update posted today, Sign In with Apple will be required for any iOS app that implements a single-sign in button.

"Sign In with Apple will be available for beta testing this summer. It will be required as an option for users in apps that support third-party sign-in when it is commercially available later this year."

https://developer.apple.com/news/?id=06032019j

jiveturkey4• 7 years ago

that smells like an anti-competitive behavior.

obviously apple has considered this and is forging on anyway. good for them.

nihonde8• 7 years ago

Competition is not anti-competitive.

Excluding other third party sign on options would be problematic if Apple were abusing a dominant position among smartphone makers, which is not the case by any objective measure.

summerlight3• 7 years ago

Probably Apple is hoping the entire Apple ecosystem not to be defined as "a market" in terms of antitrust laws. I am not sure if the Justice Department will agree with it though; we'll see.

If it's defined as a market, then Apple will be surely in trouble but enforcing Apple ID alone doesn't make much differences from the current situation as it always has been doing similar things for web browsers, music apps, app store itself etc. So it's pretty natural to enforce this policy for Apple; no additional risks but only benefits.

dfabulich2• 7 years ago

Therefore, anyone offering Facebook/Google login will also have to accept Apple's anonymized forwarded email addresses, like fc452bd5ea@privaterelay.appleid.com.

sturgill8• 7 years ago

But this explicitly doesn’t work as an SSO. How can I tie that back to the actual email address they would have used to create an account using their FB / Google account?

This sounds like a tremendous headache that I really don’t want to worry about. But Apple is looking to leverage their power in the app market to force me to implement a tool I may not be interested in as a merchant?

I despise being strong armed. I hope the EU crushes this.

ulfw• 7 years ago

How will this work if I use non-Apple products (and GOD BEWARE !) move from say an iPhone to an Android or an overpriced Macbook to a PC?

Once I chose to use Apple-Sign In will I be locked into the ecosystem? Will there be 'Apple-Sign In' for Android?

haswell• 7 years ago

I'm really curious to see if this impacts enterprise apps that are configured by an administrator to use an internal SSO provider, or if this only applies to apps that allow users to sign up.

For example, Slack can be (and is often) configured to use Okta or some other SSO provider. Does the Slack app have to implement some kind of support for Apple Sign In when such use cases are involved?

omeid2• 7 years ago

Apple have always had excellent Enterprise support on iOS, including "private apps" and what not. There is no reason to believe the same exception wouldn't be extended to Enterprise Devices and Apps.

mindgam37• 7 years ago

This is Apple sensing weakness and dropping a bomb right on facebook’s doorstep. And they sidestep the anticompetitive angle by arguing that instant anonymous sign on is simply a better UX, which it is.

Someone at Apple deserves a raise.

canes1234562• 7 years ago

Lol, I doubt it. Apple is years late and sucks at doing the leg work of getting third parties to adopt its suck. Look at Apple Pay which was launched at the perfect time.

notSupplied• 7 years ago

It is an incredibly bold move. Just as tech monopoly power comes under scrutiny--in Apple's case the AppStore--they wield said monopoly power...but for a seemingly good cause.

Quite the gambit.

timdorr• 7 years ago

How will this work for apps that depend on the third party for more than just identity? For instance, does an app built on Spotify's API have to include a Sign in with Apple option? Or something like CI2Go, which is an app for CircleCI, which only offers log in via GitHub or Bitbucket.

I have to assume there will be exceptions.

icebraining2• 7 years ago

If you are built on Spotify, then the use is not signing in to your app, but to Spotify (and then authorizing your app), so it should be up to them to provide the Apple Sign In feature, I assume.

lathiat• 7 years ago

Frankly as a consumer I am happy about this.

Even the existing Sign In with Facebook is implemented terribly by many apps, e.g. requiring me to enter my password in app instead of calling out to the Facebook app like maybe 50 of apps support properly.

I think honestly this comes from apps that are built with cross platform frameworks but its still frustrating.

Further more it drives me crazy new apps (and websites) released this year focused on mobile (e.g. pay for fuel at a fuel station with your phone) and I can't even auto complete the credit card or name using the new keyboard extensions because they somehow labelled the forms in a way apple can't figure out.

xtat2• 7 years ago

right, another one to ban

xtat2• 7 years ago

2019 big tech innovation is basically finding ways to ensure only they have access to your data

max76• 7 years ago

On the downside if I use Apple Sign In on apps I probably won't be able to sign in to that application on my Android devices.

twiceaday• 7 years ago

Or a non-Mac computer? I doubt it. This is likely just an Apple id sign-in that is progressively enhanced on ios / osx.

pat2man2• 7 years ago

They do have an sdk for web, will probably work on any platform with a web browser.

nly• 7 years ago

Using 'Sign in with X' with service Y means you're giving X, or anyone forcing X to abuse their position, full access to your account on Y.

Additionally, anything sent to you@privaterelay.appleid.com flows through an Apple server.

You can trust Apple with this now, but it's not so easy to revoke that trust later. Still, it's useful for throwaway signups and garbage I suppose.

NightlyDev• 7 years ago

"without turning over any of their personal data to a third-party company"

Uhm.. If a user sign up on my site with apple sign in then they definetly will share personal data with a third-party: Apple.

If user A wants to use product B and signs in using solution from C then C is the third-party.

paintstripper• 7 years ago

Yeah, but lots of people including me trust Apple with their data. I sure as hell don't trust your site.

cavisne2• 7 years ago

This is very cool in terms of security principles (no email that can be used to track you by default, mandatory 2FA, mandatory SPF for emails).

The mandatory inclusion if you use third party SSO already (smart I think as otherwise FB and Google would probably start paying developers not to include it) aside, this will probably get a lot of uptake for apps that dont use SSO.

Apps that people mainly use on mobile devices and TV's would benefit a lot from this (as these devices arent good for typing in complex passwords). Additionally larger companies would be concerned about letting Google or FB sell their user list to competitors for targeting. Apple already has all this information, so nothing is lost by enabling SSO.

timothyduong• 7 years ago

I've been predicting this since iOS 11! So good to see it come to fruition.

Apple SSO :)

skc• 7 years ago

I'm no big fan of Apple, but I must say I get a perverse pleasure out of moves like this because you'd probably find that 90% of Facebook employees swear by and love Apple products.

awfully• 7 years ago

How is this going to work with all the websites that make you login with your email address? Gonna be super hard remembering them?

jason46• 7 years ago

Will this effect apps that i use on an ipad and an android phone that share a login?

dontbenebby• 7 years ago

Interestingly Mozilla tried something like this a while back:

https://en.wikipedia.org/wiki/Mozilla_Persona

Sadly they cancelled it.

(I was actually hired as an intern to work on it, but they stopped paid development between me accepting my offer and my arrival in SF)

Apple Sign In

Related Stories