18 ms·

Why we won’t be supporting Sign in with Apple

• tboyd47 6y ago
  There's a subtle sense of exuberance shining through in this article that makes it a gratifying read, even if you've never heard of the company before. Kudos to them for their decision not to bow to Apple's demands. Please tell us how it goes!
  • dave5104 6y ago
    Well, they're also getting rid of the "Log in with Facebook" option too, which is arguably giving into the demands of Apple.
  • ogre_codes 6y ago
    > bow to Apple's demands. Apple "demanded" companies either add their privacy friendly sign in option, or give up on the data-slurping Facebook google sign-ups. This company gave up FB sign in, which they acknowledge is pretty gross and bloated.
  • scarface74 6y ago
    That works as intended - they took out FB integration.
• intellirogue 6y ago
  Worth noting that AnyList automatically subscribed me to a marketing list without double opt-in or any kind of consent, which is exactly the kind of behaviour that makes me not want apps to have my real email address.
  • kergonath 6y ago
    And their whining about not getting email addresses is exactly why I would not want to give mine.
  • mxcrossr 6y ago
    They mention customer support so many times in that article, but it's a grocery list app! When is the last time I asked for support for the sticky note attached to my refrigerator? I don't doubt that there are indeed customers who need support from time to time, but surely it's a small minority. These seem to just be contrived arguments to protect their customer data selling bottom line.
    • temporarysdwvit 6y ago
      Yep, my feelings exactly after reading. All this whining happens only when your business is very dependent on specific information that gets taken from you.
    • crazyricardo 6y ago
      Definitely picked up the same intentions from the post. Seems out of place to complain about not having email addresses for "support" reasons. If they truly cannot help users without asking for their email address, maybe they should not have users (login) then.
  • ativzzz 6y ago
    Having any kind of subscription payment massively increases complexity and support requirements in your app.
  • nuker 6y ago
    > automatically subscribed me to a marketing list Side note, disabling 'load remote content' in email client stops all spam in a while, they think emails are not read.
    • judge2020 6y ago
      Using Gmail at all seems to have the same effect as well since they pre-load and proxy almost all email content. Only when you use alternative mail clients might they see the images/remote content being loaded from a non-google IP.
  • nashashmi 6y ago
    This. The blog post was long and winded. And it brought up some very desperate arguments, like the bug bounty offered to hackers when they report security vulnerabilities. They want people's email addresses, period. They say that no email breaks the sharing feature. True. But that's something that can be offered later when someone actually does share something with you. They say that the emails will go to the a seldom checked account. True. But users can change email addresses. They say it breaks support service for looking up accounts without email addresses. Again true. But what's another way of looking up accounts? Username. What is another? Apple ID. They are email network harvesters. Plain and simple. And this is their business model.
    • deleted 6y ago
      [deleted]
  • Smoosh 6y ago
    The article says "When you provide us with your email address, it is never sold, shared, or used to invade your privacy." So, one of you is lying. I don't have the means to determine who, but I don't see what your motivation for lying would be, but can see what theirs may be. And to extend that, if they are a spammy company, that would be exactly why they would be complaining about SIWAI.
    • intellirogue 6y ago
      It wasn't sold or shared, the emails came from them. But they were pure marketing, not transactional, and I certainly didn't agree to it or want it.
  • mafriese 6y ago
    That's exactly what I'm thinking! Further I can't find the EULA of the app on the internet - maybe I'll find it later. But I could bet that they sell the data for marketing purposes. And I could also bet that they removed Facebook not because they don't want to use it but because they had to implement Sign in with Apple which would result in the Data being not so valuable because the standard option is to obfuscate the mail address.
• djrogers 6y ago
  This makes perfect sense from their standpoint - especially since they've had similar problems to what they outline with Facebook sign-in and are now dropping that as well. This is also a win for Apple & end-user privacy, as there's one less app using FB's login feature now. I think Sign in with Apple is a great step forward even if all it does is eliminate apps that require Facebook and/or Google accounts to log in. I hate that - I actually ran into a feature on my mesh router system that required a FB/G login, which made it a useless feature for me. Fortunately I didn't need it..
  • muro 6y ago
    I've never seen an app that required a FB or Google login. It was always possible to use email+password.
    • panopticon 6y ago
      CalTopo[0] doesn't support email+password. It's one of the few websites I use that doesn't support it, but an unfortunate number of mobile apps don't either. [0]: https://caltopo.com/map.html https://caltopo.com/map.html
    • coolspot 6y ago
      PUBG mobile requires either FB or G+. No option for email+pass.
    • dheerendra73 6y ago
      Lucky you! I've run into lot of these apps offering only FB/Google sign in. Or offering mobile number only login. For e.g. I like playing scrabble and Scrabble Go only support FB login so I'm playing only as Guest user for months now. Mobile number login is even worse! Why do I need to share my mobile number for something where you don't need to have it!
      • rmorey 6y ago
        I think a lot of services use mobile number login as a way of bot-limiting; harder to create lots of phony email addresses than phone numbers. But it's still a pain in the butt :(
• czzr 6y ago
  Buries the lede. They’ve chosen to drop support for Facebook login rather than also support Apple login. So working as intended!
  • philistine 6y ago
    Bingo ! This is Apple’s really hard bargain here. Implement us or get rid of all the other garbage sign-in.
    • lifty 6y ago
      I love it. With password managers becoming better and by owning your domain, it almost feels like a self-sovereign identity system. It would be great if services would implement better support for browser form auto-fill, and ask the minimum amount of information during signup. That way it would be very little hassle to signup for a service.
      • scarface74 6y ago
        And Apple has integration points with third party password managers.
        • bpicolo 6y ago
          Only ~1-2 apps of the several dozen I use support them. For folk that aren't super tech savvy, still a struggle
    • kodablah 6y ago
      And get rid of all the other non-garbage sign-ins too, correct?
  • guessmyname 6y ago
    Either the changes are only for the mobile app or they forgot to remove Facebook Sign In in the web [1][2]. [1] https://www.anylist.com/auth/sign-in https://www.anylist.com/auth/sign-in [2] https://i.imgur.com/3uC0E9G.png https://i.imgur.com/3uC0E9G.png
• deleted 6y ago
  [deleted]
• blakesterz 6y ago
  That was an interesting read. Also, they close with... "These are both excellent points, and it’s absolutely true that some of the arguments above apply to creating an account via Facebook. That’s why we’re also announcing that we’ll be removing the Facebook Login from AnyList."
  • dilap 6y ago
    Well, that, and also if they don't remove FB login, then the would be required to also implement Sign in with Apple. They didn't want to implement Sign in with Apple, so they had to remove FB login.
    • disgruntledphd2 6y ago
      Which is a pretty anti-competitive move on Apple's part. They're essentially using their control of the iOS ecosystem to benefit unrelated products. I seem to remember that those kinds of actions didn't work out well for Microsoft :)
      • JohnTHaller 6y ago
        Apple takes many anti-competitive and consumer-hostile actions. They can freely get away with it, though, as they aren't a monopoly.
        • frogpelt 6y ago
          Also, they will argue that they are doing it for privacy and security reasons which are benefits to users. But I don't know how much a judge would care about that.
        • scarface74 6y ago
          How is this user hostile - forcing app developers to give users a choice that doesn’t give the app developer your real email?
          • 6y ago
• stickfigure 6y ago
  If you implement Sign In With Apple, you don't have a relationship with your customers anymore. They're Apple's customers, and Apple can take them away at any time.
  • djrogers 6y ago
    How is that different from FB/Google's login services? The only apps that are required to support Sign in with Apple are those that also support FB/G/etc sign in, so those companies have already chosen a path...
    • nicky0 6y ago
      It's not, which is why they are also removing FB login.
    • stickfigure 6y ago
      Google provides an email address. You could replace your Google auth with password auth in an afternoon just by adding a "forgot your password" link. Facebook auth used to provide an email address, but it's been almost a decade since I last used their APIs so I don't know if that has changed. Apple's "provide an anonymous email address" inserts them between you and your customer.
      • jmisavage 6y ago
        When you use Apple's Sign In it flat out asks whether you want to use your real email or an anonymous one. The user is purposely says, "Hey, Apple get in the middle I don't trust these clowns."
        • jakear 6y ago
          HN... where people go to complain about both companies requiring access your email, and companies requiring you to be able to block other companies from access to your email. I don’t get it.
        • 6y ago
• Avamander 6y ago
  They will get removed. They don't have the power to fight Apple.
  • dilap 6y ago
    No, they're fine -- if your only login is first-party, you don't need to support Sign in with Apple. (They're taking out FB login to comply.)
    • muro 6y ago
      I do wonder, though, whether the requirement for Sign in with Apple is coming in a few years. As in, if you allow users to sign in with email/password, you must allow users to sign in with "sign in with apple". It might be more subtle, like suggested auto-fill to create a new account.
      • Karunamon 6y ago
        That sounds like a bridge too far even by Apple standards. I can get on board with "if you support Facebook, you have to support us as well", but not allowing any kind of escape hatch feels particularly scummy. At some point it's none of Apple's business how people sign up with my service.
        • muro 6y ago
          I don't understand how "if you support Facebook, you have to support us as well" is ok. Only by holding the relationship between the user and the developer "hostage".
    • Avamander 6y ago
      For now. I don't have much hope that it will remain like that.
• no_wizard 6y ago
  A lot of the points they make here are real points, and I think AnyList has validity in their actions. I also think it’s not as unmanageable as it seems. Let’s analyze this quote, from the article, as it highlights what I imagine are a big crux of this issue: > with the “Hide My Email” option, your spouse or friends obviously won’t know your privaterelay.appleid.com email address, so when they enter your email address, our systems will believe that you don’t have an account Since you know this to be the case, why not have an onboard if flow they Sign In with Apple where you have them A) choose a visibility email used for sharing/communication etc. and B) allow for this email to be their backup email? So if they forget their login or whatever you could just transfer the account to this email instead? Of course this should be opt-in but you can always Under good faith explain benefits there in. It’s more work, but I don’t believe that it’s going to run issue with Apple and provides end users with flexibility. Of course this may not be worth it, at all. This is just a consideration worth thinking about as an app developer edit: Of course another alternative here is they just make users aware of what their sharing email is and allow users to optionally change that, if they want to. This most definitely wouldn’t run counter to this I’d think
  • danudey 6y ago
    > Since you know this to be the case, why not have an onboard if flow they Sign In with Apple where you have them A) choose a visibility email used for sharing/communication etc. and B) allow for this email to be their backup email? So if they forget their login or whatever you could just transfer the account to this email instead? I'm fairly certain that detecting someone hiding their e-mail from you and then making them pick a different e-mail goes against the spirit, if not the rules, of Sign In with Apple. That said, it would be extremely beneficial to pop up a screen saying "Hey, is this the e-mail you want to use for communications?" and let the user decide. That said, removing third-party sign-in is also a fine solution, almost definitely a better one, and simplifies things immensely for everyone involved (assuming their sign-in form in the app supports saving passwords to the keychain).
    • ssalka 6y ago
      > making them pick a different e-mail I think it's more about _letting_ them pick a different email. While I can understand that AnyList (or any other app for that matter) would want to, on occasion, send marketing emails to users, I don't think any app would, in their right mind, _require_ the user to provide a 2nd email address. But by allowing them to optionally give that 2nd address, they can provide a path forwards with people being able to use Sign In With Apple (of course, that means some users may opt out of marketing emails entirely by refusing to provide a 2nd address). This does probably go against the spirit of the feature, but if it actually is against Apple's rules to be doing this (anyone know the answer to this?), then it would definitely veer on the side of user hostility on Apple's part, since I would expect many apps to be taking a stance similar to the one taken by AnyList here.
• Angostura 6y ago
  > One problem is that most Apple IDs are tied to an iCloud email address. Is that actually true? None in my household are.
  • withinboredom 6y ago
    It depends mostly on the demographic in my experience. For example, my parents have icloud email addresses that they occasionally email me from and never reply to for the reasons mentioned in this post.
    • ThePowerOfFuet 6y ago
      Then switch off the Mail option in iCloud settings on their devices. Poof, mailbox disappears.
    • scarface74 6y ago
      My anecdote is similar. I first created my Apple account when the iTunes music store was introduced in 2003. But, when I setup the account for my mom and my wife, I just created an iCloud email address. My wife never uses her iCloud email address. I don’t think she uses the default mail client - she uses the gmail app.
• rorykoehler 6y ago
  I’ve got a new sign in flow I’ll be using for all my indie apps. It solves 2 problems I have with Apple. 1) no PWA support for notifications 2) forcing stuff like this on everyone I use a telegram chat bot. After signing up via the bot that sends you a link to set your password, you then also request a short expiry sign in link everytime you wish to sign in. The chatbot doubles as a notifications channel. I’m thinking of enhancing notifications do you can interact with them directly from the chatbot interface too. The signin flow is great as it has 2fa built in by default.
  • sharp11 6y ago
    Could you elaborate? Doesn’t this require users to have telegram installed?
    • rorykoehler 6y ago
      Yes. I’ll probably add more chat platforms as I go so you can use whatever one you already have installed
  • kergonath 6y ago
    I am pretty sure I would never create an account on a website that wants me to chat with a bot on Telegram. This sounds particularly user-hostile.
    • rorykoehler 6y ago
      Why is it user hostile? Maybe you're misunderstanding what it is but for signup it's just a wizard and for login it sends you a link. Pretty seamless experience. To signup you click a deeplink button into the chatbot follow some simple steps and then get logged into the app. Otherwise the notifications work just the same as you're used to except it leverages the chat platform instead of the developer hostile native platform.
      • kergonath 6y ago
        Sorry, hostile was probably too much. I understand after having read the explanation. However, my experience with chatbots is that they are unreliable, unhelpful and obnoxious, and I tend to go out of my way to avoid using them. I don't think a conversation is a right model for this. I also don't think it looks good when a website or app wants me to install a messaging app to create an account (though of course some people already use Telegram). It would have to be very enticing for me to overcome that friction. The platform (Apple's, in this case) might be hostile to developers to some extent, but the whole web is hostile to users, in no small part thanks to websites slurping as much PI as possible and then leaking it one way or another. I get spam and phishing attempts every day, as do all of us, and I regularly see some of my burner emails show up on haveibeenpwned. Any service that helps me separate my accounts from me is some progress.
• lowmemcpu 6y ago
  > One problem is that most Apple IDs are tied to an iCloud email address. So most accounts created via Sign in with Apple will use an iCloud email address. But many of those iCloud email addresses are unused and unchecked, because a customer’s “real” email account is their Gmail, Yahoo, or Hotmail account. Wow, this is a really good point. I just checked and yup -- my AppleID is directly linked to my icloud email, and I've never once checked my icloud email account. I wonder what's in there. Meh, too lazy to go check it
  • mns 6y ago
    This seems strange to me. My iCloud account is my Gmail address (even though I also have an iCloud one on the account) and when I use Sign in with Apple I get an option to redirect all emails to Gmail. But the system is indeed weird, I signed up for an account in an app with bike routes and wanted later to check it in the browser and had no idea what or how to find out what my account is or how should I sign in (could be also the app/website didn't implement this properly).
    • tzs 6y ago
      Things may differ from person to person depending on when they created their Apple account(s). At first, before they had cloud services, you created an Apple account to purchase things from the iTunes store. You could use any email address. Then they created MobileMe (which was rebranded to .Mac), and that came with an email address @mac.com. (I believe there were a couple of other domains you could choose instead, but don't remember what they were). That was eventually discontinued, replaced with iCloud, and .Mac accounts were migrated. Somewhere in all there Apple loosened requirements so that you could use an outside email address as your cloud ID, and made it so a cloud account could could also work as an iTunes account. For those who created their accounts after that point, it's all sane. Create your Apple account using your outside email address if you want, or using an Apple provided address if you prefer, and then that one account can be used for all your Apple stuff. Buying music, buying or renting video, buying apps, and the cloud stuff. For those of us who created our accounts before all that, we ended up with an account using our outside address which has our music, video, and app purchases on it, and an account using our @mac.com address that has calendars, photos, and the like. When they changed it so all Apple accounts could be used for everything, it got even more annoying for us. Whenever we'd see some dialog asking us to sign in to our Apple account, we'd have to guess if it wanted our music/video/app account or our cloud account. If we guessed wrong, we could end up accidentally purchasing apps or media on the cloud account. Apple does not provide any way to transfer purchases between your accounts, so if you end up with media or app purchases on both accounts there is no way to consolidate other than purchasing duplicates. If you are willing to do that, or if you have avoided duplicate purchases, you can kind of manually consolidate accounts. You can export calendars, contacts, and the like from your original cloud account, and import them into your original iTunes account. Same for photos, online disk space, and anything else you have on the original cloud account. Once you've got it all in the original iTunes account, delete everything from the original cloud account, and then just make sure to never again sign into that account. Any time you see the Apple account login dialog, give the original iTunes account.
• AshamedCaptain 6y ago
  I found it jarring that Apple would present themselves as the vanguard defenders of privacy by announcing what is basically an email relay service. Most privacy-conscious people wouldn't exactly think of their emails going through Apple as any particular win in privacy. And even for the "general user" I find the argument very weak, since it doesn't look as being any easier than using any other email relay, and there is a huge obvious conflict of interest for Apple here (they get data they may not have had otherwise PLUS have yet another tool to bind you to their services). It reminds me of the days where everyone in the www was making OpenID providers but no one was actually willing to do an actual OpenID _consumer_. So that I could actually use _my_ identity provider on a server of _my_ choice instead of going through the hoops of yet another large company for no reason.
  • WiseWeasel 6y ago
    How is it anything but a win to have an additional easy option to use a more trusted relay rather than not? Many people have never heard of a relay, and wouldn’t understand its benefit if the option wasn’t presented to them like this.
• TheArcane 6y ago
  > Another issue is Sign in with Apple’s “Hide My Email” feature. With this feature, if you create an account with us, Apple will generate a special email address just for that account. So rather than your email address being john.doe@icloud.com, we will see your email address as something like dpdcnf87nu@privaterelay.appleid.com. Ironically, this is also why I use Sign Up with Apple at every opportunity I can
  • renewiltord 6y ago
    How is this ironic? It is by design and obviously they know why people do it because the very next sentence says that. Why on Earth would you'd want to use a list-sharing app that uses email as the addressing system and then not share your email.
    • swagonomixxx 6y ago
      The anonymous e-mail that Sign-In with Apple generates forwards to the e-mail used to set up your Apple ID. So it's not like it's a random e-mail that acts as a /dev/null. This is by far the biggest selling point of Sign-In with Apple for me and I will continue to use it, and continue to not use apps that don't support it. I have plenty of e-mail aliases, but having an alias auto-generated for you is very convenient, and not having to generate a secure password is also very convenient. The day AnyList gets hacked (not saying it will - but it's highly likely, the way security has taken a backseat due to "features") then at least my personal e-mail and password won't be there for every hacker on Earth to see and try to spam passwords to get into all of my other accounts.
      • ajhurliman 6y ago
        Small nit: Potential hackers would only have access to your email, provider id and whatever other details they pass along (preferred name, profile picture URL, etc.). Social login doesn't provide consumers (AnyList in this case) with your password.
        • 6y ago
• zaroth 6y ago
  In my experience the “Sign on with Apple“ option makes it totally risk free to click and I don’t even think twice before clicking to create an account whereas a typical registration page will definitely raise the possibility of me bouncing. Sign-in With Apple is perfect for those accounts that you basically never wanted to have anyway. If it’s something where I want a “real” login, especially one that I might want to share, then I’ll go through the trouble of actually registering and picking a shared secret that my wife and I know. But for the average app that needs a way to keep a user profile for me, it’s just right, and from a UI perspective on iPhone it really is magic. Two taps and I’m just in with zero mental baggage and an email relay to eliminate the possibility of spam.
• olliej 6y ago
  Um, it doesn’t forward to their iCloud email address, it forwards to the email they use for their iCloud login - eg the primary gmail or whatever address. Users have the option to provide their personal email address, but given the track record of these being sold it’s reasonable to expect users to not trust you. You can email them correspondence because as above that goes to their primary email. What you lose is the value of the email address as an asset.
• scarface74 6y ago
  Your iCloud account does not have to be paired with an iCloud email address. Mine is paired with my regular email address.
  • snazz 6y ago
    Yes, but many are. This app in particular needs an email address that is actually checked.
    • scarface74 6y ago
      From what others have said, they also need it to add to their marketing list....
• forrestthewoods 6y ago
  > Furthermore, if there are platforms where AnyList doesn’t support Sign in with Apple, like Android, and someone wants to log into their account, they’d have to know their privaterelay.appleid.com email address. (And that certainly won’t be easy to find if you no longer have an iOS device.) And then they’d have to create a password with us, since they wouldn’t be able to sign in using Sign in with Apple. I’m an avid iOS user with a Windows desktop. I will never use “Sign-In with Apple” for this reason. It’s not useable unless you exclusively use Apple devices. Which I don’t.
  • WorldMaker 6y ago
    Sign-In with Apple is a (mostly) standard OpenID Connect provider that works everywhere (and works just like sign in with FB, Google, et al from a technical implementation), including the Web and Android. It's an interesting miscommunication or misunderstanding (and I was not surprised to see it in this article) that applications and developers think the "Sign in with Apple" button should only show up on Apple devices. It should show up on the web and in Android apps, Apple only requires it on Apple devices because that's the only devices that they control. I wish Apple communicated that better and/or developers better understood that Sign in with Apple really is a FB/Google/social login button like all of the others and should be supported everywhere, not just Apple devices. (I'm in the iOS/Windows dual mode user team myself these days and find that I trust Sign-In with Apple, but I've definitely had to already email developers to request that they add the Sign-In with Apple button to websites and explain why they would/should.)
    • tech-historian 6y ago
      If you read the article, you'd see they address the reason they cannot implement it on Android yet. Apple hasn't provided documentation for it. Apple doesn't seem to be taking it seriously.
      • WorldMaker 6y ago
        To keep my reply in a single place: https://news.ycombinator.com/item?id=23684452 https://news.ycombinator.com/item?id=23684452
• SergeAx 6y ago
  Side note: there's (almost) no problem implementing Apple sign in on Android. It is basically the same OAuth flow as Facebook or Twitter, with couple of minor quirks.
• deleted 6y ago
  [deleted]
• floatingatoll 6y ago
  Apple's developer docs on the Private Email Relay Service are relevant to those evaluating the technicals of AnyList's position. Three specific highlights from that doc are relevant when considering AnyList's objections: https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/communicating_using_the_private_email_relay_service https://developer.apple.com/documentation/sign_in_with_apple... After the user has shared a private relay email address with your app, they can find, view, and manage it in their account settings at Settings > Apple ID > Password & Security > Apps Using Your Apple ID. The relay server transforms your email address so it’s readable to the user. For example, sales@xyz.com may become sales_at_xyz_com_<something>@privaterelay.appleid.com instead of a random email address. Replies from the user are still routed back through the service to preserve the user’s privacy. To send emails to users with private email addresses, you must register your outbound emails or email domains and use Sender Policy Framework (SPF) to authenticate your outbound emails.
• WorldMaker 6y ago
  > Furthermore, if there are platforms where AnyList doesn’t support Sign in with Apple, like Android, and someone wants to log into their account, they’d have to know their privaterelay.appleid.com email address. (And that certainly won’t be easy to find if you no longer have an iOS device.) And then they’d have to create a password with us, since they wouldn’t be able to sign in using Sign in with Apple. The easy answer is: they should just support "Sign in with Apple" on every platform. (That absolutely works. Sign in with Apple is a [mostly] standard OpenID Connect provider and has a web frontend that should work on every non-Apple platform just fine, just like FB/Google/etc.) You wouldn't think to only support "Sign in with Google" only on Android devices? Maybe "Sign in with Facebook" should only apply to web browsers? It's an interesting misconception or miscommunication that so many developers think "Sign in with Apple" should only show up on Apple devices.
  • tech-historian 6y ago
    Sure, except there is no documentation for it. From the article: "For example, Apple vaguely states that you can implement Sign in with Apple on Android, but there is no direct documentation on how to do it. We understand that Apple probably doesn’t care much for Android, but if they are going to provide a login system, and are going to force developers of multi-platform apps to adopt it, then providing no real support for a major platform that these multi-platform apps run on is not acceptable."
    • WorldMaker 6y ago
      Apple has provided documentation, it seems like the article describes a lack of attempt at trying? On the Getting Started [1] page it lists three options: Apple platforms [use AuthenticationServices], Unity [use the asset from the Unity Asset Store], and "Web and Other Platforms" [use Apple JS/REST]. That "Web and Other Platforms" link provides a wealth of useful documentation [2]. Tbf, the exact word "Android" is missing, but this is an elementary school-level process of elimination that maybe Android is inferred in the words "other platforms". [1] https://developer.apple.com/sign-in-with-apple/get-started/ https://developer.apple.com/sign-in-with-apple/get-started/ [2] https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js https://developer.apple.com/documentation/sign_in_with_apple...
• thealistra 6y ago
  For me it sounds like they didn’t like the additional work Apple made them do, that would actually benefit the end user - I love sign in with apple, the best part is the unified workflow without typing on a phone. I dream of a world when I won’t have to type passwords on a phone anymore.
  • tech-historian 6y ago
    Their blog post is well written and explains point by point why implementing it would be problematic for them AND for end users. Strange that you arrived at the conclusion "they didn’t like the additional work Apple made them do"
    • thealistra 6y ago
      They describe and edge case of someone not getting the email or wanting to login on another platform. I’m talking about the most common happy path that they don’t want to optimize - the user registration/login I hate typing a secure password on a phone and I want to evade this process whenever possible. Using Sign in with Apple you don’t have to type a thing and you confirm using FaceId. It seems like the problems they were facing require different UX solutions than they already had or some bug reports to Apple (if the feature is really missing something). For me it is much better to use Sign in with Apple as the user as the flow is simple, unified and Apple has a track record of caring about privacy, where it is often not the case for randomservice.io
• gramakri 6y ago
  Not an Apple use but I had a question. If one signs up with Signin with Apple, how can that user move over his stuff to say an Android app? Or even Desktop app? (Or does the Apple ID keep track of all this anonymous id to app mapping?)
  • faet 6y ago
    You still have your apple account on your PC/Android phone/etc. You just login on apple's website with your apple account and it passes the token/id to whatever app needs it. For example you can goto dropbox on your pc/whatever and click signin with apple to see how it works.
• artichikin 6y ago
  Last year we pulled all social logins (facebook, google, yahoo) out of our app, after supporting them for years. The UX / customer service issues mentioned in this post are absolutely legit, a complete PITA. While we were nervous about adding the extra signup friction, a year later I can easily say it was worth doing.
• temporarysdwvit 6y ago
  Why do you need to log in in this app? All the problems indicate that app is used on one device only
• vmception 6y ago
  so all of this could be fixed by AnyList just asking the user to type in their email address instead of tying it to a data mining operation from their login name well at least they are honest!
• persona 6y ago
  This seems to be a common problem, made more visible when using third-party authentication, that your application has taken the concepts of "Account" and "Authentication Method" as if they were the same thing. It appears that the "account ID", "preferred contact method+address" and "authentication ID" are all the same here - which then creates the "account management code into a rat’s nest" scenario they describe in the post. If an Account is, by design, it's own entity - you should be able to have 100 different authentication methods linked to that same account without impacting any other flow or part of the application. Turn on and off authentication methods would also allow for seamless transition for users, without worrying about when one method is about to be killed.
  • dukoid 6y ago
    +1 Any authentication method that I have enabled for my email should work -- there shouldn't be a need to remember which one is associated with a particular service...
  • dahfizz 6y ago
    I feel like they address this in the article. What you say makes sense in a technical UML diagram point of view, but that's not how people work. The examples they give are getting support and sharing things with another person with an account. As a user, both of those things are easier for me if there is an email associated with the account. Said another way, the Account needs some human friendly global identifier. The email you use to log in is an obvious choice, and anything else would require extra work from the user to set up. You could have usernames, for example, but that complicates the signup process and still makes sharing things hard. I know my friends emails already, but I don't know what username they ended up with on this site.
    • persona 6y ago
      I'd argue that this makes more sense in the real world than in a diagram, after being burnt in multiple real life experiences :) The assumption both you and AnyList are making is that an email is "THE obvious choice". From a user experience perspective perhaps this "global sharing identifier" should be defined by them. You'll notice that different generations have different online behaviors. For some, email is their main id. For others, it's their phone number (they don't know most of their friends' e-mail, but know their phone). For others, it's either online handles or nothing at all - think about the device set up for grandma with her daily To Do list. Of course, having this approach would add some upfront dev work to them but allow them to navigate this much easier later on. And for anyone starting to develop their new app/site/product thinking about this early on can reduce a lot of future headaches.
• fiddlerwoaroof 6y ago
  It’s pretty user-hostile to refuse to support the authentication provider the user wants to use. If I’m already in the Apple ecosystem, using Sign In with Apple, a service that doesn’t implement Sign In with Apple but could is preventing me from doing what I want, just as much as Walmart not accepting Apple Pay.
• danpalmer 6y ago
  Another issue with Sign in with Apple is the fact that their private relay has a pre-set allow-list per app for sending email to relay addresses. This means that you must either prove ownership of domains, or pre-add email addresses to Apple's systems. I understand why they have done this, it will reduce spam considerably, but the private relay system is already designed to empower users to do this and this extra step may be impossible for some developers. Take for example a retailer – they need to dispatch goods and use different carriers in different countries. When the user buys something they very likely want email notifications about delivery, a feature that most carriers provide. For the carriers to send those notification emails you'll need to pre-add them all to Apple's systems. You can't prove domain ownership because fedex.com isn't your domain, but where are those emails going to come from? Better hope your carrier doesn't change sending address at some point or the email goes into a black hole. Apple also limits the number of domains and addresses you can send from. In the original documentation it was "10 domains and addresses" (not sure if 10 of each, or 10 total). This was raised to 100 I believe, but that's still probably an issue for larger multi-national companies, or those who necessarily have to integrate with many external services. The really hard-line privacy stance is that the retailer shouldn't share the emails and should do the notifications themselves, but for many this is prohibitively difficult to do, or at least detracts from places where the retailer can actually add value. The benefits are also very small, as the contracts with carriers typically protect user data, require deletion quickly after delivery, and retain most privacy benefits while allowing for a good UX.
  • rossjudson 6y ago
    That's a good point, but I'd be surprised if Apple doesn't have (or is building) a mechanism to allow certain well-known domains to be trusted sender, in the circumstances you note. Like, have "enter your custom domain", but also "checkboxes for fedex.com, etc".
• afro88 6y ago
  Makes sense to support it and respect users privacy. If they forget their login, they can just sign in with apple again? And if they contact you for support they can provide their email address to you then.
• ccktlmazeltov 6y ago
  I find Apple's Sign in approach shady (forcing apps to have it, and have it first on the list), but this response is also about not liking the privacy features of Apple Sign in so... I wouldn't read much into it.
• ocdtrekkie 6y ago
  I mean, if this is pushing them to remove Facebook login, Sign in with Apple and the resulting requirement to use it has been a net positive for privacy for AnyList as well.
• crazygringo 6y ago
  As they point out at the very bottom, all their arguments apply to all third-party sign-ons, so they're removing Facebook as well. So there's nothing specifically against Apple, despite the title seeming to imply it -- just that they're taking the move right now because of Apple's new policy coming into effect. I've got to say, I really wish there were a way to know whether I already used Facebook, Google, or Apple to log into a site or app before. My password manager is usually pretty good at letting me know if I've got a "normal" account with user/password, but it doesn't do anything to remind me if I ought to log in with one of the other services. Every time I'm occasionally asked to sign into Spotify, Pinterest, Medium, Quora, etc. -- it's like, I'm pretty sure I've signed up with something before, but who even knows which one, or multiple? If password managers could start saving that you've got accounts associated with Apple/Facebook/Google and highlight the relevant button on sign-in, it would be a big feature improvement.
  • TheSpiceIsLife 6y ago
    This happened to me recently where, in a hurry and distracted, I logged in with one or another third party auth service then realised that wasn’t the correct login as it displayed a new account.
  • jborichevskiy 6y ago
    Yes! Especially once you start juggling multiple accounts for different companies and projects. Becomes a guessing game, and each wrong guess creates another account magically. Infuriating
    • warent 6y ago
      Time to create a new service to unify all your SSO accounts! One single SSO!
      • jmull 6y ago
        Here comes SSSO! I can hardly wait! Of course, there may be competing SSSO solutions...
• kerkeslager 6y ago
  Given all these third-party sign-ins are a fairly transparent grab for power by the central company, I'm not sure why anyone would implement any of them. By doing that you're giving up power over your sign-in process, which is a pretty enormous concession.
• jeffrogers 6y ago
  I dunno. There are simple solutions to the issues raised in the blog post, many good ones here in the comments. Seems likely they wanted to get rid of third party logins and oddly chose to throw it on Apple. And I’m not sure anyone, including Apple, cares if they adopt Sign In with Apple. In the end, I think everyone just wants to end creepy sign-in practices. Facebook login deleted from Anylist... that’s a win for everyone.
• Reason077 6y ago
  > "One problem is that most Apple IDs are tied to an iCloud email address." Is this really true? I've had Apple IDs for pretty much as long as they've existed, but I've never had an iCloud email. Any email address can be an Apple ID. (...in fact, early on, it didn't even have to be an email address. I still have one of those old-style Apple IDs.)
• asasidh 6y ago
  This is a war between apps and platforms on who gets direct access to customers.
• jonplackett 6y ago
  What a well written and forceful argument.
• dred_prte_rbrts 6y ago
  Is it just me or do these sites not realize that "We will never sell your email" does nothing for me? It's not that you'll sell it's that you will get hacked or lose a laptop or have an admin email everyone and then I will get spam. How do others at HN deal with this (disposable emails and prefix/suffix are a huge pain)
• mikece 6y ago
  The larger problem is trying to get the average Facebook and Instagram user to care about security (if they cared about those things they wouldn’t be on a Facebook product but I digress). I applaud Apple’s intentions but as this article proves, if the user isn’t driving the push to be more private then initiatives like Sign In With Apple cause little more than support headaches.
• rickyc091 6y ago
  If you disable your account through Apple's website the email is no longer valid. Does anyone know if they recycle the emails?
• huslage 6y ago
  Some of this can be solved by asking a user for their email when they open a support ticket. Also allowing them to link accounts from multiple login providers. These are largely "solved" issues.
• m3kw9 6y ago
  The convenience and supposed privacy of signing in with Apple ID out weights the cons. People will still have problem remembering which email they used down the road.
• musicale 6y ago
  Well, that's another app I won't be using.
• surround 6y ago
  What about vendor lock-in? Apple forced many apps on the App Store to use Sign In with Apple for increased “convenience” but it also makes it very inconvenient for people to switch to Android.
  • dangoor 6y ago
    Sign In with Apple works a lot like Sign In with Google or Facebook. There's no reason it can't be used on Android also. https://github.com/willowtreeapps/sign-in-with-apple-button-android https://github.com/willowtreeapps/sign-in-with-apple-button-...
  • scarlac 6y ago
    Yes, that's mentioned in the article: > if there are platforms where AnyList doesn’t support Sign in with Apple, like Android, and someone wants to log into their account, they’d have to know their privaterelay.appleid.com email address.
• fulldecent2 6y ago
  I usually uninstall apps with a 1-star review if they provide zero functionality until you provide your email address. Apps and devices serve me, not the other way around.
  • t0astbread 6y ago
    So you don't use social media on your phone?
• njsubedi 6y ago
  In a rat-race of adding a bunch of (Sign in with xyz) buttons everywhere in the login forms, this news feels good in a weird way. Most developers use OAuth login support using several other services to reduce the friction of signing up, but this article made me think about this for a while. I've been in a situation where I could not remember whether I signed up using a provider. Password managers and 2FA options are getting popular in the mainstream media, and most people know about it after their financial service providers are mandating 2FA. It's probably time we figure out an easy way for users to sign in using a random alias of their email address to sign in to any service. Something that is generated using their real email address, the service provider's domain name and some kind of salting. This is the time the plain old username-password login came back.
• jbarches 6y ago
  Recently went through the same debacle. Our hope was that we could solely rely on Magic Link instead of email/password ... but it turns out many users don't really understand it [1]. So your options are: 1) Email/Password Sign In 2) Bite the bullet and add Apple / the "full auth stack" (FB/Google/etc.) & deal with account linking issues. [1] https://snaphabit.app/blog/password-less-login/ https://snaphabit.app/blog/password-less-login/
• alister 6y ago
  > Apple reserves the right to disable Sign in with Apple on a website or app for any reason at any time. Holy cow, how is this acceptable to any app developer or software company? This is reason enough for me to never use Apple/Facebook/Google sign-on as a developer -- huh, or even as a user. Apple/Facebook/Google could lock out all your users and literally destroy your business in a split second for an arbitrary policy violation, without explaining why, with no way to contact a human being. Haven't we seen enough HN headlines where an independent developer or a small software company is begging for help because <LargeCorporation> canceled their account or locked them out of something with no recourse? EDIT: I know that AnyList is dependent on Apple's app store. This is still no reason to give Apple (or Google or Facebook) even more power over you.
  • ramraj07 6y ago
    This seems like the only bummer rule of all. I really would like to use this service on my next project but this dictator rule cannot be tolerated.
  • nexuist 6y ago
    You know the reason. It's on the front page of HN today even. Apple will support Sign in with Apple until it is co-opted by "white nationalists" or other scary characters, at which point they will disassociate with that website or app and prevent their services from working with them. Which is their right of course, but at the end of the day it means we get changes like these in the fine print. Gatekeepers like Apple and Google gain more control over what is allowed on their platforms, and subsequently what is allowed for the majority of the population to see.
    • TazeTSchnitzel 6y ago
      Why have you put that term in scare-quotes?
  • TazeTSchnitzel 6y ago
    It's not like other popular login systems can't also arbitrarily terminate your account, but the really problematic thing here is “Sign in with Apple”'s email hiding, which removes the lifeline of emailing your customers when you lose your sign-in provider.
• AnonC 6y ago
  The only authentic point I saw in this entire article was the one about the lack of documentation by Apple in implementing this across different platforms. Everything else applies to logging in with Facebook (or can be dealt with in other ways), which the company has supported for years and is now forced to remove it because of Apple’s restrictions. Without Sign In with Apple, I doubt if they would’ve chosen to remove the Facebook login anytime soon, thus putting more users into privacy hell holes despite making statements like this: “At AnyList, we respect your privacy. ... When you provide us with your email address, it is never sold, shared, or used to invade your privacy.” If the documentation had been good enough, I’m sure they would’ve implemented it and also retained Facebook login for a longer time. Seeing Facebook login being removed gives me some comfort and a sense of “all’s well that ends well”.
• deleted 6y ago
  [deleted]
• ascotan 6y ago
  Love it. I hate it when I'm presented with a "sign in with Google". I feel pressured to have a Gmail account or a Facebook account (which I honestly don't want). I get the fact that login is broken across the web and there is no centralized login authority, but sorry Google/Facebook are not it imho. We can/should look at other ways to authenticate, but thats a larger discussion.
• Razengan 6y ago
  I had never heard of AnyList and this makes sure I will never use them. Before Sign in with Apple, I uninstalled most apps that required me to sign up before I could even try them at all. Now I specifically look for apps that support it. I don't want to give my email to 100 different companies (I get spam on the aliases that I did hand out long ago to apps that aren't even around anymore). Though, all these hitherto obscure companies jumping into the spotlight just by setting themselves up as the underdog against the Apple world tree gives me an idea of what to do when I want a quick boost in popularity.. :)
• dcow 6y ago
  I'd like to see Apple allow users to use "Sign in with Apple" to maintain Apple ID account and purchase hardware/software? Imagine if they had to go through what they're asking all the services on their platform to go through... yeah... never gonna happen. Bravo AnyList for calling Apple out for pushing immature software ecosystem harmful software agenda.
• Orlan 6y ago
  All of them good points. I'll add another wrinkle; for some reasons I can barely remember, I have 2 different Apple IDs. I was a paid .Mac user when it was a thing, but I also had a different account to make iTunes purchases back in the day. Currently I need to log in with both in my devices; one of them is used for purchasing in iTunes/App Store, the other one is used for iCloud Photos/iCloud Drive. However you can also make purchases in the Books app (which I use it to sync PDFs), so this always trips me up. There's no way to merge two Apple IDs, and setting up a new device is always an adventure. Knowing when to use which Apple ID can be confusing (don't get me started on 2FA, I'm afraid that having 2 Apple IDs will eventually lead to me getting locked out!). I liked the concept of Sign in with Apple when I first heard about it, but at this point it might be too confusing (I also never check my "main" Apple ID email).
• mssio 6y ago
  Developer should just ask for user's email after new sign up using third party provider. Even Facebook does not require email for user to sign up. They should separate the email used for the account & the email used for third party sign in. Because 1 user can have multiple third party sign in, all with different email. I think they did not need to care about customer who did not check the reply email from support, because customer can also have multiple email and did not use their primary email to sign up to your service.
  • esperent 6y ago
    What's to stop someone signing up with a fake email and sharing it on a forum so that many people can sign in with it? Yes, I know that there are ways to reduce this by scanning IPs and so on, but by using third party auth you offload that onto the auth providers.
• NorwegianDude 6y ago
  I seriously hope I'll see the day when OpenID takes off. It doesn't seem to be going the right way, but it would solve most of our login problems. One way to sign in, used everywhere, decentralized, set up 2FA for everything in one place, switch providers with ease or be your own provider. Apple could promote a decentralized solution instead of forcing the sign in with apple shit on people, but clearly they want all your data so they can lock you in.
• ianamartin 6y ago
  Apple having a major flaw is a pretty bad mark against this. But in my experience, companies doing it themselves are far worse. The correct response to "Yo, they fucked up." is not "Oh screw it. We'll just do it ourselves."
• Mave83 6y ago
  Why not just bind the sso Mail to an local Account, then it doesn't matter what identity Provider gets used by the customer. In addition, add a check that prevents Account creation of ...@privacyrelay...if you have a problem with it or nag the user to provide a real mail for this account if you detect this type of mail. This way you would have a user friendly implementation without giving up on sso.
• deleted 6y ago
  [deleted]
• camillomiller 6y ago
  Well, though titty. Honestly, as a user, I don’t give a damn about the pains this can cause to developers. The amount of spam and unsolicited email crap this is gonna save me from is worth it 100% for the users. And as a developer, I honestly think that Third party sign ins are lazy solutions that empower data-hungry companies way more than they deserve. If your business model relies on people giving you their data or reselling their email or using it for unsolicited purposes (these are the only reasons you would be affected financially by a privacy-driven solution like SIWA) then your business model is bullshit. Suck it up. EDIT: I really love the downvotes from developers that are perfectly aware this is how the things are.
• HenryBemis 6y ago
  > your email address, it is never sold, shared, or used to invade your privacy. This is ambiguous. "..to invade your privacy". They should have stopped at "sold, shared. The "to invade your privacy" is a bit doublespeak. One can say "we do not invade privacy, we merely inform of new products and services (aka marketing). I know I am being pedantic, but hey.. it doesn't write "never" it writes "never for A".. we never wrote "never for B", so B is allowed by our T&C (which I haven't read so I may stand corrected).
• qwerty456127 6y ago
  There are 3 major problems with this kind of sign-in from the user perspective they apparently omit: whenever you sign-up for a service B with an account at A (usually Google, probably applies to Apple, Facebook and the rest as well) 1. A will block your account at B at any time as soon as its (A's) algorithms realize they don't like you for some stupid reason they won't even tell you (which is icky but understandable given how many users they serve) 2. A tracks your usage of B (obviously). 3. The most overlooked - A discloses many additional details about you (like your contacts, your location, your birth date, your real name etc.) to B. Sign up to some shitty website once and they immediately have enough data on you to apply a wide range of social engineering / identity theft attacks with ease. I actually can consciously accept the 2 in many specific cases but 1 and 3, each alone, are enough for me to avoid using this kind of sign-in.
  • lrem 6y ago
    Why is 2 so obvious? I imagine many implementations would do that, but basically once you exchange your SSO token for the site-specific token, you could stop making any requests to the SSO provider. The only part of your SSO provider's offering that inherently needs to track you is running detection if you're a bot.
• ludditetech 6y ago
  Well opined piece, as a customer of Anylist for over 3 years you have my full support in this decision.
• axilmar 6y ago
  I wonder why we still have passwords. Couldn't we have a simple USB device that is encrypted, cooperates with the native O/S in an encrypted manner, and then allows remote login to sites also in an encrypted manner? The device could be programmed to automatically generate new passwords/keys/whatever needed for remote authentication. It would also have a 'disable' functionality that would render it useless if stolen. (Perhaps this thing already exists. I am too lazy to google it as I type this :-)).
• GoblinSlayer 6y ago
  Identifying users by email is a bad practice anyway. Such systems usually don't provide a way to change the email address, because it's literally your id. This makes it unnecessarily difficult to migrate between email addresses.
• ThePhysicist 6y ago
  We've implemented a bunch of third-party login solutions on our platform, but in retrospect I think it was not worth it for us. I think integrating third-party logins makes sense if you know that most of your target users come from a given platform or your application wants to interact with a specific platform (e.g. a Github integration). Otherwise the points the author makes seem painfully correct from our experience. Adding third-party sign-in immediately complicates the frontend as you need to support OAuth/OpenID-Connect workflows that are much more complicated than sending a password & e-mail combination (and possibly an OTP token) to a backend and reading the result. In addition, even though OAuth/OpenID-Connect are standardized it seems that almost every provider has decided to add its own quirks to it, so you can almost never just reuse the same code for integrating e.g. Github and Gitlab sign-ins. What we currently do is to always add an e-mail using the third-party provider and use that to allow a password reset or password creation. You have to be quite careful with this as well though unless you want to open new security isues. Incorrectly implemented sign-in workflows via third-party providers can open avenues for account takeovers if you implement e-mail validation or account reconciliation incorrectly (e.g. an adversary might register an account with the victim's e-mail on a third-party platform and try to use that to sign into the victim's account; if the sign-in flow is configured incorrectly [happens a lot] the system will recognize the e-mail and sign the attacker into the victim's account). Also, don't trust any validated information from third-party providers (especially e-mail addresses), as this can provide another attack vector. Always do your own validation.
  • deleted 6y ago
    [deleted]
• mojuba 6y ago
  3rd party logins have the advantage that sharing content from within your app on those social platforms becomes less of a friction unfortunately - if that's what your app relies on. Email-only logins work fine with technical users, but non-technical ones absolutely suck at maintaining their logins and passwords. You lose users because they can't login for whatever stupid reason - one of the thousand stupid reasons - and they turn away to never come back, or they register afresh. This is the reality and yes, 3rd party auth is beneficial for popular (non-techie) services. As for Apple Sign-in, haven't tried it on the development side yet but I can imagine it reduces friction even further and makes the user experience even nicer. This may be such a big bonus for your service that you may ignore the fact that you can't always collect your users' real email addersses. Find other ways to communicate: in-app messaging for example. If the user deletes your app then retargeting via email won't help much anyway - they will mark you as spam and overall it will probably do more harm than good, I think.
• kolla 6y ago
  It's a grocery list app, how much customer support do they have to do!? Feels like they just really really want to have my email.
• mahnouel 6y ago
  Wouldn't their problem be solved by using usernames?! Usernames are easy to remember, share and setup.
• amelius 6y ago
  As a user, I won't be supporting them either. Just give me sign in without involvement of a third party.
• dorcassmith 6y ago
  Students find Finance Coursework Writing Services as being of great assistance since they are able to complete their finance essay writing services and finance research paper writing services on time. https://researchpapers247.com/finance-coursework-writing-services/ https://researchpapers247.com/finance-coursework-writing-ser...
• dorcassmith 6y ago
  Among other courses, business assignment writing help online has become popular since students seek Business Essay Writing Services and business case study writing services. https://researchpapers247.com/business-essay-writing-services-2/ https://researchpapers247.com/business-essay-writing-service...
• LockAndLol 6y ago
  How long till it becomes mandatory by Apple? I give it a year. Then they'll say "our users expect it, so now we do" and it won't matter if that's true or not.
• TheRealDunkirk 6y ago
  > We’re a small company that makes money when people like our app and pay for it. We do not make money with creepy tracking or by selling your information. When you provide us with your email address, it is never sold, shared, or used to invade your privacy. You're the only one, then. What's happening here is another revolution. Email spam got so bad, that Congress actually passed a law. Which, of course, did almost nothing. People got so tired of spam, that they avoided email, and allow the services to silently remove 90% of the crap. This has now spilled over into voice calls, where it got so bad, so quickly, actual legislation was considered again. But people quickly realized that their phone contained a curated whitelist. Now, I never answer unless the number is recognized, and I think most people are doing the same. Texting is also similarly whitelisted. At this point, email systems and clients need to start with the assumption of whitelisting. Instead of just a "spam" folder with obvious crap, and controls to flag or unflag messages in that folder, we also need a "questionable" folder, with controls to mark as "known" or "unknown", as well as "spam". Emails shouldn't make it to my inbox unless they pass BOTH the whitelist AND the spam check.
• onyva 6y ago
  >> Third-party login systems like Sign in with Apple cause many user experience and customer support headaches. It’s not. It’s perfectly slick , simple and powerful and even non technical user can use. Please enable.
• oramit 6y ago
  After reading the article and comments i'm honestly a bit baffled. Why is email address obfuscation an important component of online privacy? There are so many other more invasive and pernicious privacy concerns to worry about. It seems like we're spending an enormous amount of time to build far more complex authentication systems that are brittle and confusing just to avoid sharing an email address. Why? Email addresses are supposed to be semi-public. If I share it with you I want you to contact me. People do abuse this, of course, but the open nature of it is exactly its best quality. I can sign up for new services easily, they can contact me, and if they bother me I block them. I've had the same email address for almost 20 years now and have never had issues managing it. I cannot say the same for Facebook connect and Google Auth. I actively avoid signing up for services if I have to use a 3rd party auth service.
  • ric2b 6y ago
    An e-mail address is as close to a unique id of a user as you can get online. It makes cross-site/service tracking very easy.
• martini333 6y ago
  cry me a river
• neop1x 6y ago
  I support their decision. They shouldn't be dictating developers which SSO services to use or not. It's developer's app not Apple's.
• MintelIE 6y ago
  Heh marketing people and data brokers are MAD about Sign In With Apple.
• doggydogs94 6y ago
  AnyList does not like Sign In with Apple (and others), but they helping with the sign on jungle.