[polutropos]

According to the App Store review guidelines update posted today, Sign In with Apple will be required for any iOS app that implements a single-sign in button.

"Sign In with Apple will be available for beta testing this summer. It will be required as an option for users in apps that support third-party sign-in when it is commercially available later this year."

https://developer.apple.com/news/?id=06032019j

[mindgam3]

This is Apple sensing weakness and dropping a bomb right on facebook’s doorstep. And they sidestep the anticompetitive angle by arguing that instant anonymous sign on is simply a better UX, which it is.

Someone at Apple deserves a raise.

[notSupplied]

It is an incredibly bold move. Just as tech monopoly power comes under scrutiny--in Apple's case the AppStore--they wield said monopoly power...but for a seemingly good cause.

Quite the gambit.

[canes123456]

Lol, I doubt it. Apple is years late and sucks at doing the leg work of getting third parties to adopt its suck. Look at Apple Pay which was launched at the perfect time.

[macintux]

Apple Pay, the market leader?

https://www.similartech.com/compare/apple-pay-vs-google-pay

[canes123456]

Great 1% of online stores supports it. I am sure only a fraction of that traffic actually uses apple pay. You are comparing it to google pay that had a terrible UX and like four conflicting versions. They had to catch up to apple pay once it launched. Apple had the perfect product at the perfect time. They complete wasted the US chip switchover. They could have dominated retail purchases.

[consp]

Interesting site since neither Apply pay or Google pay is available in lots of the countries on that map.

(Data is mostly correct though)

[fastball]

Always fun to see a comment that doesn't age well the moment it's posted.

[kilo_bravo_3]

Practically any point-of-sale that supports NFC also supports Apple Pay. Adoption rates may vary by region but NFC penetration is very good where I live.

I have switched almost exclusively to Apple Pay, and frequent only one chain of gas station because they rolled out NFC at all of their pumps last year. After the introduction of chip readers gas pump mag stripe readers became the main vector for card skimming in my area and even with the security stickers all of the gas stations have been putting on their pumps I don't trust any mag reader anymore.

At locations that don't have an Apple Pay logo on their card readers, like my local movie theater, I have spied the NFC logo and given it a try and it works.

Except for Amazon, almost all of my online shopping is now done through Apple Pay. I have a shirt out for delivery today from a small retailer I had never heard of before that I purchased with one click and a fingerprint via Apple Pay.

It has not only changed how I buy things, but how I dress. Instead of my George Costanza wallet I only carry an ID and two cards in a slim front pocket wallet, relying on Apple Pay for almost everything and walking out of a store if they are cash-only or don't support chip/NFC.

Regardless of your chosen NFC platform, I recommend that everyone use it and shun points of sale that don't have it.

[dzhiurgis]

I think he meant Apple Pay on the web.

Personally I used it only once (although I am not in US market)

[oarsinsync]

Apple Pay has been my primary payment method since the day it launched in the UK.

Fortunately, most payment terminals in London already supported NFC payments thanks to NFC debit and credit cards long being prevalent here, and Apple Pay is just tokenised NFC payments.

Same is true of literally every iPhone owner I know, and usage simply increased as payment limits went from £20 to £30 to unlimited (unlimited on Apple Pay, but still limited to £30 on NFC cards or when using older payment terminals).

Plus I got to ditch my oyster card and just use weekly fare capping after a while too. Good times.

[jnaina]

I use Apple Pay for almost all my purchases in Singapore, where almost ~80% of merchant terminals support it. Recently, Singapore's train system started allowing Apple Pay payments at the turnstiles. Using the Apple Watch at the turnstiles without having to fumble for the stored value card is amazing.

[lathiat]

Frankly as a consumer I am happy about this.

Even the existing Sign In with Facebook is implemented terribly by many apps, e.g. requiring me to enter my password in app instead of calling out to the Facebook app like maybe 50 of apps support properly.

I think honestly this comes from apps that are built with cross platform frameworks but its still frustrating.

Further more it drives me crazy new apps (and websites) released this year focused on mobile (e.g. pay for fuel at a fuel station with your phone) and I can't even auto complete the credit card or name using the new keyboard extensions because they somehow labelled the forms in a way apple can't figure out.

[haswell]

I'm really curious to see if this impacts enterprise apps that are configured by an administrator to use an internal SSO provider, or if this only applies to apps that allow users to sign up.

For example, Slack can be (and is often) configured to use Okta or some other SSO provider. Does the Slack app have to implement some kind of support for Apple Sign In when such use cases are involved?

[omeid2]

Apple have always had excellent Enterprise support on iOS, including "private apps" and what not. There is no reason to believe the same exception wouldn't be extended to Enterprise Devices and Apps.

[DaiPlusPlus]

> Apple have always had excellent Enterprise support on iOS

Not for the first half of the iPhone’s life, I’d say.

[dfabulich]

Therefore, anyone offering Facebook/Google login will also have to accept Apple's anonymized forwarded email addresses, like [e-mail].

[sturgill]

But this explicitly doesn’t work as an SSO. How can I tie that back to the actual email address they would have used to create an account using their FB / Google account?

This sounds like a tremendous headache that I really don’t want to worry about. But Apple is looking to leverage their power in the app market to force me to implement a tool I may not be interested in as a merchant?

I despise being strong armed. I hope the EU crushes this.

[natch]

It’s the users who are being given power here over their own data. Yeah it’s tough but it’s been a long time coming.

[dionian]

I trust apple w/ my data way more than the EU

[toyg]

A non-sequitur if I ever saw one.

[cavisne]

It seems the email part is optional (ie you can choose to share your verified email with the company if you want).

The above scenario goes against what they are trying to achieve though

1) If you support SSO and email/password - then the email and password are still stored (and possibly not hashed and salted if the developer is incompetent) - so you are at risk of compromise if you reuse passwords 2) If you store the users actual email, you are putting them at risk of credential stuffing, as well as opening them up to tracking

The EU can always surprise, but I suspect they would actually like this because it addresses key risks to consumers of password reuse, credential stuffing, and tracking. Additionally it competes against their ideological targets, Facebook and Google.

[danielscrubs]

EU is not picking on FB and Google specifically. This mindset is toxic. They are picking on all monopolies for European customers and have been for a long time. Basically we believe the market is not healthy if there isn’t any competition.

[jkirsteins]

This is a bit rose tinted outlook. GDPR does not increase competition, the amount of regulation in EU and worker protections in place raise barriers for new competitors. France has laws that prohibit new movies from being put on Netflix in order to support local distributors etc.

Not saying what the EU does is goos or bad, but painting it as pro free market competition seems unfounded.

[addicted]

GDPR isn’t about addressing monopolies. It’s about addressing privacy and data ownership.

Every tech related legislation doesn’t and shouldn’t need to so,be every tech related problem. The EU has other, non GDPR related, mechanisms to handle monopoly issues.

[EGreg]

Presumably it’s always the same address every time they sign in. It is used for single sign on after all!

However, I wish email and sms would go away as a way to authenticate. Until it does I will be using [e-mail] so that my account can’t get transferred to someone else through socially engineering a tired rep.

[sturgill]

But someone who has already signed up via FB is going to click that button and then get angry when we can’t log them into their account.

I personally don’t use FB login. And I use `+merchant` to keep track of bad actors. But from a merchant perspective this will likely be a chore. And Apple has decided that we don’t get to decide if it’s worth it. We can’t disable FB login because we’ve supported it for a long time and a ton of accounts only have a FB-synced profile.

To be clear, it’s not the product I have issue with. It’s the draconian ultimatum that because we are in bed with FB we have to also get in bed with Apple Sign In.

They could have just built this into their form system. It already recommends my personal email / credit card / auto generated password. Why not prepopulate / suggest an Apple-generated email? Why force the merchant to implement another standard which breaks all other SSO integrations _by design_?

I don’t have answers to those questions. If this was a consumer feature embedded into their keyboard I’d be ecstatic. Strong arming merchants to implement and bear the full cost of confused consumers who can’t seem to login to their app _even when they click the Apple button_ is inexplicable (to me).

[ryandvm]

"+merchant" doesn't do squat to prevent bad actors from selling your email address. Anyone so inclined to sell your address would just strip off the postfix since they know it's unnecessary per the spec.

[bscphil]

One of the many advantages of using a hosted solution with your own domain is that you can receive email from arbitrary addresses in the same inbox. For example [e-mail] gets sent to my inbox at Fastmail. [e-mail] doesn't exist, so there's no way to get my "real" email address from what I give out to merchants. If I start getting spam on an address, whoops, you and everyone you sold my email to get sent to a black hole in the cloud.

[cbsks]

Per what spec? Having “a+b” deliver to address “a” is Gmail specific, as far as I know.

[CaptainMarvel]

If you email me without the +merchant postfix I gave you, your email will go into the trash without me even knowing you sent it.

[philwelch]

Apple's auth does allow you to use the canonical email address associated with your Apple ID rather than a one-off generated by Apple.

[tinus_hn]

You can’t, that’s the idea. What do you need it for?

[sturgill]

Because thousands of people already have an account tied to a specific email and are going to click the Apple button and get really mad when we can’t log them in.

[tinus_hn]

So then you ask them for their email address and password once and link the accounts together?

[sturgill]

And Apple Sign In helps this user, how?...

[LunaSea]

Sending invoices, GDPR exports, validating that a user contacting you is a certain account, etc.

[jeremyjh]

You send information to the apple address, that's what its for. You can still send it invoices or a magic link, the user gets it and clicks on it, nothing is changed in that regard. The difference is they can turn off that email address and never hear from you again if that is what they want.

[addicted]

Stuff sent to the fake email address will be forwarded to the user’s real email address, from what I understand. So you will still be able to communicate with them.

[ulfw]

How will this work if I use non-Apple products (and GOD BEWARE !) move from say an iPhone to an Android or an overpriced Macbook to a PC?

Once I chose to use Apple-Sign In will I be locked into the ecosystem? Will there be 'Apple-Sign In' for Android?

[alanh]

this is the same problem you get from any identity provider — what happens when you finally delete your facebook? — it's just more obvious with Apple. With a 97% satisfaction rate, most iPhone users don’t want to go anywhere else… but yes, if you want to stay free, you should always create credentials directly with any app or service you use, when possible.

That said, the concept of "Apple Sign-In" for Android and other platforms is an interesting one, not likely in the short term, but possible someday!

[gwright]

I'm speculating here, but Apple Sign-In for Android would work just fine if the sign-in process was based on an OAuth flow where the credentials are entered into a web form. From the limited details I've seen that sounds like how Apple Sign In will work.

A service supporting alternate identity providers via OAuth (Facebook, Twitter, Google, Github) via a flow like this shouldn't have trouble with Apple Sign In from a web page, iOS app, or Android app.

[jaakl]

It is not about deleting accounts or moving over. Heavy user has multi-device setup, I use Android tablet, iPhone, Mac and sometimes PC, some appliances like Synology with bundled apps also. Nowdays even my printer has online sign in, for file sharing apps. I expect same account to work everywhere. If they provide reasonable platform-independent email solution, it may work.

[swish_bob]

Yes, but while I can choose to log in with facebook, or google, or whatever, it appears that Apple are mandating that app providers use the Apple sign-in, which means app users no longer get to choose.

Unless I'm misunderstanding what the mandatory part is.

[oarsinsync]

They are mandating that if you offer any other authentication provider (e.g. Facebook, Google, etc), that you have to offer Apple sign-in as an option as well.

The option is mandatory. End users using it is optional.

[swish_bob]

If the policy is "if you offer one or more authentication providers, you must include Apple sign-in", while it's still a little harsh, I think it's much more defendable and reasonable.

[aaronbrager]

It’s a standard SSO flow with JWT token and a REST API. Any website or Android app can add it.

[toyg]

I expect the disposable email will end up in Keychain, and you can export from there. Not the most user-friendly thing, but doable. Well, at least on a Mac.

[icebraining]

Sites should allow you to add extra authentication methods; if they don't, that's not Apple's fault.

[timdorr]

How will this work for apps that depend on the third party for more than just identity? For instance, does an app built on Spotify's API have to include a Sign in with Apple option? Or something like CI2Go, which is an app for CircleCI, which only offers log in via GitHub or Bitbucket.

I have to assume there will be exceptions.

[icebraining]

If you are built on Spotify, then the use is not signing in to your app, but to Spotify (and then authorizing your app), so it should be up to them to provide the Apple Sign In feature, I assume.

[jiveturkey]

that smells like an anti-competitive behavior.

obviously apple has considered this and is forging on anyway. good for them.

[summerlight]

Probably Apple is hoping the entire Apple ecosystem not to be defined as "a market" in terms of antitrust laws. I am not sure if the Justice Department will agree with it though; we'll see.

If it's defined as a market, then Apple will be surely in trouble but enforcing Apple ID alone doesn't make much differences from the current situation as it always has been doing similar things for web browsers, music apps, app store itself etc. So it's pretty natural to enforce this policy for Apple; no additional risks but only benefits.

[nihonde]

Competition is not anti-competitive.

Excluding other third party sign on options would be problematic if Apple were abusing a dominant position among smartphone makers, which is not the case by any objective measure.

[sb8244]

Is it problematic if Apple says "you must include us if you include anyone else?" That seems anti-competitive to me.

[nihonde]

That’s competing. Fair play unless you’re the dominant player in the relevant market.

[maxerickson]

Leveraging their status as the controller of the platform to require support for their solution is not the same thing as their solution competing head to head with other solutions.

Note that I'm not making an argument about how to classify the behavior legally, I'm arguing that calling it "competing" is pretty generous.

[summerlight]

The trouble here is the definition of "market". Apple's ecosystem (which Apple has an absolute control on) doesn't seem to be very safe from being defined as a sole market since there's no viable substitute to the app store for Apple users.

For instance, even if Apple decides to increase the app store fee to 50% so its app's prices as well, still consumers don't have much choice since buying a new phone is typically more expensive by order of magnitude than buying an app. This is also a part of Spotify's claim as well and Apple is trying to defend itself for this time unlike Apple v. Pepper.

[nihonde]

You can’t define Apple’s market as iOS customers unless there are no alternatives to iOS, which there most certainly are.

[Mindwipe]

"Dominant player" isn't especially relevant in European market law. Essentially the test is that you are of sufficient import to materially affect pricing in that market, which Apple definitely is.

[nihonde]

I was taught that Article 102 is the test for abuse of monopoly power in the EU. It actually uses the words “dominant position” if I’m not mistaken.

I haven’t studied this since the late 90’s, so I may be out of date...

[EGreg]

Yes it is anticompetitive. It is using Apple’s monopoly as gatekeeper of their app store.

Apple would have long ago been cited for Antitrust if Android hadn’t had most of the market. I personally think that the definition of a trust is too narrow — one member of an oligopoly abusing its position as a platform provider and strongarming people is also pretty bad.

https://www.theverge.com/platform/amp/2019/6/3/18650861/appl...

[nihonde]

That’s not how antitrust law works. It’s not a test of whether a company exerts too much control over its own customers. It’s a test of whether customers have some alternatives and a real opportunity to vote with their dollars.

[sturgill]

Apple has argued that developers are its customers (in the Pepper lawsuit). What options do developers have? Ignore the iOS market (those most likely to pay money)? There isn't a choice here: you let Apple have 1/3 of all of your revenue and you implement Apple Sign In. Because... competition?...

[Mindwipe]

That's how American anti-trust law works.

It's not entirely how European anti-trust law works.

[EGreg]

Yep, that’s what meant when I said that the definition was too narrow

[threeseed]

Well exactly.

If Apple was the only provider of smartphones then there would be a case for them to open up their platform to third parties.