News for hackers. Stuff that matters.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by frenchman99 on Saturday June 29, 2019 @04:41AM (#20311495)
They basically just asked Apple to give them 15K$, which is the cost of membership for a company of more than 100 employees [0].

Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication ? Does Apple not provide some sort of SDK that makes this easy ? And if so, what is the advantage of "Sign-in with Apple" being interoperable ?

[0] https://openid.net/foundation/members/registration

Re:Open Letter from the OpenID Foundation to Apple Regarding... by thefounder on Saturday June 29, 2019 @05:01AM (#20311561)
I doubt 15k is really an issue for Apple. You could even say that at its scale its Apple's duty to pay that membership and give back contributing to the specifications.

Using standards has some advantages like not having to test dozens of authentication systems/clients doing basically the same thing. If you would have read the document you would have found that you can't use standard openID clients due some issues with Apple's implementation. Some of the issues have security implications.

Re:Open Letter from the OpenID Foundation to Apple Regarding... by pjmlp on Saturday June 29, 2019 @07:26AM (#20311970)
No, you just test slightly different implementations of the same standard, that seem to interoperate until they don't, even among products from same vendor.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by k8_maze on Saturday June 29, 2019 @07:16AM (#20311938)
No, they laid out several issues with Apple's OpenID Connect implementation with one of them being an actual security-related issue (missing nonce which can enhable replay and csrf attacks). You only have to pay if you certify and even then, 15k is not that much.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by trazire on Saturday June 29, 2019 @10:19AM (#20312720)
$15k is an inconsequential amount for the OpenID Foundation, either. Just based on members listed on their site, they're making around $966 thousand.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by perlgeek on Saturday June 29, 2019 @07:26AM (#20311972)
They have mainly asked Apple to follow a standard, and not do their own similar-but-not-quite-the-same thing.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by mjlee on Saturday June 29, 2019 @07:15AM (#20311937)
> Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication?

Not really...

For example, the lack of a discovery document means that a lot of the essential configuration cannot be discovered programmatically.

The lack of a UserInfo endpoint means that applications which are used to using that will need to get the user info out of the id_token.

Re:Open Letter from the OpenID Foundation to Apple Regarding... by hprotagonist on Saturday June 29, 2019 @07:36AM (#20312007)
$15k feels like so trivial an amount to apple. It’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there.

edit: not “no expense report”; i actually meant “you don’t have to ask anyone first (but will have to file a report about it later)”, which is not quite the same thing.

Re:Open Letter from the OpenID Foundation to Apple Regarding... by jefftk on Saturday June 29, 2019 @08:56AM (#20312314)
> it’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there

You're probably joking, but in case you're not this isn't right. If a company had a policy like that they would have difficulty demonstrating to the IRS that all their expenses really were for their business, and they would have a hard time protecting themself from embezzlement. The company needs to be keeping a receipt and a business justification for the expense.

Re:Open Letter from the OpenID Foundation to Apple Regarding... by CydeWeys on Saturday June 29, 2019 @08:53AM (#20312303)
I guarantee you'd have to file an expense report, but that's probably the extent of it.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by Zenbit_UX on Saturday June 29, 2019 @10:47AM (#20312880)
Of course you need to file an expense report, his point was it's such a trivial sum to Apple the person expending it wouldn't need to ask permission.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by xenophonf on Saturday June 29, 2019 @10:07AM (#20312660)
The advantage of "Sign-in with Apple" being interoperable means that networks of relying parties (e.g., national research and education networks) can readily provide Apple customers access to high-integrity services. Both kinds of LOA—identity proofing and identity binding—are really difficult to do without secure hardware, and it could drive Apple product sales if they make LOA easy to do with their stuff (like TouchID or FaceID).
Re:Open Letter from the OpenID Foundation to Apple Regarding... by merb on Saturday June 29, 2019 @05:56AM (#20311708)
btw. you do not need to be member of openid to support openid connect. you just can't advertise it. but being a member is relativly cheap.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by tlrobinson on Saturday June 29, 2019 @05:19AM (#20311617)
It would be the polite thing to do.

$15k is something like 0.000006% of Apple's cash on hand.

Re:Open Letter from the OpenID Foundation to Apple Regarding... by throwaway2048 on Saturday June 29, 2019 @06:50AM (#20311868)
For reference, its like somebody that has 10k in the bank paying 0.6 of a cent
Re:Open Letter from the OpenID Foundation to Apple Regarding... by comboy on Saturday June 29, 2019 @08:14AM (#20312137)
0.06
Re:Open Letter from the OpenID Foundation to Apple Regarding... by aiyodev on Saturday June 29, 2019 @07:05AM (#20311904)
For reference, it’s also about 18 months of salary at median wage.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by andruby on Saturday June 29, 2019 @07:08AM (#20311916)
Not Apple median wages. That would probably be closer to 2~3 months.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by wikibob on Saturday June 29, 2019 @07:46AM (#20312032)
Apple Engineering Compensation ranges from ~$150,000 to ~$450,000 per year (including salary, bonus, and stock compensation).

$15,000 would be between a week and just over a month of compensation.

See https://www.levels.fyi/salary/Apple/

Re:Open Letter from the OpenID Foundation to Apple Regarding... by thetinguy on Saturday June 29, 2019 @05:56PM (#20315047)
The most common employees at Apple are not engineers.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by falcolas on Saturday June 29, 2019 @09:59AM (#20312615)
Not all employees working at or directly for Apple make Apple salaries. All the contractors they hire are likely to bring that median down significantly.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by huffmsa on Saturday June 29, 2019 @08:19AM (#20312155)
18 months? That would make the median hourly wage ~$5.20

I don't think that's right. Perhaps you meant 18 weeks?

It's still irrelevant, as it's not a something an individual is paying. The parent comment merely scales Apple's cash on hand to numbers we can understand.

Re:Open Letter from the OpenID Foundation to Apple Regarding... by GTP on Saturday June 29, 2019 @07:26AM (#20311971)
But it's the price for a company, not for a person.
Re:Open Letter from the OpenID Foundation to Apple Regarding... by souterrain on Saturday June 29, 2019 @06:40AM (#20311843)
Is there something in the OpenID Foundation membership agreement that might raise concerns for Apple?
Re:Open Letter from the OpenID Foundation to Apple Regarding... by Bombthecat on Saturday June 29, 2019 @04:45AM (#20311512)
Apples reply: lol, no