Yeah, I think there must be more to it than Apple not knowing about OpenID - it was probably deliberate for some reason, would be interesting to know what it was.

I dunno.

It's also pretty weird to borrow 95% of a spec, miss out on a half dozen important security features, not acknowledge the relationship between your work and the spec, and not contribute back to the community that funded the spec.

The big tech companies all tend to have excellent security teams, each of which have particular strengths. Google's obviously includes low-level vulnerability research and browser security. Apple's includes hardware security and cryptography. I would be surprised if they "missed out on a half dozen important security features".

The article describes the missing security features. Did you read it?

The lack of nonce makes replay protection impossible. The lack of c_hash opens up vulnerabilities in connect flows where the service incorrectly assumes the two tokens refer refer to the same user. Returning the id token on the query leaks it in the Referer header.

I don't know enough about Sign In With Apple to map its security features to those of OpenID; I'm guessing you don't either.

Neither of you need to; the article contains a link to https://bitbucket.org/openid/connect/src/default/How-Sign-in... where a bunch of experts have analysed the current (beta) signin with Apple against the spec. In particular it's "signing with apple on the web" that they've analysed, which is open for anyone to analyze using the developer tools in a browser etc.

Apple are actually following the OpenID standard, that's why the list is differences is concise and to the point. Several of the pieces that are missing/different are items that were added to OpenID to prevent attacks that have been used against pure OAuth 2.

Many of the potential attacks relate to fooling the third party sites as to what happened, so it is difficult/impossible to mitigate them with magic on Apple's side.

(disclaimer: I'd listed as a contributor on above doc. I'm writing here in a purely personal capacity.)

>The big tech companies all tend to have excellent security teams, each of which have particular strengths. Google's obviously includes low-level vulnerability research and browser security. Apple's includes hardware security and cryptography. I would be surprised if they "missed out on a half dozen important security features".

>In particular it's "signing with apple on the web" that they've analysed, which is open for anyone to analyze using the developer tools in a browser etc.

Why is it I am getting the idea Apple just aren't very good with the web. I am reading it as Sign In with Apple ID is secure on the devices, iOS and App, but not when used on the web.

It's very "pirate of Silicon Valley", i.e. very old-school Apple: "so sue me". Regardless, the right answer is to engage privately first, to see why they missed that 5% and if there is any way to find agreement, not to go pedal-to-the-metal with public shaming.

As someone who's tried to contact Apple before, posting publicly is about the only thing that would ever work. Good luck getting in contact with anyone there who'll speak to you. They're worse than most other companies, and most other companies are already quite bad.

For an individual, yeah. Apple belongs to a number of standards bodies and consortia, though; when they deviate from an existing standard, they usually do do more deliberately than this letter implies.

I was not trying to get in contact with them in my capacity as an individual.

In that case, a simple line saying "we tried to contact you to no avail" would have avoided looking rude.

I just don't get why you're so stuck on this one point on etiquette. To me, saying "We tried to contact you to no avail" is ruder than omitting the line.

An open letter is obviously not a communication to the recipient, but to the public. It's a rhetorical exercise you use so that the public will put pressure on the counterpart; hence it has to win the public to your side. In order to have the public on your side, you have to be as clear as possible about your motives and your methods - otherwise you'll get people questioning them, which is exactly what you can see in this thread. That's a fail. A simple paragraph saying "we tried to engage with you but could not because X" would have made the writer more sympathetic to the public, imho, and avoided most of the challenges you see here.

If that looks rude to the counterpart, it doesn't really matter; everyone knows any politeness is fundamentally insincere anyway, because if one had not wanted to ruffle their feathers, one wouldn't have published anything in the first place.

> It's pretty weird to borrow 95% of a spec, miss out on a half dozen important security features, not acknowledge the relationship between your work and the spec, and not contribute back to the community that funded the spec.

they all been doing this all the time

A good friend is on one of the product teams at Apple that had a recent release around WWDC. Their new product (realitykit) basically made a couple of well known startups in the space irrelevant overnight.

So I asked my friend if he knew about these other companies, again all very well known in the specific market for AR developer tools, and he said he didn't and they don't actively look for companies they might be impacting when making product decisions.

The difference is that OpenID is not a 'well known startup' but an industry standard and that Apple obviously implemented the well-known protocol 'OpenID Connect' but added some bugs and didn't want to mention that their technology could be compatible with the existing one.

And I don't want to downplay the innovative additions Apple made to the whole thing (browser integration etc.), but it doesn't make an honest impression if you don't mention that your revolutionary product is a based on a well-known standard.

> and didn't want to mention that their technology could be compatible with the existing one

Really curious for the reason behind that. If they would've mentioned it there probably would have been quite a bit less of lock-in criticism for the product. But maybe they are also banking on the devs not realizing that they aren't that locked in and have an easy option to move away.

I suspect they didn't mention it because they see the lock-in to their product as a feature. Mentioning OpenID might give the impression that Apple would be interested in interoperability (to some degree).

they didn't mention it because if they did, they would need to be a member of the openid foundation and pay the 15k$.

There's no requirement to be to a member of the OpenID Foundation to describe your implementation as OpenID; the trademark rules are here: https://openid.net/intellectual-property/trademark-license/

The main requirement therein I would say is that you can't use OpenID to describe an implementation unless it implements the mandatory-to-implement parts of the relevant protocol specification (and all the specifications are 100% free; e.g. https://openid.net/specs/openid-connect-core-1_0.html ). That's more about interoperability than anything else.

It looks weird either way.

"Use the OpenID Connect Self Certification Test Suite to improve the interoperability and security of Sign In with Apple."

Give us a bunch of money and maybe we'll let you join our little group and you can have our mark of quality that you are now secure. Wow, really? Thanks.

It's a little like a lot of the spam I get as an Android developer from "marketers" and just general weirdos trying to get rich off my hard work.

> my hard work.

But it's mostly not their work - Apple's protocol is basically a bad implementation of OpenID Connect.

I expect that if Apple said it "forked" OpenID, then the HN community would be OK with it. It's all about the optics.

It’s been a couple weeks since I’ve seen this “optics” being thrown around in comments here. Why you keep using this term when the more appropriate one would be “perspective”?

I don't know that I "keep" using that word. I suspect you've seen someone else also using it.

But the reason is because "optics" and "perspective" don't mean the same thing.

Unlike “marketers” a certificate of compatibility is mandatory for many development teams to use an external technology

The certification suite is open source software (produced by the OpenID Foundation mostly at their cost) and entirely free to use:

https://github.com/openid-certification/oidctest

Apple are absolutely 100% free to run the tool and fix any issues found without any payment to anyone except their own engineer's time.

(There is a fee to pay for the 'OpenID Certified' logo and to be listed as certified, but in my opinion just running the free tool and fixing any interoperability issues is a major benefit by itself.)