Is there any good reason to do the Sign In With <giant data aggregator>?

I never take that option if there is anything else available. They don't need to see my signins on other sites, why should I just give it to them? For a few sites where it is utterly unavoidable I make one-off twitter accounts instead, because Twitter doesn't require your phone number to make an account and doesn't have a "only one account per person" policy I think.

Well, Sign In with Apple is different because:

1. It’s fast

2. It gives you a pseudonym

3. It doesn’t leak all your other social graph data

4. Doesn’t require a new password

The rest are:

1. Faster than creating an email, but will require redirects, and possibly logging into fb/google

2. May give you a pseudonym but often reveals your real name

3. Are used typically to build profiles of you and create stats on app popularity across demographics

4. Don’t require a new password.

Maybe it's just me, but one bummer about this kind of system is that's is A+ top security for a lot of stuff I don't care about. To create some account on a random forum to give feedback about how I got a stuck oil filter off of my '03 Civic, for example. With email+password I can just use a low security password because I'm typing on a phone. With these all-in systems my device isn't recognized so I'll need to type in some code from 2FA and type my long, unique password.

I know they're very popular, but there's so much long-term unintended baggage with using these singe signon systems...even assuming Apple's doesn't have the nefarious parts most others have.

Even setting aside Sign In With Apple, why are you consuming mental space and energy with a reused password and whether they should be throwaways or not in 2020, when all mobile OSes and desktop browsers integrate seamlessly with password managers?

Over here, I just use Face ID and 1Password does the tedious filing-and-remembering part that computers are good at.

I use 1Password on both my phone and desktop for logging in. Saving a new password on the desktop is easy. For the phone it seems rather tedious. Especially when, even on the desktop, many sign up pages have me submit 2 or 3 times because the username is taken, password too complex, or I didn't give them my phone number. I find it way less mental space and energy to reuse a weak password.

Sign in with Apple has the advantage that the service on the other side of the auth window doesn't get to see you actual email address. They're provided instead with an anonymized email address from Apple that serves as a forwarding address for you.

It's also easy in general to revoke permissions with these SSO providers rather than dealing with whatever the service's account cancellation protocol is.

What’s cool about that anonymized email address is that even if it gets leaked, only the registered service can use it to communicate with you.[1]

[1] https://support.apple.com/en-au/HT210318

Does this just cement you too apple? I'm assuming if you lose your Apple address, you have lost all linked addresses?

In most sensible authentication flows, your email address is not the primary key on your account, but rather just a credential with a link to an account, where an account HAS MANY credentials. You can usually "Sign in with X" and then "link" your now-existing account to credentials from "Sign in with Y" and "Sign in with Z."

That doesn't work if the email address the service knows as you, is a fake proxy at Apple.

It works as long as you add the second credential before losing access to the first.

Fair. Still a central point of failure, but not much (any?) worse than the alternatives.

Apple IDs can be arbitrary emails, and can be changed at any time (https://support.apple.com/en-us/HT202667).

I suppose it does. In the same way that using your gmail address to sign up for anything cements you to Google. But unless Apple or Google suddenly go out of business, I have a hard time seeing a problem with this.

Less than Google, really, because you can't change your main Google sign-in email at any time.

Login fatigue. Yes, I use a password manager (1password). But it means I need to stop going through the sign-up flow, jump over to the password manager, create a new login, change the password recipe from random-letter to random-word (which I prefer), generate a password, then go further modify it to accommodate the site's particular password complexity rules (upper/lower/special/numbers), add the URL, save, then go back to the sign-up flow to finish.

And... 90% of the time, that's what I do, because I prefer to have separate logins for every site.

But sometimes, I just click the 'sign in with google' because it's a hell of a lot faster and easier.

Hear hear. I’m amazed 1PW hasn’t defaulted to random word recipes by now, as well as providing checkboxes to fold in all the upper/number/special character rules, or min/max length. (My passwords usually look like this nowadays: “turtle megaphone house 6@B”)

Twitter does require your phone number to make the account sometimes. (I suppose if it can’t determine enough about you.) Recently I was able to make one, only to be locked out a few minutes later until I “confirmed my identity” by providing a phone number.

Do you signup with your self-hosted email?

I don't think I've ever seen it. I have, however, seen Apple Pay on the web a few times (and in apps many more times), and that has been a great experience.

Apple Pay on web is fantastic. I don't use an iPhone, but specifically use my iPad for online purchases from any retailer that supports Apple Pay.

I don't think I've seen it either. What I have seen are requests for my App Store password on occasion when I launch, say, Google Maps. It's infuriating because when I'm out in the world, I don't have access to my passwords and I don't remember them.

It's a sign in to Apple, if not a sign in with Apple, and it's weird because what I'm trying to use is Google's Maps application without signing into anything. What is going on with all of this?

I think that the point of using Sign In w/ Apple is to prevent you from having to remember more than one password. It is only used when you would have to create/remember a password anyway so it won’t get in your way when you are out an about any more than signing in with Google/Facebook or your own email/password.

Turns out it's only required if you already exclusively use FB/Google sign in (I thought it would also apply to your-app-auth+FB+G but I guess not) https://developer.apple.com/app-store/review/guidelines/#sig...

That's not true. Any social sign-up except given exceptions will require SIWA.

Where "given exceptions" are mostly limited to obvious situations, like using Twitter signin for a Twitter client.

Huh, that was not my understanding, and your link goes on to state:

> not required if...Your app exclusively uses your company’s own account setup and sign-in systems.

So there’s no official guidance on the both/and case?

I interpret that as:

- If you only have social logins, you must implement apple sign in.

- If you only have your own login, you don't need to implement apple sign in.

- If you have both apple sign and your own login, you must implement apple sign in.

> - If you have both apple sign and your own login, you must implement apple sign in.

I would think that too, but the text is odd by saying "exclusively"

> Apps that exclusively use a third-party or social login service

I think you meant

> If you have both social logins and your own login, you must implement apple sign in.

which is my understanding as well! Would be nice if they explicitly handle this case as it's probably the majority.

The deadline to make it mandatory for apps and that use google and Facebook is still a few months away if I recall correctly

Yes, that's what i read also... so hopefully in a few months all apps that have 3th party logins like Google and FB are required to add SiwA and we will see a spike in popularity too...

I'm not sure I'd notice if it rolled out to a lot of the apps I use, though. I mostly stay logged in for things that don't require login every use (lastpass, banks, etc).