Re:How Popular Is “Sign in with Apple”?
by adamlett on Tuesday January 28, 2020 @01:49PM
(#22172716)
What’s cool about that anonymized email address is that even if it gets leaked, only the registered service can use it to communicate with you.[1]
Does this just cement you too apple? I'm assuming if you lose your Apple address, you have lost all linked addresses?
In most sensible authentication flows, your email address is not the primary key on your account, but rather just a credential with a link to an account, where an account HAS MANY credentials. You can usually "Sign in with X" and then "link" your now-existing account to credentials from "Sign in with Y" and "Sign in with Z."
That doesn't work if the email address the service knows as you, is a fake proxy at Apple.
It works as long as you add the second credential before losing access to the first.
Fair. Still a central point of failure, but not much (any?) worse than the alternatives.
Re:How Popular Is “Sign in with Apple”?
by crooked-v on Tuesday January 28, 2020 @02:46PM
(#22173328)
Apple IDs can be arbitrary emails, and can be changed at any time (https://support.apple.com/en-us/HT202667).
Re:How Popular Is “Sign in with Apple”?
by adamlett on Tuesday January 28, 2020 @02:55PM
(#22173424)
I suppose it does. In the same way that using your gmail address to sign up for anything cements you to Google. But unless Apple or Google suddenly go out of business, I have a hard time seeing a problem with this.
It's also easy in general to revoke permissions with these SSO providers rather than dealing with whatever the service's account cancellation protocol is.