Security news that informs and inspires

Sign In With Apple Makes Privacy a Centerpiece

Apple is introducing a new identity feature that will enable people to use their Apple IDs to authenticate to third-party apps and sites. The system is quite similar to the social authentication frameworks powered by Facebook and Google, but with one important distinction: minimal data sharing.

Sign in with Apple is the company’s attempt to help people deal with the flood of usernames and passwords they must create for all of the apps and sites they interact with on a regular basis. One approach to this problem is using a password manager, such as LastPass or 1Password, to generate unique credentials for each app or site and store them in a secure location. Another approach is to use one master identity, such as a social media account, as the authentication mechanism for multiple other sites. That system has the advantage of simplicity and ease-of-use, but also can result in quite a bit of personal and demographic information being shared with the third-party apps and sites.

“This can be convenient, but it also can come at the cost of your privacy. Your personal information sometimes gets shared behind the scenes and these logins can be used to track you,” Craig Federighi, senior vice president of software engineering at Apple, said during the company’s Worldwide Developer Conference Monday.

To deal with that problem, Apple is giving people the ability to minimize the amount of information they share through the new authentication system. Developers can use an API to add the Sign in with Apple button to their apps, and when a user taps the button, she is then authenticated through her Apple ID and FaceID. Apple’s system allows developers to request names and email addresses from users, but gives people the option of sharing what amount to disposable email addresses with each app rather than their actual address.

“You can choose to share your actual email address or you can choose to hide it and when you do, we’ll create a new unique, random address that forwards to your real address,” Federighi said.

This system has a couple of advantages, most notably the data minimization and lack of tracking across the web. Social authentication schemes typically share quite a bit of data about users with third-party apps and sites, data that’s used to personalize and target ads and other content. Apple’s system forgoes the tracking and gives people the ability to use throwaway, randomly generated email addresses for each app or site. Users have control of the way each app communicates with them and can revoke any of the addresses whenever they choose.

“You can choose to share your actual email address or you can choose to hide it."

"Sign In with Apple is a win for Passwordless in general. Helping people get comfortable with using biometrics for login is essential for Passwordless adoption. Apple, given their track-record of improving authentication UX at scale with technologies like Face ID and Touch ID, has the ability to help break down this barrier," said Nick Steele, a R&D engineer with Duo Security.

The main prerequisite for people to use Apple’s system is that they have to trust Apple with their personal information, which, if they have iPhones and Apple IDs, they’ve already done. However, Apple’s system also has some potential limitations. For one, it doesn’t implement the emerging WebAuthn authentication standard, which is designed to make the implementation of multi-factor authentication easier for developers. The major browser vendors have either added support for WebAuthn already or have plans to do so, and Apple has announced support for it in an upcoming preview release of Safari for macOS. But Apple’s system uses a different method with a proprietary sign-in flow.

Also, Apple is requiring developers to use its system in any app that also supports third-party sign-in systems, once Sign in with Apple reaches commercial availability later this year. That means any app that supports Facebook or Google’s social authentication system also must support Apple’s, and also must give Apple’s button top priority in the sign-in flow.

“In a stacked layout, place the Sign In with Apple button above the other buttons,” Apple’s developer guidelines for the system say.