Hacker News Reader

Comment by frenchman99 | Hacker News Reader

They basically just asked Apple to give them 15K$, which is the cost of membership for a company of more than 100 employees [0].

Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication ? Does Apple not provide some sort of SDK that makes this easy ? And if so, what is the advantage of "Sign-in with Apple" being interoperable ?

[0] https://openid.net/foundation/members/registration

View on HN

I doubt 15k is really an issue for Apple. You could even say that at its scale its Apple's duty to pay that membership and give back contributing to the specifications.

Using standards has some advantages like not having to test dozens of authentication systems/clients doing basically the same thing. If you would have read the document you would have found that you can't use standard openID clients due some issues with Apple's implementation. Some of the issues have security implications.

No, you just test slightly different implementations of the same standard, that seem to interoperate until they don't, even among products from same vendor.

No, they laid out several issues with Apple's OpenID Connect implementation with one of them being an actual security-related issue (missing nonce which can enhable replay and csrf attacks). You only have to pay if you certify and even then, 15k is not that much.

$15k is an inconsequential amount for the OpenID Foundation, either. Just based on members listed on their site, they're making around $966 thousand.

They have mainly asked Apple to follow a standard, and not do their own similar-but-not-quite-the-same thing.

> Is it currently not possible to use standard OpenID clients for "Sign-in with Apple" authentication?

Not really...

For example, the lack of a discovery document means that a lot of the essential configuration cannot be discovered programmatically.

The lack of a UserInfo endpoint means that applications which are used to using that will need to get the user info out of the id_token.

$15k feels like so trivial an amount to apple. It’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there.

edit: not “no expense report”; i actually meant “you don’t have to ask anyone first (but will have to file a report about it later)”, which is not quite the same thing.

> it’s the sort of expense you don’t even need to file an expense report for on a corporate credit card if you’re even a mid-level manager there

You're probably joking, but in case you're not this isn't right. If a company had a policy like that they would have difficulty demonstrating to the IRS that all their expenses really were for their business, and they would have a hard time protecting themself from embezzlement. The company needs to be keeping a receipt and a business justification for the expense.

I guarantee you'd have to file an expense report, but that's probably the extent of it.

Of course you need to file an expense report, his point was it's such a trivial sum to Apple the person expending it wouldn't need to ask permission.

The advantage of "Sign-in with Apple" being interoperable means that networks of relying parties (e.g., national research and education networks) can readily provide Apple customers access to high-integrity services. Both kinds of LOA—identity proofing and identity binding—are really difficult to do without secure hardware, and it could drive Apple product sales if they make LOA easy to do with their stuff (like TouchID or FaceID).

btw. you do not need to be member of openid to support openid connect. you just can't advertise it. but being a member is relativly cheap.

It would be the polite thing to do.

$15k is something like 0.000006% of Apple's cash on hand.

For reference, its like somebody that has 10k in the bank paying 0.6 of a cent

0.06

For reference, it’s also about 18 months of salary at median wage.

Not Apple median wages. That would probably be closer to 2~3 months.

Apple Engineering Compensation ranges from ~$150,000 to ~$450,000 per year (including salary, bonus, and stock compensation).

$15,000 would be between a week and just over a month of compensation.

See https://www.levels.fyi/salary/Apple/

The most common employees at Apple are not engineers.

Not all employees working at or directly for Apple make Apple salaries. All the contractors they hire are likely to bring that median down significantly.

18 months? That would make the median hourly wage ~$5.20

I don't think that's right. Perhaps you meant 18 weeks?

It's still irrelevant, as it's not a something an individual is paying. The parent comment merely scales Apple's cash on hand to numbers we can understand.

But it's the price for a company, not for a person.

Is there something in the OpenID Foundation membership agreement that might raise concerns for Apple?

Apples reply: lol, no

Reply on news.ycombinator.com