iOS now requires Sign On with Apple alongside other auth providers
developer.apple.com
developer.apple.com
- Your app exclusively uses your company’s own account setup and sign-in systems.
- Your app is an education, enterprise, or business app that requires the user to sign in with an existing education or enterprise account.
- Your app uses a government or industry-backed citizen identification system or electronic ID to authenticate users.
- Your app is a client for a specific third-party service and users are required to sign in to their mail, social media, or other third-party account directly to access their content.
> Apps that use a third-party or social login service (such as Facebook Login, Google Sign-In, Sign in with Twitter, Sign In with LinkedIn, Login with Amazon, or WeChat Login) to set up or authenticate the user’s primary account with the app must also offer Sign in with Apple as an equivalent option.
You only have to offer "Sign in with Apple" if you already have third-party login options. It would be completely unreasonable to require adding a third-party login option if you don't already have one. But if you already have third-party login options, having uniformity seems reasonable.
- Your app exclusively uses your company’s own account setup and sign-in systems.
What if they required the same thing on websites by having their browser engine look for Facebook/Google sign ins and require an Apple one be present before displaying the page?
Not explicitly as you implied. But implicitly it is required. Let me explain.
You own a service that has social authentication with Google, Facebook, Twitter, etc.. You have web, desktop, and mobile apps for this service (or some combination thereof).
Your iOS app now requires you to offer "Sign in with Apple" as an auth provider, because you already offer Google, Facebook, Twitter, etc.. So you add "Sign in With Apple" to your iOS app because Apple requires because of their monopoly for distribution on iOS devices. So you now add Apple auth as an authentication option within the iOS app.
Now what happens if a user signs up in your iOS app with Apple's Auth? How are they going to log in on your website, desktop, Browser extension, or anything else? Well, I guess you now need to add "Sign in with Apple" on those devices too.
Once you offer an auth provider as an option on one device, it must now be offered throughout your platform on all devices or you risk locking users out.
Thus, if you offer social auth for authentication, and you want distribution on at least one iOS device, you are implicitly required to offer Apple Authentication across your entire platform.
And that is the power of Apple's distribution monopoly on iOS.
Oh, and before you think "well we will just boycott iOS" for my platform. Good luck. You won't get very far (in the US at least) without iOS support if you are just starting. Even an established company would struggle to succeed without iOS support. Imagine if Uber just said "Fuck it, no more iOS app". All their iOS users would say "Fuck it, no more Uber then, Lyft here I come".
Is it feasible to not do this, and instead tell users to add any one of the existing auth methods to their account in addition to Apple's, if they want to use the app on another OS?
This is going to lock more users to iOS, and doesn’t allow users on popular apps to migrate to Android and maintain their login. (Note no Android SDK is provided)
It might technically not be antitrust, but as an app developer we’re now forced to include Apple sign-in.
Isn't it? It should be. You're forcing developers to add your sign-in method everywhere... they can't add it on Android. You're essentially forcing sub-par android support.
Edit: I mean technically, it's gonna suck for users for sure.
It's the same reason I don't let Google keep any of my browsing and location history even though I might benefit from that as a user today. I don't trust what they might want to do with that data later.
If you think any billion dollar company is acting in any interests but its own you're being naive.
What data is Apple collecting?
Honestly this stuff scares me more than the data collection that Google does, for example, because at least I have some control there. And Apple's privacy controls are kind of moot anyway if I use iCloud and all my data is just one subpoena away from anybody that wants it.
Does Amazon allow third party book sellers on their Kindle devices? Again, the open web to the rescue. I can go to Amazon’s store from my browser and buy books.
In fact, I use the Kindle web reader on my iPad when reading books about AWS, because the Kindle app doesn’t allow embedded web links to Amazon (even AWS Informational links).
Again you can make the argument that this is to protect users but it also just happens to protect their native app ecosystem.
Push notifications only came in handy to keep the battery draining Slack “application” off of my computer.
I had to uninstall many apps because there was no option to deactivate marketing PNs.
When I have to turn off PNs completely for an app, there is no reason to have that app installed anymore, I might just use the website.
They did make a web version but it lacks the offline and privacy features of the native app. Apple removing the iOS app is a perfect example of why these big companies can't be trusted with ultimate control.
How much more privacy did they get by an app that gets information from the internet than a website?
https://love2dev.com/blog/what-is-the-service-worker-cache-s...
You can use one of a number of browsers on you phone. The browser developers are the ones who are constrained, having to use the WebKit rendering engine—but then, it’s not their phone.
It's silly to cast the mobile browser wars in abstract terms, as if JoesOwnWebBrowser is going to be a thing tomorrow. It's Google and Apple, full stop. Google is leveraging their titanic web properties and mobile ecosystem control to push Chrome. Apple is using their control over the iOS ecosystem to retain Safari. The choice is whether the mobile web has two relevant players, or one.
That's an important distinction. Apple's monopolistic practices prevent better software from succeeding on phones, and I'm disappointed that Apple's anti competitive behavior is excused.
Note: UC Browser is a huge privacy threat and please ask friends and family to uninstall it. But the point still stands.
And here's a real world example: even if v8 was a better runtime for React Native it still wouldn't be allowed into iOS.
I think so, yeah. Or at least, the idea that the rendering engine is all that matters for a browser is not something I’d just accept without explanation.
And apparently it's not your phone either.
Perpetually missing web features (PN) so that you are forced to make an app, for obvious reasons.
Then don’t buy one. Highly competitive market where you can buy others where this is possible.
I'm comfortable with that, because I understand the working agreement that exists with my network and third-party services providers (such as Apple), and I understand that they are bound by legal summons in many respects for the data they receive.
Note I don't consider this ideal, and I don't think it's the best possible outcome for society, but I've spent 20 years consciously managing my choices on such matters, ever since DejaNews was founded, and I understand where I stand versus my choices today.
I don’t think this is actually feasible in practice. I’ve never encountered a real person using a Google-free android device as their daily driver in the wild. I work in security, and actually ask android users I encounter if they are worried about GOOG data collection or whatever. Nobody ever responds with “I’m Google-free”.
In reality, this "sign in with apple" feature doesn't push Apple's ecosystem any farther than Apple Maps does. You can use sign in with apple via their web SDK on both desktop browsers and Android, and I wouldn't doubt putting "sign in with apple" in an Android app itself is trivial.
> - Be signed in to iCloud on an Apple device.
This doesn't help users no longer carry around an Apple device.
https://support.apple.com/en-us/HT205223
I would be very curious (and happy!) to receive any information indicating that I'm wrong in my belief that ad tracking is not being limited by default.
edit: I am not sure if this source is correct, but it does agree with me:
https://threatpost.com/privacy-iphone-apples-targeted-ad-tra...
"A unique identifier is enabled by default on every iPhone that’s shipped, allowing advertisers to follow the phone’s activity across the web."
Chinese citizens do not receive the benefits of the rest of the world. Apple will remove apps from the store that could benefit its citizen's freedoms at the whim of that government to allow themselves to remain in that market.
Your iCloud backups are not encrypted on Apple servers.
And Safari stops Google and other 3rd-party ad providers from tracking you all over the web.
Apple not doing things your way doesn't constitute a breach.
>Chinese citizens do not receive the benefits of the rest of the world.
How is this Apple's fault? The Chinese government explicitly prevents their citizens from having those benefits.
They released per-app access controls in iOS 6[1] (which was huge!) in 2012 and didn't bother to mention it in their marketing[2]. The reviews of the update don't mention it either[3]. The same feature landed in Android 6.0 three years later.
[1] https://www.cultofmac.com/173128/new-ios-6-privacy-settings-...
[2] https://web.archive.org/web/20120615175407/http://www.apple....
They really do need to allow easy side loading and/or alternate stores. I shouldn't have to chose between Apple's nanny-state "no porn apps", "no political apps" allowed and "privacy"
Apple hides the ability to add a website to the home screen somewhere inside of Safari, instead of making it a first class feature and including a UI for it in the "App" "store". If they did that, a lot of apps could viably just be a website instead.
Adding a website to the home screen has been prominent in Safari since 2007. Go to the share sheet and scroll up.
How many websites have a prominent pointer on iOS devices showing you how to do it.
But the App Store is not known to be a place of discoverability.
On top of that, how many mainstream platforms and physical stores allow porn to be prominent? The most popular video site - Youtube - doesn’t allow porn.
Oh, come on, you know very well why you'd want a native app: it's the exact same reason why you'd download a native app for anything else; they can be more polished, use platform APIs, download files…
> On top of that, how many mainstream platforms and physical stores allow porn to be prominent? The most popular video site - Youtube - doesn’t allow porn.
Because the ad platform it uses doesn't like it?
You can upload and download files from Safari on iOS.
There's still a decent number that aren't.
> You can upload and download files from Safari on iOS.
The UX on this is significantly worse, even if you consider iOS 13's new downloads manager.
How well do AR/VR/3D applications run in Safari?
Less than 15 years ago, it used to be common in UK supermarkets for there to be a section at the entrance dedicated to newspapers and magazines. A good section of the top shelf would feature porn magazines. The printed covers of the magazines would generally be masked with some cardboard, so you couldn't see the explicit content by mistake, but could still see the title of the magazine.
Print media is generally in decline, so these sections no longer exist in quite the same form as they used to in supermarkets, but this is as prominent as it needs to be. In the past, this meant it was (literally) out of reach of children, but still readily available to adults, and only if they reach for it.
Why isn't that acceptable anymore?
Just like if you don’t like one console makers platform you have two more to choose from, if you don’t like Apple’s you have another one to choose from - the same one chosen by 85% of the market.
Why is it good for a single company to determine what you can and can't do on your phone?
And in the particular case of the HkMap app, what functionality did you not get on the website?
HKMap needs strong offline support since it's an actual map showing dangerous/important areas and people. It also used mesh networking for updates from other devices. Neither is possible on Safari.
I would say that apps aren't as blocked as easily as a website either, but Apple proved that wrong which is the reason for the question on their control.
Some form of the hamburger button has been a standard UI convention since real web browsers came to mobile.
[0]: https://www.goodreads.com/quotes/40705-but-the-plans-were-on...
There are five buttons at the bottom of an iPhone. Only one brings up a menu.
Examples include CG porn creation apps including Virt-A-Mate, TK17, Honey Select, etc... There are also real time 3D VR porn apps and even AR porn apps
Apple's platform currently limits freedom of expression. Sure you can watch any movie you want or read any website but the future will clearly include interactivity with real time VR, AR, 3D, etc...
Imagine if Apple invented the holodeck but their app store disallowed sex!??!? It's ridiculous that such a "progressive" company has just a poor position on sex positive apps. I get they don't want to sell them in their store which is why they arguably need to over alternatives.
Because it's possibly anti-competitive.
If their service is as good as they claim and it's something that users really want then why do they have to make it mandatory?
Remember, that's the Uber that tracked people, identified by name, and showed their location to guests at a party on a map. Just for entertainment.
It's the same Uber that has had so many privacy and customer data scandals, I have lost count.
But sure, they "have our back".
It's just that Apple isn't collecting it, the apps on their appstore are, which Apple profits from directly and indirectly.
But, yes, they're doing a really good job marketing themselves as the "privacy" company.
Where Apple traditionally gets profit is in selling more devices, and they do that through controlling apps on the platform.
Alternative approaches could be just as successful. But their approach does differentiate them from other market leaders, while equally (as here) allowing them to play catch-up and advertise themselves alongside Google, Facebook, and other logins.
Apple does marketing, it’s true, but they also try to back up their security and privacy work with white papers: https://www.apple.com/privacy/features/
Having the rule "if you can log in with Facebook, you can also log in with Apple" is in fact a protection against Facebook-only login.
I do not buy their company line at all. This is simply Apple flexing its power in the App Space to require developers to implement an ecosystem very few would do of their own volition.
You can argue it’s a good thing. I disagree. But it is hopefully clear that Apple being able to wield this kind of power is indicative of monopolistic power in that marketplace.
I don't think that's correct. Anyone who currently gives FB login as an option is required to support Sign On with Apple. If FB Login was previously an option, but was removed at some point, Sign On with Apple is not required.
I happen to have an app out there which we maintain security updates but aren’t adding new features. It was built with a FB login option. So now we either never update or have to implement features we don’t care about.
Also if you sign with iPhone, and want to switch phones I’d hope the developer would have a way to set a username or email and password on your account or link another account. So you could have Facebook and Apple linked to the same account, unlink, etc.
I think Apple offering a eco system is interesting though but seems to create lock-ins. Like if you have a Apple Watch, can’t switch to Android as easily either. Then texting or calling from your Mac using your iPhone is also cool but another hurtle if you ever wanted to switch if you really liked that feature.
I’m writing this from an iPhone (and just bought an iPad Pro yesterday). I don’t hate Apple. I don’t trust Facebook. But the only way Apple can do this at any scale is to leverage their control over the App Store.
For anyone who argues that Apple doesn’t have monopolistic power in the app space, I present this as a counter point.
The business strategy 101 is to amplify your strengths, and create a “chain” of value that is difficult to imitate by copying only one link.
Apple’s focus on privacy is hard to imitate for Google: Apple business doesn’t depends on ads, they control the whole production chain of the iPhone and the software that goes in it. Google can put a lot of security enhancements in Android, but they don’t control what Samsung or other manufacturers do with it.
So the “we care about your privacy” message, is not because they are altruistic; and it’s ok by me :) (I’m writing this from an iPhone).
I am rather bound to Apple's ecosystem, with no notable/relevant restrictions that I care about so far, than handing over all of my data to an ad company running and adtech OS on mobile phones with 500 sensors in them.
A fellow comment downthread encapsulates the benefit of this change perfectly:
“There was some app I downloaded last year which only had facebook or google sign on. You couldn't register with an email. I ended up deleting the app.”
This should be cheered by all.
This is a massive step back in progress. I weep for everyone stuck in a single company's ecosystem. You will be abused before it's over.
You're free to roll your own sign-in system, in which case you are not required to offer Sign In with Apple.
Not seeing a problem here.
It is third-party in the sense the user (who is a third party from the perspective of the app) is supplying the authentication service, but it's not a pre-existing social login.
It's likely that the IndieAuth protocol wasn't on their radar, and so they haven't considered it when coming up with this rule.
I hate signing in with social accounts, but sometimes it's so much easier than trying to sign up with an app's custom sign up form. I will happily pick Sign On with Apple 100% of the time to avoid linking to my Facebook or Google identity.
According to the Wayback Machine, the same terms were present as early as October 1st 2019 (maybe earlier; didn't look):
https://web.archive.org/web/20191001161920/https://developer...
Apple ecosystem is completely closed off. It does make it easier to ship software. For example they've hijacked SMS by creating their own iMessage, they tried to take full control of the mobile news publishing until Google came up with AMP and they have been dragging their feet when it comes to new web standards in Safari because they prefer native apps.
So the morale of the story is as long as you ship quality products you'll get a pass for tactics other companies don't usually get a pass for. None of openness, fairness, privacy, etc. matters really.
It'd be much more worrying and abusinve if they blocked users from logging in to certain products with their Apple ID.
Citation needed. They make the most profit, but do they make the most devices?
I dunno, I don't have an iPhone and don't plan on using Sign On with Apple, but I think it's still a good move that benefits consumers.
Who gets hurt? Companies that don't respect user privacy?
Imagine a single developer who has an idea to make a cool app. Because data linking is a core part of the app, they will either implement Sign in with Facebook or Google. They don't even have enough cycles to implement the other one, and they certainly don't have the time or energy to implement Sign in with Apple, so the app never gets created.
Well that app could have really benefited a niche audience potentially and we now you'll never have it.
I'm not a mobile developer, but I do run a SaaS that has Facebook and Google login, and adding Apple login would take me a couple of hours tops. I can't see how it would be magnitudes different on a mobile app.
Please explain.
And the comment was edited anyway. It originally did say monopoly.
This, however, is almost the opposite. Apple isn't banning any other authentication mechanism. Authentication services can still compete and app developers can even listed their preferred auth methods preferentially. Apple is only saying that Apple's service has to be given a chance to compete as well. Apple is certainly using its market power to enforce policy, but if anything it's pro-competitive (even if it benefits Apple itself).
This is cleverly done and is an option with a lot less friction that needs to leverage its potential network effects.
but they aren't removing choice, they are only adding choice in their approval processes, and leaving it to the developers to decide to remove choice when they get social login fatigue but want high engagement and low friction. Looks like they dotted their I's and crossed their T's on this one.
Let's say I have an old app that isn't bringing me much new revenue. I have currently have implemented two options: sign in with email + password, and "sign in with Google".
After this announcement, I would just remove "sign in with Google" as an option, and force all my users who previously used "sign in with Google" to set a password.
Okay, you do that. That's not a punishment to Apple, you might bounce some of your own users and is a choice you made exclusively.
> You can have only Apple sign in, but not only $competitor sign in.
If that's the antitrust argument, they just need to reword it say "and include another signin method" or logged out functionality. I just don't think thats a strong enough argument, as they aren't removing choice in any way only adding it, except to people with existing apps - like you - who will risk decimating all their own users.
A hyperliteralist could argue over what exactly the product/service is, in each case - sign-on itself? The whole stack of other customized media these companies serve to the same users? Synergistic old products or bulled services? The app store?
But the fact pattern, & effect of a ‘big guy’ using market power to force partners/customers/users/developers/competitors to unnaturally add a new, pro-Apple-profits option to their own separate offerings quacks like antitrust tying.
I'm not sure I see the "pro-Apple-profits" angle here. Generally, customers are better off with IdP-assisted login than with one-off password login, and if that feature needs to exist for UX and safety reasons, it seems understandable that Apple wouldn't want Facebook locking everyone into Facebook's extremely intrusive IdP.
> it seems understandable that Apple wouldn't want Facebook locking everyone into Facebook's extremely intrusive IdP.
Doesn't make something not anticompetative. If apples offering is truly better, they should offer it and it will be naturally adopted.
No, it doesn't.
First, there’s been no ruling that Apple is a monopoly, which by the way, isn’t illegal. With their 20% global market share [1], they clearly aren't a monopoly.
Do they have a monopoly in the iOS app market? Absolutely, but that's to be expected. It’s their platform that developers have agreed to their terms of service. Nobody is being forced to develop on their platform, especially since they aren't the market leader.
This is nothing like the antitrust lawsuit against Microsoft back in the day, after a federal decent decree forbidding Microsoft from using their 95% market share that was obviously a monopoly from tying Internet Explorer to Windows.
Of course, they went ahead anyway, declaring that Internet Explorer was so integrated into Windows that it could not be removed, which proved to be false.
Microsoft threatened to cancel the Windows licenses of various PC manufacturers if they continued to ship Netscape Navigator instead of IE, clearly abusing their monopoly power.
Apple doesn’t have a smartphone monopoly; there hasn't been any ruling to the contrary. They are only requiring Sign in with Apple if a developer already provides social logins.
Apple gives developers 2FA, verification of the login being a real person and not a bot. Users get to be anonymous by using a proxy email address if they choose. And there's no tracking by companies who make the vast majority of their revenue by monetizing user information. And it works on macOS, iOS, watchOS, the web, and Android devices.
It would be hard to argue users don't benefit from this.
[1]: https://www.statista.com/statistics/216459/global-market-sha...
Whether users benefit or not is not necessarily relevant for antitrust analysis; it is only since the Reagan era that direct consumer damage was considered a requirement for antitrust prosecutions. Most of the economics/antitrust experts favored by Democratic Party legislators or possible Presidents seek a return to the pre-Reagan enforcement standards, or new standards based on the unique economics of new tech-enabled platform business models.
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
This obviously doesn't work for anonymous sign in, but there's not much we can do about that.
I use a 2013 MacBook Pro to develop a cross platform app and have purchased multiple used phones to test and develop with for a lot less than $500. And if you're not making it all up, you're highly incompetent.
A $4k computer and $500 phone are entirely unnecessary.
Also, App Store approval doesn't take days. It takes hours.
So, what we see here is a dictatorship of a monopolist player to lock users into their own ecosystem. That's a weak move that shows how insecure Apple is as to users' churning. Shame.
As for the users opting in to have their emails directly relayed and read by apple .... i don't know what to think of it.
Developers could remove other login choices in favor of their own email based login.
If you only had 3rd party logins, then you can either remove them and develop a single first party login, or add Apple's login (which is likely much easier and safer). It's pretty clear to me what the incentives look like for developers these cases, and they don't seem like they could result in less choice.
This is a much smaller issue for me than "no alternative browsers" or "no sideloading".
It should just be a way to login and nothing else.
The number of privacy conscious users is minuscule compared to the rest of the market (I'd love to be some evidence otherwise) and Apple is a corporation. Its way forward is clear.
Even Facebook can say that they will not have data centers in non democratic countries. Something that Apple can’t say. Since FB isn’t allowed in most non democratic countries, even it can spin their business model to their advantage.
A) Google could choose to start a business selling high margin hardware so it wouldn’t need to sell targeted ads?
B) Apple could choose not to sell in the world’s most populous country? How would the shareholders or board feel about that?
Given that, I wouldn’t say this is a mere Rorschach test.
It’s not exactly the same behavior at all.
If we have a modest app and it’s thing much of a struggle to cross all the t’s and dot the i’s... I highly doubt there is a lot of malware getting through.
A cynical read on the situation but it’s as valid as any.
It’s kind of a stretch to suggest they aren’t pro-privacy, given the intentional features they provide: https://www.apple.com/privacy/
I'm not an ios user but my understanding is that you can't install 3rd-party software on it (including your own!) without an apple account
phone home is always slimy
It is indeed quite hard to imagine Google doing virtually anything to allow users to be more anonymous on their spyware OS.
You can still sign in with one of those social providers. You can always put your money somewhere other than Apple.
Seems no real justification other than Apple can use its power.
Apple not permitting apps that display certain types of legal content in the App Store is not a benefit to users that like to produce or consume those types of content. Censorship sucks, even if Apple is legally permitted to do it because it’s their store. It’s rude.
Hopefully the rumor that Apple is soon going to let you select a different default browser/mail/music/photos app is true, and this will be less of an issue.
It will still be an issue because of the many types of apps that Apple simply censors entirely from the store, from Tumblr to Tor to VPNs in China.
I worked for Spotify, and apple did all kind of hoopla to delay/deny the iOS updates....
My favorite one: If you did tap at one of the support/help tabs, it would open a webpage, which contained the support text, and the app got rejected, because after about THREE links, that would lead to the homepage, and there was a premium offer, and you can't have it.....
They kept denying updates for reasons like that....
"Coincidentally" they released their streaming service that month....
That's extremely anti-competitive..... and it wasn't done for the benefit of the user, but for the benefit of Apple only. When a user buys a phone, they have a reasonable expectations that other apps would work, and you will not be forced to use apple only services (directly or indirectly).
I.e. they are false advertising their phones.....
They could have said, if your app has social network log in, must support a more anonymous way as well.... and not must support Apple's login service..... which might/might not be good for users....
So it seems pretty targeted:apps that provide FB or Google sign in must also provide Apple sign in, which has an anonymous option.
As a user I’m loving this. Worrysome use of AppStore power aside...
Don't develop for evil companies. I tried explaining this to my coworkers but they couldn't see beyond the $$$. Now I understand why Engineers take a 2 hour ethics class.
It effectively forces apps to have an anonymized email login option, and even better, if said app starts abusing its access to my inbox, I can cut it off permanently even if the app offers no such option.
- He says, Apple is pro privacy - He redirects systematically with some 301 all monopolistic apple moves to Facebook concerns or Google. - Finally he has a fallback gateway when discusing "don't buy apple" if you go with "I want to be free about that thingy in my iPhone"
Apple is pro Money, and all it does is 2 things now : - More Money - Brand image building, apple is PC , apple is the PC Fraternity of southPark haha, and blind supporters are its members.