undefined | Better HN

0 pointsswagonomixxx5y ago0 comments

The anonymous e-mail that Sign-In with Apple generates forwards to the e-mail used to set up your Apple ID. So it's not like it's a random e-mail that acts as a /dev/null.

This is by far the biggest selling point of Sign-In with Apple for me and I will continue to use it, and continue to not use apps that don't support it. I have plenty of e-mail aliases, but having an alias auto-generated for you is very convenient, and not having to generate a secure password is also very convenient.

The day AnyList gets hacked (not saying it will - but it's highly likely, the way security has taken a backseat due to "features") then at least my personal e-mail and password won't be there for every hacker on Earth to see and try to spam passwords to get into all of my other accounts.

0 comments

renewiltord5y ago

Perhaps you don't use AnyList? It doesn't make sense to use with a private mail relay because they use email as an addressing system. And honestly, few users will go look up their per-app address and tell people to add them.

KeepFlying5y ago

This is where their article lost credibility with me. Their decision to base their sharing and addressing system on email was their mistake, and Apple is just the first to force them to face their mistake.

I don't want to share my spam email with all my friends to get them to share with me. And I don't want to give my primary email to an app that will spam me.

If I want to share something, I'll send a link and the recipient can connect to me that way. I don't need to search them within the app to get in contact, that's useless.

> so when they enter your email address, our systems will believe that you don’t have an account. At that point, you’ll get an email from us asking you to create an account.

This is a trivial part of the problem to solve. Why am I being asked to create an account in an invite email? Why not "log in or create account" and having the link itself be the piece that connects the share to me.

JAlexoid5y ago

It's not a mistake, by any means.

It's dead clear that you don't work with consumers. Your technical bias shows what you care about and you're(an me) are an utter minority.

If you want security, btw - you should have multiple passwords for different things. And ideally not even use a password manager.

1 more reply

swagonomixxxOP5y ago

Ah, I wasn't aware that e-mail was used as an addressing system within AnyList. Do users not have any usernames associated with their e-mails?

Still, I think in this day and age, having a requirement in your product that says "e-mail that is provided should be the one the user uses the most" is pretty naive. In general, it's true, but when it comes to 3rd party authentication providers like Facebook, Google, and now Apple, this kind of requirement is not really useful and will likely cause issues for you down the line, which is why usernames are better for addressing people within apps (e.g, Instagram handles).

renewiltord5y ago

It is rather unusual, honestly. Even Venmo uses just an app-specific name. That's probably a lesson in product design: have your own usernames.

1 more reply

ajhurliman5y ago

Small nit: Potential hackers would only have access to your email, provider id and whatever other details they pass along (preferred name, profile picture URL, etc.). Social login doesn't provide consumers (AnyList in this case) with your password.

swagonomixxxOP5y ago

Agreed, social login like Facebook et. al do not provide passwords to consumers, but e-mail is already contentious enough.

Most people use the same e-mail for every single account they have. A large majority of these users use the same password for all of their accounts. (Just want to clarify that I do neither of these things - I have a large set of e-mail aliases and have a unique & secure password for each account I have to set up manually).

If you'll grant me that fact, then all I need is your e-mail from a dump of AnyList's users table, and look up that e-mail in my already vast database of dumped tables, and see that your password was "hunter2". Now I have access to your bank account, because you used the same e-mail and password for that account as well.

This is a bit of a contrived example, but in general, any personal information that is leaked (e-mail included) is bad - full name, address, and the like, which many websites ask for, is even worse, because crackers have even a better shot at guessing a lot of your personal information, and at that point, the ball is in their park.

JAlexoid5y ago

FYI: Getting a hold of someones' email isn't particularly hard.

Aeolun5y ago

So you say you are using your email as the unique identifier instead of the password?

If you use a unique password for every service, what would you need a unique email for?

ogre_codes5y ago

> If you use a unique password for every service, what would you need a unique email for?

Because then you control when the flow of marketing or "Service" related email stops. And you can tell which vendor leaked your email either deliberately or by accident.

j / k navigate · click thread line to collapse

0 comments

renewiltord5y ago

KeepFlying5y ago

I don't want to share my spam email with all my friends to get them to share with me. And I don't want to give my primary email to an app that will spam me.

If I want to share something, I'll send a link and the recipient can connect to me that way. I don't need to search them within the app to get in contact, that's useless.

> so when they enter your email address, our systems will believe that you don’t have an account. At that point, you’ll get an email from us asking you to create an account.

JAlexoid5y ago

It's not a mistake, by any means.

It's dead clear that you don't work with consumers. Your technical bias shows what you care about and you're(an me) are an utter minority.

If you want security, btw - you should have multiple passwords for different things. And ideally not even use a password manager.

1 more reply

swagonomixxxOP5y ago

Ah, I wasn't aware that e-mail was used as an addressing system within AnyList. Do users not have any usernames associated with their e-mails?

renewiltord5y ago

It is rather unusual, honestly. Even Venmo uses just an app-specific name. That's probably a lesson in product design: have your own usernames.

1 more reply

ajhurliman5y ago

swagonomixxxOP5y ago

Agreed, social login like Facebook et. al do not provide passwords to consumers, but e-mail is already contentious enough.

JAlexoid5y ago

FYI: Getting a hold of someones' email isn't particularly hard.

Aeolun5y ago

So you say you are using your email as the unique identifier instead of the password?

If you use a unique password for every service, what would you need a unique email for?

ogre_codes5y ago

> If you use a unique password for every service, what would you need a unique email for?

Because then you control when the flow of marketing or "Service" related email stops. And you can tell which vendor leaked your email either deliberately or by accident.

j / k navigate · click thread line to collapse