Apple’s sign-in insecure

Stefan Mileschin · 5th July 2019, 15:59

You get that when you mess around with standards

An outfit behind the OpenID open standard and decentralised authentication protocol, has penned an open letter to Apple saying its "Sign In with Apple" feature is insecure.

The OpenID Foundation said that Apple has built Sign In with Apple on top of the OpenID Connect platform, but the Cupertino company's implementation is not fully compliant with the OpenID standard. As a result, it "exposes users to greater security and privacy risks".

OpenID Foundation Chairman Nat Sakimura said: "The differences between OpenID Connect and Sign In with Apple reduces the places where users can use Sign In with Apple and exposes them to greater security and privacy risks."

The OpenID Foundation published a list of differences between Sign In with Apple and the OpenID Connect platform, which Sakimura urged Apple to address.

The OpenID exec said these differences place an unnecessary burden on developers working with both OpenID Connect and Sign In with Apple, who now have to support two different authentication standards and deal with each one's quirks.

"By closing the current gaps, Apple would be interoperable with widely-available OpenID Connect Relying Party software", Sakimura said.

https://fudzilla.com/news/48997-appl...gn-in-insecure

5th July 2019, 15:59	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 153,541	Apple’s sign-in insecure You get that when you mess around with standards An outfit behind the OpenID open standard and decentralised authentication protocol, has penned an open letter to Apple saying its "Sign In with Apple" feature is insecure. The OpenID Foundation said that Apple has built Sign In with Apple on top of the OpenID Connect platform, but the Cupertino company's implementation is not fully compliant with the OpenID standard. As a result, it "exposes users to greater security and privacy risks". OpenID Foundation Chairman Nat Sakimura said: "The differences between OpenID Connect and Sign In with Apple reduces the places where users can use Sign In with Apple and exposes them to greater security and privacy risks." The OpenID Foundation published a list of differences between Sign In with Apple and the OpenID Connect platform, which Sakimura urged Apple to address. The OpenID exec said these differences place an unnecessary burden on developers working with both OpenID Connect and Sign In with Apple, who now have to support two different authentication standards and deal with each one's quirks. "By closing the current gaps, Apple would be interoperable with widely-available OpenID Connect Relying Party software", Sakimura said. https://fudzilla.com/news/48997-appl...gn-in-insecure

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Apple TV's zero sign-on is live, starting with Charter Spectrum	Stefan Mileschin	WebNews	0	20th December 2018 09:27
Apple's iOS 11.3 may use iCloud as a single sign-on for websites	Stefan Mileschin	WebNews	0	5th February 2018 06:22
Iphone X face recognition insecure	Stefan Mileschin	WebNews	0	16th November 2017 19:40
Apple's 'single sign-on' feature now works with HBO Go	Stefan Mileschin	WebNews	0	29th January 2017 14:51
ESPN brings Apple's handy single sign-on tool to its iOS apps	Stefan Mileschin	WebNews	0	11th January 2017 07:07
Android most insecure OS of 2016	Stefan Mileschin	WebNews	0	4th January 2017 20:47
Apple is close to launching single sign-on for Apple TV	Stefan Mileschin	WebNews	0	7th November 2016 06:33
Apple's medical research kit gets thousands of sign-ups	Stefan Mileschin	WebNews	0	13th March 2015 07:33
Majority of mobile apps are insecure	Stefan Mileschin	WebNews	0	16th September 2014 08:41
iPads too insecure for British cabinet	Stefan Mileschin	WebNews	0	5th November 2013 08:10