At WWDC 2019, Apple announced, once again unveiled a bunch of shiny, overpriced technology.
You know that we love a Mac or two (Cortex HQ is littered with iMacs) but this isn’t about that - the big news that wasn’t about $5,000 cheese graters was Sign-In with Apple. On the scale of 1 to new Mac Pro - we think this one fell slightly under the radar in terms of its potential impact.
Sign-in with Apple is Apple’s foray into the federated login realm. If you want to know how it all works - then see here. TL;DR - it’s OAuth and OpenID.
Signing-in to stuff with other services is obviously not a new thing at all. We’ve been able to login to a load of stuff with our Google, Facebook and Twitter accounts - for ages. Big woop.
BUT the reason this has the potential to be an absolute game-changer for information security and protecting your privacy is the “hide my email” feature. Again - nothing, new - particularly - you’ve been able to do this with Gmail accounts forever - except the ease of use in this case plus the fact that it enforces 2FA to use it.
In simple terms, it allows you to sign-in to a service but Apple will provide that service with a single-use email - so they never actually see your real email address.
This is absolutely monstrous - how many of the data breaches that we’ve seen over the last few years have seen the attack vector being email address (and password) - as the means to authenticate? That we then see traversal attacks when you reuse email address (and password) across services? That email is typically the primary account recovery method and so if someone gets in to your email they moreorless own you?
In this case, the companies you are communicating with never see your real account details - and so - if they do get breached - the information that is breached is all but useless to anyone else. We wonder if this is almost becoming 3FA? As in - no longer can you have a distinct password, a secondary login - but you can now have a distinct email address. The potential to brute force this is computationally nil.
And the application doesn’t end there - how many times have you unsubscribed from something only to continue receiving emails or suspected that your email address has been sold on? You can no uniquely identify every single person who has your email address.
Of course - this means you become even more tightly embedded with Apple - and your primary account is still a major target - but we can’t help feeling that nowadays that is becoming harder and harder to avoid.
None of this hasn’t been tried before - but with a giant like Apple wading in to the mix; maybe this time it will have a big impact.
By Matt Thornton
Matt’s biggest (and most irritating) asset is his attention to detail. Whether it’s spotting bugs in code or spotting grammatical errors in other people’s work, Matt will find it and tell you about it.
Usually with an obnoxious smirk on his face.
After a long spell at University honing his analytical skills, gaining a PhD in remote sensing and computer science, Matt has spent the last 15 or so years applying them in Guernsey.
Don’t interrupt him if he’s in the zone - usual signs are air drumming, fixated stare on random object and/or swearing prolifically - unexpected behaviour may will result.