website or app in question. While that may not seem
much different from our current situation, the significant
change here is that Apple can do all of this without
sharing that information with the service in question.
Part of Sign In with Apple is the ability of Apple
to safeguard your personal information, such as your
email address; as previously discussed, the system will
even generate a random email address that points back
to your own account. Apple, essentially, intermediates
the authentication process, which puts the company
in the interesting position of being the arbiter of who
claims to be who.
This isn’t precisely a new role for Apple, either: Apple
Pay is built on a similar idea, with Apple obfuscating
your real credit card number in order to prevent fraud.
Payment vendors and banks alike have agreed to trust
Apple’s judgement as a middleman.Nice to meet you
Apple is in the rare circumstance to be able to take this
even further. The company has already implemented
a web of authentication, with systems in place to help
individuals prove that they are who they claim to be,
including knowledge factors (passwords and PINs),
ownership factors (devices like an iPhone or Apple
Watch), and inherence factors (biometric data), that
taken together can provide a pretty conclusive call on
the identity of a user.
But if Apple pointed these systems outwards, it could
help to provide more assurance that the people users
deal with are who they say they are as well. Imagine
if such a system could be used to verify that you’reiOS 13websiteorappinquestion.Whilethatmaynotseem
muchdifferentfromourcurrentsituation,thesignificant
changehereisthatApplecandoallofthiswithout
sharingthatinformationwiththeserviceinquestion.
PartofSignInwithAppleistheabilityofApple
tosafeguardyourpersonalinformation,suchasyour
emailaddress;aspreviouslydiscussed,thesystemwill
evengeneratea randomemailaddressthatpointsback
toyourownaccount.Apple,essentially,intermediates
theauthenticationprocess,whichputsthecompany
intheinterestingpositionofbeingthearbiterofwho
claimstobewho.
Thisisn’tpreciselyanewroleforApple,either:Apple
Payisbuiltonasimilaridea,withAppleobfuscating
yourrealcreditcardnumberinordertopreventfraud.
Paymentvendorsandbanksalikehaveagreedtotrust
Apple’sjudgementasamiddleman.
Nice to meet you
Appleisintherarecircumstancetobeabletotakethis
evenfurther.Thecompanyhasalreadyimplemented
awebofauthentication,withsystemsinplacetohelp
individualsprovethattheyarewhotheyclaimtobe,
includingknowledgefactors(passwordsandPINs),
ownershipfactors(deviceslikeaniPhoneorApple
Watch),andinherencefactors(biometricdata),that
takentogethercanprovide a pretty conclusive call on
theidentityofauser.
ButifApplepointedthesesystemsoutwards,itcould
helptoprovidemoreassurancethatthepeopleusers
dealwitharewhotheysaytheyareaswell.Imagine
ifsuchasystemcouldbeusedtoverifythatyou’re
iOS 13