Thread by @hillbrad

Thread: Apple's recent policy change to forbid apps using social sign on from saving or using access tokens server-side is going to harm security, and well beyond for just users of Apple devices.

Remember that passwords are the #1 source of user security and privacy harm. Social sign in is the most usable, preferred alternative in use today. Password managers just aren't as easy and useful, especially for those who use apps across multiple platforms and devices.

The biggest source of abuse against single sign on systems comes on the client side, not the server side, when tokens leak to malware, malicious browser extensions, bad redirects, XSS, and apps impersonating other apps in the app store.

The mitigation for these weaknesses is to use a "code" flow, where the authorization process on the client only returns a code, which must be combined with a server-side secret to obtain an access token. It seems Apple's new policy forbids this long established best practice.

Why does this matter? Because apps and sign on providers now need to always support direct token flows. That might be fine if it were only for iOS apps. but a server can't tell. Once you enable token flows, all that malware can now just pretend it's an iPhone over the network.

There's no way to attest that an app is actually running on iOS. Apple could implement FIDO, and that would partially solve this, though it still wouldn't protect from impostor apps in the app store (it happens) or attacks using Mobile Safari.

And Apple's new policy also forbids apps from offering only social sign in. So get ready for more passwords - because Apple still doesn't support interoperable, standards-based password alternatives - and worse privacy, since the username will almost always be an email address.

It all makes me wonder. is it a coincidence that, against the industry wave of standardization, all of Apple's work on authN in the last 5 years has been tech that just happens to make it more difficult for people to use non-Apple devices or ever switch away from their products?

And do they really care that much about privacy (hello, Chinese market!) or is it that too many apps found that being free and ad-supported was a preferred way of doing business for them and their users compared to direct payments. (30% of which just happens to go to Apple?)

I guess we'll learn soon enough, if Apple starts demanding their vig on APIs like developer.apple.com/documentation/… once they've forced out other business models and put themselves in the middle of every way a developer might collect revenue from their app.