Unexpected risks of using Apple ID: 'Sign in with Apple' will be blocked for Epic Games
- Reference: 1599744009
- News link: https://www.theregister.co.uk/2020/09/10/unexpected_risks_of_using_apple/
- Source link:
[3]
Any user with an Apple ID has been able to use it to sign into Epic Games, but Apple will shortly block this from working
The ability to sign with Apple is not directly connected to running an Epic game on Mac or iOS. Rather, it is an option for a user to use their Apple ID as an identity for Epic Games as a third-party site. This can be convenient for users as it means they have one less password to keep track of. The same identity service is offered by Google, Facebook, Microsoft and others. It can be more secure to use one or two identity providers run by top technology companies, rather than using separate logins for every internet service, since the likes of Google and Apple are likely to run more secure systems.
Epic [4]said in an update to users that: “Apple will no longer allow users to sign into Epic Games accounts using 'Sign In with Apple' as soon as September 11, 2020,” and urged its users to update the email address on their Epic account and to set an Epic Games password, so they will still be able to log in.
[5]
Apple touts “Sign in with Apple” as fast and easy, but does not mention the risk of lockout if it has a disagreement with the third-party
Get rich quick! Work from home! Earn $100,000 easy – just find a critical flaw in Apple's sign-in system [6]READ MORE
Some users may not do this in time, particularly if for some reason they missed an email from Epic entitled “IMPORTANT! Epic Games account update required for continued access.” The fact that Epic is requiring users to “update your email address with Epic Games” suggests that in some cases the email address held by the company could be wrong or missing. The email is critical as it includes a verification code that enables Epic to recover the account manually in case users do not respond in time. In the worst case, it seems plausible that users could lose access to their Epic Games account, more than inconvenient for those with a big investment in time and/or money.
Apple encourages users to “Sign with Apple”, claiming it is “fast and easy”, as well as respecting privacy. The ability to hide your email address is touted as one of its good features. However, The Reg missed the bit that says "If we have a dispute with the company you might get locked out."
It is a considerable escalation from simply [7]blocking applications from running on iOS .
That said, bug-hunter [8]Bhavuk Jain landed a $100,000 payday earlier this year after he reported a critical flaw in Apple’s sign-in system, potentially allowing an exploit that accesses all the user's accounts – from sites like Dropbox and Spotify to Airbnb.
Maybe using those convenient options to sign in with Apple, Google or Facebook is not such a good idea after all.®
Get our [9]Tech Resources
[1] https://www.theregister.com/2020/09/09/apple_epic_counterclaim/
[2] https://www.theregister.com/2020/08/14/epic_games_apple/
[3] https://regmedia.co.uk/2020/09/10/epicapple.jpg
[4] https://www.epicgames.com/help/en-US/epic-accounts-c74/connect-accounts-c110/how-do-i-retain-access-to-my-epic-games-account-after-sign-in-with-apple-ends-a6894
[5] https://regmedia.co.uk/2020/09/10/appleepic2.jpg
[6] https://www.theregister.com/2020/06/01/flaw_apple_sso/
[7] https://www.theregister.com/2020/08/14/epic_games_apple/
[8] https://www.theregister.com/2020/06/01/flaw_apple_sso/
[9] https://whitepapers.theregister.com/
Re: Users will lose the ability to log into an Epic Games account via "Sign in with Apple"
.. this is (primarily) an IT related news site.
I go elsewhere for my 4 horsemen of the apocalypse style news
Re: Users will lose the ability to log into an Epic Games account via "Sign in with Apple"
Poor baby. Epic Games is only "IT" as much as the movie business is. And like the movie business & Sports business, it's primary business is actually Entertainment.
Re: Users that they will lose the ability to log into an Epic Games account via "Sign in with Apple"
To the users who may be about lose all access to several hundred $/£ worth of games expediture it may well be.
I'll point out that it has been said many times here that using 3rd party 'anything' puts you at the whim of those third party companies.
Apple dumping on it's users who happen to have an Epic account seems a very short sighed move.
Re: Users that they will lose the ability to log into an Epic Games account via "Sign in with Apple"
Including the whim of a party who decide that the rules don't apply to them because they want more profit so proceed to screw their users over by picking a fight they can't win. The same party that thought the mess of console exclusives was too good a profit opportunity not to bring it to PC.
Epic dump on all PC gamers, not just the ones who play their games. Supporting them is the short sighted move.
Re: Users that they will lose the ability to log into an Epic Games account via "Sign in with Apple"
"Including the whim of a party who decide that the rules don't apply to them because they want more profit so proceed to screw their users over by picking a fight they can't win."
Sorry, are you talking about Epic or Apple?
Re: Users that they will lose the ability to log into an Epic Games account via "Sign in with Apple"
Nothing stops a user from linking an Epic ID to an Apple ID like just about every other account system that lets you use 3rd party credentials. Except a users stupidity. So while the Apple ID might be a convenience, the users didn't have to be locked out.
Re: Users that they will lose the ability to log into an Epic Games account via "Sign in with Apple"
This is where I normally would ramble on about the risks of DRM...
But I have refrained (low battery on my laptop). You are a lucky person.
Bad decision
Let Epic & Apple have their legal battles as much as they like.
Revoking the Apple related login at ludicrously short notice is bad for customers.
It mistakenly assumes
People check their emails almost daily.
People are in a position to check emails daily (e.g. someone on holiday, no access to their PC, shit reception so cannot get emails on their mobile)
Everyone will regard the "IMPORTANT" screaming email as legit and not some dodgy fishing attempt.
The Epic / Apple spat, should not be shafting customers - which this potentially can. Lets hope Epic put something in place so people who cannot change login method in time do not lose access (else I see legal action from customers flying toward Epic)
Disclosure - not an Apple user, not played an Epic game for probably a decade, so no skin in this game, just peeved that paying customers treated like irrelevant collateral damage by a big company
Re: Bad decision
I didnt actually see it completely spelled out in the article, but does anyone know if this Epic's decision to pull the Apple login? Or did Apple pull the login away from Epic?
Re: Bad decision
RTFA!
"Epic said in an update to users that: “Apple will no longer allow users to sign into Epic Games accounts using 'Sign In with Apple' as soon as September 11, 2020,” and urged its users to update the email address on their Epic account and to set an Epic Games password, so they will still be able to log in."
Done from Apple's end.
Re: Bad decision
“Done from Apple's end.”
Absolutely. But I can’t help but wonder : since when did Epic know about this ? Apple *requires* the option to use Apple ID for app on iOS that also offers other 3rd party authentication (FB, Google, MS). I don’t know if Apple ID sign in blocking is mentioned anywhere in the T&C’s of a developer account, but if it is Epic should have known when they knowingly breached those T&C’s.
Either way I don’t really care who wins. Though we have a couple of bets running in my team, Apple seems to get the best odds so I put my 5 euros there. I expect the winners will be able to collect in a decade or two.
Re: Bad decision
It's more like "Epic lost its developer account. So Apple isn't doing _anything_ for Epic right now. " Amongst other things, if _Epic_ asks Apple about "Sign in with Apple ID", they get a 403 access denied. Or is it 401? Or if Epic tries to send a push notification. That's one of many things Epic's 30% pays for.
Re: Bad decision
It’s the latter. Neither company has covered itself with glory in this whole saga, but this latest development is Apple being rather petty.
They might have shot themselves in the foot here; technically they’re entitled to withdraw AppleID support from any party with whom they’re in legal dispute, but it’s not going to reassure all the other companies/sites that use the service.
What next Apple, a patch for Safari so that it will refuse to load the Epic Games homepage?
Re: Bad decision
There is being in dispute, and there is being in court proceedings, that the other side had long planned. Epic was in deliberate and well planned violation of their developer agreement. They intentionally hid their changes so they were not detectable during a review. As a result, Apple is refusing to have any business relationship with Epic.
Screw them both, but I did notice this...
- "...Bhavuk Jain landed a $100,000 payday earlier this year after he reported a critical flaw in Apple’s sign-in system"
O.K., this might sound like "greedy me", but companies need to pay these bug hunters A SHIT TON MORE. I bet it will cost Apple more to disable this stupid login.
This reminds me of the early days of NBA, NFL, etc. when players were paid pittance for their time (and in this case physical health). What is really stark is that this is one of the highest valued US companies paying what...?
Am I missing something?
How does
"Never reuse passwords"
square with
"It can be more secure to use one or two identity providers run by top technology companies, rather than using separate logins for every internet service"?
Just getting ready to use my Facebook password to log into my bank account ...
Re: Am I missing something?
Never reuse your passwords: Because if you use a password to log in at shitty-security.com and they get hacked, or dodgy-site.com and they sell it, or even att.com and they tell it to whoever on the phone claims to be you, then people can use your password to log into your bank account. When you reuse passwords, all your accounts are only as secure as the least secure of them all.
If you use an identity provider, then any website you use that is hacked, dodgy or incompetent can at most reveal: "This guy's email address is xxx@gmail.com", and that doesn't let anybody log into your bank account. This of course assumes that the identity provider itself, whether facebook, apple or google, in not hacked, dodgy or incompetent.
Why is this happening?
The problem is that Epic didn't just manage to get Fortnite removed from the App Store, but they got their developer account removed. So anything related to Epic will stop working. I suppose to login with AppleID, these third party apps call an Epic server for help, and Apple doesn't talk to any Epic servers anymore. Well, it is a bit messed up.
The third party apps can probably fix this by doing login with AppleID on their own servers, under their own developer accounts.
How very petty
I have no idea if there is an underlying technical issue with this move, but Apple targeting Epic Games alone makes me think two things :
1) Apple is being extremely petty, on top of being unreasonable, inconsistent and a complete control freak
2) I would love to see how Apple justifies that in court
If there is a technical issue around the security of logging in with an Apple ID, then Apple should be cutting off that functionality for everything, not just for Epic Games.
It looks like Apple is on its way to becoming the Trump of the IT industry.
Users will lose the ability to log into an Epic Games account via "Sign in with Apple"
Oh, the horror of the inconvenience!
This is vastly more important than those pesky things people make stinks about like famine, genocide, and environmental devastation.