By Glenn Fleishman
Sign in with Apple: convenient logins, broken email
Like many people nestled in the bosom of Apple’s ecosystem, I appreciate its general attitude towards data and personal privacy. I loved it when it gave the advertising industry a big middle finger with Ask App Not To Track, the most amazing phrasing for “I don’t give consent, and my friend Apple is backing that up.”1
When Sign in with Apple was launched as a complement to the existing Hide My Email feature, I was all for it. Hide My Email—part of iCloud+—lets you generate an anonymized iCloud relay address from the Mail app’s From line and a settings pane (among other places). The Website or app gets the anonymized address; if they use it send you email, that’s relayed to you.
Sign in with Apple provided a privacy-enhancing alternative to signing in via Google, Facebook, and others.2 Because those companies don’t have the same commitment to strict privacy, Apple seemed like an excellent alternative. (You don’t need iCloud+ to use it.)
An address created with Hide My Email might look like 80theorem-pistil@icloud.com. One created with Sign in with Apple typically follows a form like fc519smxsm@privaterelay.appleid.com. If you start receiving email you don’t want to those locations, you can click Deactivate Email Address (Hide My Email) or Stop Using Apple Account (Sign in with Apple). You can also temporarily disable forwarding to your iCloud address.3
The forwarding address is always to your main iCloud address—which can be an me/mac/icloud.com one or your own email addresses elsewhere—or an iCloud alias you’ve defined. I expect most people with an Apple ID have an iCloud address associated with it, though some might use iCloud.com to forward incoming email to another account. Given my experience and what I hear from readers, I am going to assume that 97% of people using Sign in with Apple don’t do that: the mail is delivered to their iCloud address and sits in their iCloud inbox.4
While Hide My Email addresses are ones you deploy to use with one or many sites or apps, and thus can receive email from anywhere, Sign in with Apple is highly restricted. As part of preserving your privacy, Apple requires that apps and sites that use Sign in with Apple also register a limited set of domains or email addresses, and use specific kinds of extra validation in their DNS (Domain Name Service) mail records. Apple notes:
This means that only emails sent from designated email addresses by the app or website will be automatically forwarded to the verified email address set on your Apple Account.
Would that were that case! Instead, Sign in with Apple is a great way to sign up for an account and then seemingly never receive any important emails from them again, as well as forgetting you used Sign in with Apple to set up an account.
Kickstopper
As someone who has run Kickstarter campaigns that have crowdfunded about $1.5 million for my own projects and those of other people, I have some intimate experience with the limitations of Sign in with Apple. Kickstarter supports Sign in with Apple, and it’s one of the biggest time wasters for campaign backers and campaign managers. It frustrates campaign backers—who think we are incompetent or they did something wrong—while wasting billable hours for clients as I run down backers who can’t be reached.
Kickstarter supports its own email-based account plus Facebook and Apple for third-party SSOs. When you have a campaign that has a lot of people new to Kickstarter, the Sign in with Apple button is quite appealing: click it, choose Hide My Email (which sounds appealing), and proceed. You’re in! And then, it turns out, many people forget they did this.
Managing a campaign for my book Six Centuries of Type & Printing, and one for Dan Perkins (a.k.a. Tom Tomorrow), I found that the consistent problem I and we had in communication and in finishing out a subset of all pledges was Sign in with Apple.
I can’t tell whether or not Kickstarter has checked all the right boxes with Apple, but I am going to assume so. Looking at the company’s DNS records, which are public, it has a number of entries related to mail, including ones that let a domain owner specify which mail servers are valid for handling outgoing messages, and a digital signature that validates outgoing mail.
I’ll keep Kickstarter as the example, because it is a proverbial “good egg”: it doesn’t spam customers (or campaign backers) and it allows an easy opt-out of campaign-related email. So why would its email go astray? I have some thoughts:
- Apple is so strict with incoming iCloud email that it bounces messages silently to
privaterelay.appleid.comaddresses even when the sending app or Web site has met Apple’s requirements. - People don’t realize the email is being forwarded to their iCloud email, and they don’t look at that mail regularly, or maybe ever. They use iCloud and don’t think about an associated iCloud account.
- People with a non-iCloud Apple ID have an email host or forward to such a host have the messages filtered, because that host decides they looks sketchy and drops them in the spam filter or blocks them.
Whatever the case, including other scenarios I haven’t proposed, it feels impossible to rely on your recipients getting messages this way.
Kickstarter has an even more extreme problem, which is that the service doesn’t offer everything I need to fulfill projects. After every campaign, I need to contact backers to get their shipping information or email, send them tracking numbers for physical items, send download links for digital items, and follow up when they don’t respond via Kickstarter’s messaging system and haven’t provided information. The privaterelay.appleid.com addresses silently block email.5
As a Kickstarter backer, or a customer of any business, all of this makes me rightly shy away from using Sign in with Apple because I’m not sure I will ever receive the messages I need.
In addition to not receiving email or checking it, there’s an aspect of sites using single-sign-on that I’ve encountered that exacerbates this. As far as I know, someone arriving at a site where their login session has expired and they have previously used Sign in with Apple have no special alert or insight. They are faced, as I have been, with a set of login options.
If you don’t remember that you used Sign in with Apple, there’s no way to check from that page. Instead, you have to go to Settings/System Settings: your name: Sign in with Apple to review logins.
Sign me up for notifications of improved service
Apple can fix this:
- Instead of blocking all messages for
privaterelay.appleid.comaddresses, Apple could use a combination of spam scoring and a page from its new Unknown Messages/Callers category in FaceTime, Messages, and Phone. Don’t bitbucket all messages. - Apple could alert us the first time we receive a message to a
privaterelay.appleid.comaddress that isn’t from a site-registered source, and let us opt into or out of receiving messages from specific domains or email addresses that use it. - In addition to providing a token to sites that use Sign in with Apple, Apple could provide a token that could be included in an email footer for messages that need to be sent outside of the approved channels. (This would solve the Kickstarter issue.)
- Prioritize authorized
privaterelay.appleid.commessages so that even people who don’t check their iCloud mail regularly have a mechanism for alerts. I’d gladly opt into notifications or other prompts when I received messages from a site that I used this workaround on.
I get Apple’s intent here, and I generally appreciate it. But the restrictions it has set have proven not to match up with the reason for this feature: people want to receive email from the sites and apps they register with, and have an easy way to stop getting those messages if and when those addresses are abused by the sender or leak out to the broader Internet and become targets of spam.
- The previous voluntary Do Not Track flag had failed because it required an opt-in by ad networks and browsers, but it was conceptually a huge success. Apple didn’t use the same name clearly to avoid confusion and send a more passive-aggressive message. ↩
- This is called Single Sign On (SSO), as a single account of yours gives you access to many resources. It’s typically used in enterprises (corporate networks) for internal resources and external ones, like Slack or Google Workspace. ↩
- These options appear with slightly names and features if you navigate via Settings/System Settings > your name > Sign in with Apple (for those addresses only) or Settings/System Settings > your name iCloud > Hide My Email (for either kind). It’s peculiar. ↩
- You can also use iCloud.com to set up forwarding rules, so that messages to a specific address, which can include an alias (if you defined one), is forwarded offsite. I have to believe that 0.01% or fewer of Apple users deploy iCloud.com rules. ↩
- Kickstarter has an integrated pledge manager for collecting shipping fees and shipping addresses, but it’s not mandatory, and there are two competitors for this part of the business. Kickstarter also lets campaign organizers send digital codes and links and upload tracking numbers. Unfortunately, I’ve found this feature is broken in practice, and have told the company and provided follow-up that dates back nearly a year about fixing them. ↩
[Glenn Fleishman is a printing and comics historian, Jeopardy champion, and serial Kickstarterer. His current books in preparation, which you can pre-order, are Flong Time, No See, and That One Matt Bors Comic. Other books include Six Centuries of Type & Printing and How Comics Are Made.]
If you appreciate articles like this one, support us by becoming a Six Colors subscriber. Subscribers get access to an exclusive podcast, members-only stories, and a special community.