Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Can someone explain who is OpenID, what's the OpenID Connect Self Certification Test Suite, and why it is so important that Apple follows their spec?


OpenID Connect is a profile of OAuth 2 that adds authentication and identity information. Sign in with Apple was a partial implementation of OpenID Connect, for sharing authentication as well as an email address and the user's name between Apple and other apps/services.

As a partial implementation, there were both difficulties using existing third party libraries and known security issues in Apple's implementation. This was shown initially by manual inspection, then by Apple's implementation failing the freely available certification test suite published by the OpenID Foundation (I believe run by third parties, not Apple themselves).

The OpenID Foundation published an open letter both to ask Apple to fix these issues, and to inform other operators that there were security issues with Apple's implementation.

A complete implementation solves known security and interoperability issues.


OpenID Connect is a protocol for any site (and other software) to ask an identity provider who the user accessing the site is. Generally the user chooses one provider among those supported by the site (e.g. Google, Facebook, etc) and gets redirected to it, so it can authorize the authentication, then gets sent back to the site, and the site can now get info about them (usually some ID, and an email address).

This allows the site/user to avoid having to provide and store a password, since the site can just create an account and login the user based on the ID given by the provider.

Apple started using that protocol, allowing sites to authenticate users with them, but it broke a few parts of the standard, which meant the site developers couldn't use their normal libraries to connect to Apple's identity provider.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: