Apple, please support OAuth for iCloud

From June 15 2017, Apple has made it mandatory for iCloud users to use app-specific passwords if they want to use their accounts on third party apps. It is understood that this step was part of their ongoing efforts to ensure strong security for customers

So what is an app-specific password then? App-specific passwords are single-use passwords for your Apple ID that let you sign in to your account and access the information you store in iCloud from a third-party app.

An app-specific password does add another layer of security but having to remember or keep track of a second password for a service which can be used only for a single app does not make a compelling argument to use one.

One of the cons of App-specific passwords is that they provide access to the user’s entire data even if the app does not necessarily need that data. For example, A calendar app which has access to an App-specific password will have access to your iCloud files even if it is not needed.

You might ask, “Is there any other alternative?”. The answer is a resounding ‘YES’ and the solution is called OAuth. Now, what is OAuth? OAuth is simply a secure authorization protocol that deals with the authorization of third party application to access the user data without exposing their password.

Services like Gmail, Hotmail/Outlook have started supporting OAuth for their services a long time ago. Recently, even Yahoo joined their ranks and started supporting OAuth for all Yahoo accounts. However, Apple does not seem to like this idea. Developers and Apple customers have been requesting this of Apple from some time and till now, their requests fell on deaf ears.

Now that Apple is concentrating their efforts to make their user’s data more secure, the stage has never been this perfect to introduce OAuth support for iCloud. On one hand, Apple users will be able to enter their account credentials without having to worry about how their sensitive data is being used. On the other hand, the developers will be able to integrate it into their apps easily without having to worry about storing user credentials securely.

With so many obvious advantages, why is Apple not taking an initiative to support OAuth for iCloud accounts? Apart from Apple trying to keep its users in its own Eco-system, there aren’t many reasons as to why Apple should not support this. While there are some risks associated with OAuth, many users wouldn’t mind being a little more careful than having to remember a different password for every service they use.