Indian researcher finds security flaw with 'Sign in with Apple'

An Indian security researcher, Bhavuk Jain, has reportedly found a serious security flaw with Apple's 'Sign in with Apple' login service that was introduced with iOS 13 last year. 'Sign in with Apple' lets users protect their privacy by registering for apps and services with randomised email IDs, and in turn forwards mails from them to a user's actual email that remains protected. The flaw reportedly allowed a hacker to forge a token linked to any email ID and verify it as valid using Apple's public key, if the app or service didn't have its own security measures, potentially giving the attacker full control of the user account. Apple has reportedly fixed the flaw found in April, and awarded the researcher a $100,000 bug bounty.