16 ms·

Pokemon Go is a huge security risk

780 points by patchoulol 10y ago

gesman 10y ago
So the solution is to create a throw away gmail account, I guess? Or not bother playing at all.
minimaxir 10y ago
Better/more neutral title: Pokemon Go asks for full Google permissions
- BenoitEssiambre 10y ago
  It doesn't ask though: "Normally you’d see a little message saying what data the app is going to be able to access - something like “This app will be able to view your email address and name”. For some reason that’s not shown in this case"
  - minimaxir 10y ago
    You're right, "asks" isn't the correct word and I apologize. The title could still be more neutral/explanatory, though.
- ceejayoz 10y ago
  I was not asked. I put in my username, password, 2FA, and that was it. No permissions dialog - I certainly wouldn't have given it admin rights to my Google Account.
- mortenjorck 10y ago
  Not really. There is absolutely no reason for a game, or pretty much any other kind of software, apart from maybe an operating system, to have full access to your Google account. It adds a new single point of failure for everything somewhere you have no control over – I don't think "huge security risk" is unnecessary editorial in this case.
- criley2 10y ago
  Even better title: "iOS users using Google Account sign-up affected by Pokemon Go permissions bug, Android unaffected"
Alexsandros 10y ago
I fond of e-sport. So it’s interesting for me to test new game. Pokemon go stole the scene at a grate pace. But this game is a really risky for cybersecurity. Maybe we don’t need such program.
seagray 10y ago
I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions I am running on a Nexus 6 and signed in with my Google Account when I first launched the app. Try revoking access and see what happens. Worst case, it might ask you to sign in again.
- jdc0589 10y ago
  ditto. Recent android phone. This worries me almost as much as the full access issue, cause I definitely signed it to my google account via the app yesterday.
- shkkmo 10y ago
  I also don't see any access granted to Pokemon Go, I signed in on my nexus 5x and was also in the field test.
- btown 10y ago
  It's possible it only does this on iOS, because I signed up normally using iOS and I see this at that link: https://dl.dropbox.com/s/bgii07rzoddj504/Screenshot%202016-07-11%2013.04.21.png?dl=0 https://dl.dropbox.com/s/bgii07rzoddj504/Screenshot%202016-0...
- mordocai 10y ago
  Just chiming in that I am another person (using a OnePlus One with cyanogenmod) that does not even see pokemon go in my "Apps Connected to your Account".
- criley2 10y ago
  I also do not have a Pokemon/Niantic entry in my list there. No idea what happened for OP
- chipgap98 10y ago
  Yeah I'm on a Galaxy S7 and signed up with my google account as well and see no mention of it on my connected apps page
Darsstar 10y ago
So, Pokemon Go is not listed under my account... Could it be the mallware version?
- castis 10y ago
  Should be listed as "Pokemon Go Release" here: https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions
- rtkwe 10y ago
  If you're on Android it's done properly through app permissions and doesn't encounter this issue.
randomh3r0 10y ago
Any idea how long the signup page is down? I made my account yesterday and, when forced between using my google auth and making some pokemon.com account, it was a no brainer to not use my google account. It took me a few tries but since this is a game and not something in the realm of life-and-death, I found it wasn't horrible to actually wait. And try again. The entire issue is predicated on using your google account credentials which isn't really mandatory. Maybe I'm overly cautious but I don't use my google account to auth anywhere. If that's the only option, and it's not a google product.. then it looks like I'm not using that service.
- arielweisberg 10y ago
  It's been down since at least last Thursday. The way I hear it it's been much longer.
  - randomh3r0 10y ago
    But, again, I made an account yesterday. <24h ago. So, is it _actually_ offline, or are people hitting the friendly little google button instead of just waiting? If it's the latter, then while I don't disagree about the gravity of requiring "All Perms" for a stupid game, I kind of feel like people deserve whatever happens for their impatience. Don't just throw around account access, no matter how pervasive, in the name of impatience. Ever.
    - arielweisberg 10y ago
      That's great news. I can't do it, but the error message has changed from 504 to try again.
    - MBCook 10y ago
      The game never asks for access, it's not clear in any way how much information you're giving them. In the past I've tried to use Google to sign in to some games and been given a screen that I noped out of because of what it was asking for. That didn't happen here. I assumed they only got my email address (if that), not full email/contact/calendar history. I checked my Google permissions. iOS has a fair amount, Mac OS X has a fair amount, Pokémon GO has more than both put together. Without asking. That's crazy.
arielweisberg 10y ago
And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that they didn't hoover up all the information they had access to they can be unbanned after a year. Unlikely though considering they used to be a part of Google.
- Alex3917 10y ago
  This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.
  - maxerickson 10y ago
    Google recommends using the browser workflow for installed apps too. https://developers.google.com/identity/protocols/OAuth2InstalledApp https://developers.google.com/identity/protocols/OAuth2Insta... Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not. Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use an app password: https://support.google.com/accounts/answer/185833?hl=en https://support.google.com/accounts/answer/185833?hl=en
    - jasalo 10y ago
      Did you try using an App password? Doesn't seem to work for me
      - maxerickson 10y ago
        No I haven't tried it.
    - 10y ago
NeonVice 10y ago
"[T]his section of the privacy page on the Google account settings website is only showing up for those that have played on iOS and signed in using the Google button. Android users who used the same login method are not seeing the “Pokemon Go Release” at all on the permissions site (nor do they see Ingress), so we’re not sure yet if those users have trusted Niantic with their entire Google account as well." source: http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-google-accounts-iphone/ http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-...
- onetwotree 10y ago
  Yeah it's not showing anything in my google app permissions. I assume it signed in using google play services (it was automatic, I never selected anything), and that's where the in app purchases seem to go.
- thevibesman 10y ago
  > Android users who used the same login method are not seeing the “Pokemon Go Release” at all on the permissions site (nor do they see Ingress) This is interesting, I can't test this myself as I have previously played Ingress on both iPhone and Android. My Android device is mostly for development/testing, so I'm not nearly as regular a user of the platform as I am for iOS. Could any Android users comment on if this is normal to not see Android apps like Ingress on this authorization list?
  - mr_potato_face 10y ago
    I've never played Ingress, but I've played PGO for android. Google account settings (https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions) shows an empty list for me.
thoreauway 10y ago
Doesn't Google OWN Niantic? So now Google has access to our Google data? Don't see the issue.
- andrewguenther 10y ago
  They no longer own them. They were spun during the housecleaning before the Alphabet announcement.
  - jfoster 10y ago
    Yep, though they also soon after made a further investment in Niantic. It may sound bizarre at first, but there might be good reasons why they did that. For instance, Nintendo might've been less likely to team up with a wholly Google-owned Niantic. (purely speculation on my part) https://nianticlabs.com/blog/niantic-tpc-nintendo/ https://nianticlabs.com/blog/niantic-tpc-nintendo/
    - pg_is_a_butt 10y ago
      more like google wants 2 layers of protection from the inevitable lawsuits from stalking victims and families of car crash victims caused by ingress or go.
    - ocdtrekkie 10y ago
      I strongly suspect a direct Google/Nintendo tie was considered less favorable than some little ex-Google company that still uses Google servers working on a Nintendo game. The announcement timing was pretty close.
- joelg 10y ago
  1. Google no longer owns Niantic, they spun off as their own company last year. 2. The security risk isn't that Niantic is going to turn evil, it's that Niantic becomes an access point for other (evil) hackers.
- deleted 10y ago
  [deleted]
Mendenhall 10y ago
Thing like this is why i dont use google, facebook etc and only have 4 apps. I love technology but it looks like hardly anyone is looking out for the consumer,let alone a non tech savvy consumer.
deleted 10y ago
[deleted]
godisdad 10y ago
Am I the only one who read this url as "adamEEVIE.tumblr.com" ?
toufka 10y ago
Isn't Niantic actually affiliated with (part of?) Google in some way? So it would seem natural, if odd, that it doesn't ask for full permissions for the account is actually already has full permissions to. In the same way google docs doesn't ask, but gets, full permissions to your google account, or google+ doesn't ask, but gets, full permissions to your google account.
- pritambaral 10y ago
  Google no longer owns Niantic
  - toufka 10y ago
    Well then that is a strange security lapse on Google's part. A spin-off company that had internal high-level access privileges, is spun off, and can still retains those high-level access privileges? That seems like a mistake somewhere.
    - pritambaral 10y ago
      I don't think there are any internal privileges involved here. Why do you think so?
    - ihsw 10y ago
      You can make an app that does the same thing right now. What are you talking about? It's developer laziness.
      - toufka 10y ago
        I don't know the android ecosystem well. Can any random app ask for and be granted full access without informing the user of that elevated access request?
        ihsw 10y ago
        That is a feature of the Google sign-in system. The security policies for that sign-in system are not as granular as Android's security policies. Normally an app would request permissions at run-time or install-time.
kamac 10y ago
> I really wish I could play, it looks like great fun, but there’s no way it’s worth the risk. Why not just create a separate google account if one's so eager to play?
- duaneb 10y ago
  Seriously; I created one just to avoid entering 2fa every time servers go down.
  - rickyc091 10y ago
    The pokemon trainer site does work, just requires a lot of refreshing...
    - duaneb 10y ago
      I tend to trust easy to revoke, well tried auth mechanisms over someone's home-grown version—especially judging by e.g. playstation network's terrible history. I simply don't trust Nintendo to not require me to reset my password with a breach, and I'm lazy as hell.
    - duaneb 10y ago
      Yikes, I had no idea who Monte Davidoff was. I've actually read his floating point routines! This is embarrassing; I wish I could edit my other post still. Anyway, my point stands—Bill started as a coder, good enough to code on the pdp-11(?); Steve never was one.
- MBCook 10y ago
  Why should I? Why should this be legal in the first place without asking my permission?
- nommm-nommm 10y ago
  Who uses their "main" Google account for these one off services anyway? I can't imagine it would be too popular to keep pseudo-anonymity. you don't want to post lol cats from the same account you use to send your resume, I would think.
nickpsecurity 10y ago
Here I thought the article was going to be on how Pokemon Go encourages people to wonder into dangerous or restricted areas while paying attention to their phone. The odds of someone getting attacked in a rough area would seem to go up with such an app given how critical situational awareness is. I don't know enough about how the app works to assess that, though. One app that got me thinking about these things was Google Maps. I noticed it directed me through The Hood of a murder capital to save 3 minutes on a route. An area where people are known to surround cars or level guns on their owners. I had to wonder how much more risk like this is in any GPS-enabled app that sends you from point A to B.
- teofilow 10y ago
  What city is this? Just curious. I don't know any such city in the United States
  - nickpsecurity 10y ago
    Just look up top 10 cities or metro areas for violent crime. Memphis Metro Area, in and around Memphis TN, is one of them on most years. We have lots of good areas and things going on with the worst stuff mainly in impoverished, minority areas. Lots of street gangs that maintain efficiency and image with armed robbery, murder to solve disputes, and/or initiation by murder of innocent, harmless people. Impoverished, white areas are fairly safe with their crooks mainly doing property crime or con jobs. Rarely violent. Most impoverished areas I've been have a mix, though. Middle-class and upper-class areas are also fairly safe outside property crime regardless of mix. Last I checked, city was going mostly Black with lots of Latinos coming in and Whites moving out due to crime. Actually, exits from all races for that. Often outside of Memphis but having jobs inside it. Economy & education keep going downhill predictably. Many companies refuse to deliver to certain areas or leave the city since theft overtakes profits quickly. Many make it, though, with beefed up security. Local grocer has 8 security guards for one store. Police themselves guard best, Chinese, food place. Haha. That's backdrop. Relevant here, North and South Memphis are largely the worst in terms of violence. You do not want to be in certain neighborhoods regardless of color. Even cops avoid them. Others are a risk more if you're white or look like you have property to take. Local media & cops suppress the worst of it to maintain tourism revenue (eg Elvis, BBQ) although the murders naturally get reported. Examples of censorship were kicking out The First 48 show and rape kit scandal. That Google Maps takes you right near those areas is probably why lots of people think the whole city is hood and trashed rather than just those parts. They never see the good parts unless specifically visiting them family, friends, jobs, or tourism. So, yeah, it's a real issue. I double-check Google Maps if I'm going anywhere Downtown, Midtown, North, or South as it doesn't differentiate risky vs non-risky areas. I regularly have to force it to make safer routes. Straight-up avoid certain areas of the city unless I'm packing heat & with backup. Otherwise, still all kinds of good things to get involved in over there with most folks being alright. We just in a rough area and economy. :) Note: As another example, BLM protestors sieged our Interstate (I-40) last night for hours then dispersed into Downtown. Local news cautioned everyone to stay away from that area for safety as it's normally dangerous but now unpredictable. Bad route at the least. Google routes still offering me a speedy trip through there, though. Unreal.
BadassFractal 10y ago
I detected that immediately when I signed up with google at first. No double-checking what I was ok with sharing with the company. Had to remove their permission from my account settings right away. Signed up with their email/password system, much better.
pg_is_a_butt 10y ago
uh... genius... niantic IS google. they can already read all your email. they already have full access. they have more access than you've ever had or could ever grant to anyone else. adam reeve is an idiot.
rwallace 10y ago
Caveat: I've seen a number of players state or imply that playing this game has been the first decent exercise they've had in years. Lack of exercise is a far greater threat to your well-being than having your Google account hacked, so if that's what it takes, go ahead and play the game anyway.
- ceejayoz 10y ago
  > Lack of exercise is a far greater threat to your well-being than having your Google account hacked... This is by no means universally true. Plenty of people get enough exercise outside of the app, and plenty of people have Google accounts for which compromise could be very significant. It should at the very least be disclosed in the OAuth flow that I'm giving away admin rights to the app. Facebook's flow won't even let me give away my email address without an explicit decision to do so. The current silent-but-deadly flow is inexcusably risky.
  - smilingtom 10y ago
    You're saying having your Google account hacked is worse for your health than never exercising? What is wrong with you?
- jonny_eh 10y ago
  Pokemon Go, like most apps, is likely just a fad. In a few months, only a few thousand die hards will still be playing it. But the full access permissions will still be there.
  - rwallace 10y ago
    Point. If you use a lot of things that require access permissions, maybe it should be part of your spring cleaning or some such to look through what you've given permission for, and cancel anything you haven't used in the last six months or whatever.
  - TheOneTrueKyle 10y ago
    That's what my parents said 20 years ago... hasn't died yet
gregorkas 10y ago
On Android 6.0 I got the correct permissions dialog and I was able to select what the app sees and what it can do. Is this just me?
- hortonew 10y ago
  I also see this. It asked for I think 4 separate permissions that you could allow or deny.
- chipgap98 10y ago
  But isn't that what the app needs from your phone? I always thought that was difference then what you are giving an app permission to do when using OAuth
  - rtkwe 10y ago
    On Android they're able to use the OS APIs to access that information because the google account is closely tied to the OS so the permissions there are basically permissions to the phone data because with Android they're pretty much one and the same.
drivers99 10y ago
"Pokemon Go Release" has "full access" and yet "Ingress" (a game very similar to Pokemon Go from the same company) only has "basic account info". I removed the access and when I started the app, it crashed right away. (I'm on iOS, by the way.) Subsequent launch I'm stuck on the "LOADING..." screen, and then it says "Failed to get player information from the server." I hope the servers are just down and I didn't lock myself out. (Or maybe I should be glad until this fix this breach.) Edit: Deleting the app and reinstalling allowed me to log in again. It appears to be the iOS version only that's doing this, according to this article: http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-google-accounts-iphone/ http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-...
- surge 10y ago
  When I signed up, it only said basic account info or that they'd like to know who I am. Nothing else.
- BryantD 10y ago
  When I checked this morning Ingress also had full perms. I revoked and reconnected and Ingress only had basic account info. I was also queried appropriately. Possibly this was fixed on Ingress sometime in the last X months but not on Pokemon Go.
  - biehl 10y ago
    Same here. I granted Ingress access in Nov 2015
- jaxondu 10y ago
  Apparently Google Maps also has full access to your Google account: http://sanziro.com/2016/07/pokemon-go-has-full-access-to-your-google-account.html http://sanziro.com/2016/07/pokemon-go-has-full-access-to-you...
ceejayoz 10y ago
This seems like a massive security fail on Google's part. There's no reason the OAuth flow should be able to request admin privileges silently. As a user, I really must get a prompt asking me (and warning me!).
zeffr 10y ago
It's a free game everyone. When something is free to play, and involves you walking around with geo services and a camera on, you and your data are the product. This is just massive data collection disguised as a video game.
- MBCook 10y ago
  No, they make their money through IAPs. No one signed up to let Niantic read their email in exchange for free items.
  - zeffr 10y ago
    Maybe no one on HN or in your circle of friends, but I think you massively overestimate the average user's sense of data protection.
    - MBCook 10y ago
      I'm willing to bet if you put a warning that said "This app will read your email" a ton of people would react. Not 100%, but a ton. Especially parents.
  - chrisdbaldwin 10y ago
    Okay. They are also selling user data.
- Mtinie 10y ago
  While that may be true, it isn't relevant to the conversation about how deep into the permissions forest the app is reaching. Pokemon Go can collect the bunches of the data it wants without having admin-level access to their users' Google accounts.
MBCook 10y ago
There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement. How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.
- greggman 10y ago
  Kids (under 13 in USA, under 16 in Netherlands) aren't allowed to have gmail accounts AFAIK https://support.google.com/accounts/answer/1350409?hl=en https://support.google.com/accounts/answer/1350409?hl=en
  - nommm-nommm 10y ago
    That's due to a Clinton era law Children's Online Privacy Protection Act of 1998 (COPPA). It forbids companies form collecting personal info from children under 13 without their parents permission.
    - Pxtl 10y ago
      What's funny is that nobody seems to provide a workflow to actually create accounts for kids. I want to set up a supervised google account for my son for hangouts et al... and I have no idea how. I guess that's not a thing.
      - nommm-nommm 10y ago
        It is for some services/websites that have policies in place. Google probably doesn't care enough to have a process, not worth it for them.
        nommm-nommm 10y ago
        Since I can't edit here is an example: http://www.neopets.com/coppa/consentform.phtml http://www.neopets.com/coppa/consentform.phtml Google doesn't care because it takes more effort for them to obey by the law than its worth for them at this time.
carsonreinke 10y ago
Why in the world would they do this? Or was this just merely an accident?
- sp332 10y ago
  Niantic used to be owned by Google, so they should know what they're doing.
  - rtkwe 10y ago
    It does work properly on Android. It only asks for access to Location, Contacts, Camera, and Storage.
    - sp332 10y ago
      Those are just things it has access to on your phone. That's not the permissions you give it on your Google account, which might include sending email as you. Those you can find here https://security.google.com/settings/security/permissions?pli=1 https://security.google.com/settings/security/permissions?pl...
      - pmlamotte 10y ago
        It doesn't appear in that list for me, curious if this is only affecting iPhone users and/or Android 5 and below.
        sp332 10y ago
        According to https://techcrunch.com/2016/07/11/pokemon-go-shouldnt-have-full-access-to-your-gmail-docs-and-google-account-but-it-does/ https://techcrunch.com/2016/07/11/pokemon-go-shouldnt-have-f... it also happens sporadically on Android 5 and 6, and iPhones.
      - rtkwe 10y ago
        I checked that page already. I can only speak for myself but for me it has no listing on the Google Permissions page so it looks like it does permissions correctly to me.
hughes 10y ago
If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.
- rickyc091 10y ago
  So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.
  - rbjorklin 10y ago
    Seriously? What happens if I delete the app? Do I delete all of my progress?
    - rickyc091 10y ago
      I've yet to try that, but I can. I'll report back in a few. Having trouble logging into my iPod... will see if I can get my coworker to remove it from his older device.
    - russjr08 10y ago
      Then you reinstall and all is fine. I went from using it on my Nexus 7 to my Nexus 5X and all of my progress was there.
  - h1fra 10y ago
    Not true, don't worry :)
    - rickyc091 10y ago
      This was the case on an android phone using Google login. His nexus 6X was on a beta build so he was unable to install the app. He started playing the game on an older device while he downgraded his 6X. After it was complete, he logged into his 6X using his google credentials and it prompted him to start over.
test6554 10y ago
Could you not simply create a new google account strictly for use with pokemon go?
- pritambaral 10y ago
  One could, but will everyone do that?
test6554 10y ago
Could you simply create a new google account for the sole purpose of playing pokemon go?
beckler 10y ago
It should be noted that it sounds like only iOS users are seeing this. I signed in with my Android, and I didn't see anything from Niantic or Pokemon Go in my security settings.
- generalledger 10y ago
  Same here (Android user), and I just double checked what apps have access to my google account, and nothing from Niantic or Pokemon Go listed at all.
eth1 10y ago
http://boards.4chan.org/pol/thread/80610796/pokemon-go-is-bad#p80618256 http://boards.4chan.org/pol/thread/80610796/pokemon-go-is-ba...
dopu 10y ago
I'm running iOS 9.3.2, and signing in to Pokemon Go caused it to have full access to my Google account. Just revoked it and looks like I can still play the game just fine. Perhaps they misconfigured the Google auth sign-in? It's rather worrisome that it's this easy for an application to gain full access to your account, though.
- quantumhobbit 10y ago
  I did the same. The app worked for a little while but bugged me to sign in again after a close and restart of the app. No thanks.
- csolo93 10y ago
  Did you check the permissions again? I did the same, running the same iOS version, and it just restored the same full-access when I opened the app again.
  - dopu 10y ago
    Yep, just checked. It's not here at all. Were you asked to sign in again after you revoked?
gg97 10y ago
I read people are chasing "pokemon" everywhere. I do not even know what a Pokemon is but I'm pretty sure Descartes would not care. Reading the press, I understand we may expect to see random people looking in their phone on the street chasing virtual pets. And still some people complains about the security risk of sharing his google account. Nobody seems to see the big picture. I guess that is the "Idiocracy" future we are being sold every day. Of course I will never ever chase a virtual pet in the street with my "dumb-phone". But this does raise questions for the future of humanity if hundred thousands of people do. That must be the end of the world.
- detaro 10y ago
  How is this any more "end of the world" than people watching TV?
  - gg97 10y ago
    Oh, are you chasing virtual pets 43 minutes 23 secondes per day in average too ? I'm sorry, really, I should think more positively of the future. My bad, will improve, promess ! Let's start by creating a facebook account, we will learn the pokemon thing after, one benefit per humanity at a time.
- dopu 10y ago
  The amount of self-aggrandizing and general contempt for people I see on HN really astounds me sometimes.
  - gg97 10y ago
    I'm all with you for general contempt for people on HN. I read everyday here the HN crowd claiming urgent need for an elite to set up a globalized centralized European Federal Union to get rid of nations and populism. I see people being bashed and insulted for supporting their own nation and not living for the NYSE. Let's just throw away states, cultures, religions, and build a global free market where everyone would be happy consumer. Maybe facebook and Jp Morgan can help in this mission. Let's celebrate the day when everyone will be chasing virtual pets on their phone. We're so in love with the people ! Pikachu !
mschuster91 10y ago
On a sidenote: does anyone know why the fuck are the servers so overcrowded? In a world with a whole bunch of automated cloud management solutions and auto-scaling, where is the problem?
nostrademons 10y ago
A lot of aspects of Pokemon Go are less than polished from an app dev perspective. The way they ask for device permissions doesn't follow best practices at all (no explanation of why they need them). The interface has too much explanatory text in some places (how much useless backstory did I need to click through to start playing?) and not enough in others (it took me forever to figure out what I was supposed to do once I found a pokemon). My sister-in-law was complaining about how all the pokemon graphics are very 2D, when they could easily have sprung for some shading or shadows. I suspect they built an MVP and launched it and it happened to take off, and we'll see some more polish in the future. For this particular issue though - I'd bet that Niantic has some sort of data-sharing agreement with Google, anyway, making this point moot. They started as an internal startup at Google, and they make really heavy use of the Maps & Places APIs that would probably cost a fortune if they didn't have some sort of bulk data sharing agreement.
tlrobinson 10y ago
Report it here: https://support.pokemongo.nianticlabs.com/hc/en-us/requests/new?ticket_form_id=319988 https://support.pokemongo.nianticlabs.com/hc/en-us/requests/...
throw7 10y ago
I see google Chrome gets full account access... I guess this is required? Or not?
cheshire137 10y ago
I know Google lets you see which apps are connected to your account via https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions but is there any page where I can see what activity was done on my account by particular apps?
RKoutnik 10y ago
It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security risk"? No more than putting your stuff in Google's hands in the first place. Niantic are also the folks behind Ingress, if you've heard of that. [0] Specifically, Alphabet owns a significant portion of Niantic, along with Nintendo: https://nianticlabs.com/blog/niantic-tpc-nintendo/ https://nianticlabs.com/blog/niantic-tpc-nintendo/ (they were previously wholly-owned by Google).
- deleted 10y ago
  [deleted]
- ja27 10y ago
  Google's own apps often don't request this much permission. Basic security principles.
  - cheshire137 10y ago
    Correct. Google Drive, for example, requires fewer permissions: https://pbs.twimg.com/media/CnG3kslW8AA1iZM.jpg:large https://pbs.twimg.com/media/CnG3kslW8AA1iZM.jpg:large
  - nissehulth 10y ago
    If you connect Chrome to your account it does get full permissions for some reason. Perhaps Chromebook-related?
    - Ezhik 10y ago
      Pretty much. Google was trying to cram the entire Chrome OS platform in their browser a while back (remember Chrome's Windows 8 mode?), although they've kind of taken a step back from it lately.
- 10y ago
Zigurd 10y ago
I got a number of permission requests at runtime the first time launching the app. If anything, it appears to be running into more of the Android 6 runtime permissions.
thecourier 10y ago
I'm usingn the android version. they aren't even a connected application. so no risk in Android.
julionc 10y ago
Jesus Christ, They wants to catch 'em all
ultramancool 10y ago
Title isn't exactly accurate - can we edit this to indicate iOS only?
Animats 10y ago
Where there's a security hole, there's an exploit.[1] [1] https://thestack.com/security/2016/07/11/infected-pokemon-go-apk-carries-dangerous-android-backdoor/ https://thestack.com/security/2016/07/11/infected-pokemon-go...
- Nadya 10y ago
  This is completely unrelated because it isn't exploiting anything (other than humanware) Any modified APK for any App could be loaded in with a RAT asking for full permissions. It just happens PKMNGO is popular and people are trying to get their hands on it before it is officially released in their region.
lowbloodsugar 10y ago
I'm more worried about my daughter getting hit by a car (because she walks in front of it, or because the driver is playing) than I am about my google account being hijacked!
- rasz_pl 10y ago
  How about your daughters naked selfies leaking because someone breached Niantic and leveraged access to gdrive?
raoulduke 10y ago
Here's a weird question. https://www.facebook.com/NationalMallNPS/photos/a.379580652053692.97287.151776458167447/1186299898048426/?type=3&theater https://www.facebook.com/NationalMallNPS/photos/a.3795806520... Pokemon Go is designed to not only augment places where people already are but also to direct them to other places. My friend just ran down the Ninatic/Google connection. Can the app be used to direct people away from polling places and/or to congest areas around polling places? To wit, would anyone be interested in tracking (I can do it for at least some locations) the locations of gyms in comparison to polling places? (I haven't used the app; can one get a location of gyms?) [lol. let me clarify my interest would be in thwarting rather than harnessing this possibility.]
- rasz_pl 10y ago
  screw pooling places, what about locations of businesses (restaurants etc) that spend serious $$ for Google advertising?
  - raoulduke 10y ago
    I mean... that'd be an issue. I don't think it'd be as big an issue as widespread electoral fraud or electioneering. But it'd probably be an issue...
- raoulduke 10y ago
  Also... the Clinton campaign just announced it would be having an event at a 'Pokestop,' and Clinton referenced the game. http://thehill.com/blogs/ballot-box/presidential-races/287792-clinton-campaign-holding-event-at-pokestop http://thehill.com/blogs/ballot-box/presidential-races/28779...
deleted 10y ago
[deleted]
peterjlee 10y ago
Seem like a issue with Google Auth on iOS. I've logged into Pokemon Go from my Android and iPhone. I revoked the access of "Pokemon Go release" from Connected Apps page then logged in again from my Android phone. "Pokemon Go release" doesn't show up in my Connected Apps page anymore even after a login from Android.
auganov 10y ago
Wow. This game must be the fastest thing to skyrocket into worldwide popularity. Yesterday I noticed someone on social media talking about it. "Some random game pokemon fans like" - I figured. Today it seems like everyone around the world is playing it. And it was released just a week ago? Never seen anything quite like it.
maknz 10y ago
Full access is bad enough, but the really dodgy thing going on is that you never get asked to approve or deny that access for Pokemon Go when doing the OAuth flow. You just log in, proceed through 2fa, and you're magically logged into the app. Pokemon Go Release then shows up as an authorised app... except I never authorised it. My theory is that they're injecting JavaScript into the web view to automatically press the 'Approve' button and hiding that from the user. If true, that's very worrying. They'd be effectively circumventing the whole OAuth framework by forging the user's approval of the app. Every user should have been asked up-front whether or not they wanted to approve or deny Pokemon Go's full access.
nappy-doo 10y ago
I spoke with a friend of mine at Niantic. They are in communication with the oauth group at Google, and are fixing the issue.
- voltagex_ 10y ago
  Can you also tell them to read a few Reddit threads, or Twitter? There are many, many issues which will limit the lifetime of this game.
lllorddino 10y ago
Just revoked access because the app never disclosed this information on signing up with my Google account. This is sick.
Dowwie 10y ago
I can't tell whether this game is the most heavily marketed social-media blitz of all time or truly viral. A virtual treasure hunt game finally gets people outside? Come on.
ChrisLTD 10y ago
Update from Niantic in this Game Informer article http://www.gameinformer.com/b/news/archive/2016/07/11/pokemon-go-has-access-to-your-entire-google-account.aspx http://www.gameinformer.com/b/news/archive/2016/07/11/pokemo... "We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves."
- eeeeeeeeeeeee 10y ago
  Impressed by the quick turnaround on this!
- andyjdavis 10y ago
  I actually just finished wrangling social log in for a system that is waaaay less popular than Pokemon GO. Rather amusing to see an organization operating at a vastly bigger scale still hitting the same sorts of speed bumps.
guillegette 10y ago
Funny enough, when I installed the game I didn't use my official Google account and I used my test one thinking about this. Glad I did it.
guillegette 10y ago
Funny enough when I downloaded the app I didn't use my official account and I logged in with a secondary account wondering exactly about this.
131hn 10y ago
kind of a scam, just a bad wording from google "full access" and old oauth workflow - but no real security threat TLDR: Pokemon Go can't read your gmail - he checked https://gist.github.com/arirubinstein/fd5453537436a8757266f908c3e41538 https://gist.github.com/arirubinstein/fd5453537436a8757266f9...
meowsus 10y ago
This article, though rife with paranoia, brings up some interesting points. http://blackbag.gawker.com/pokemon-go-is-a-government-surveillance-psyop-conspirac-1783461240 http://blackbag.gawker.com/pokemon-go-is-a-government-survei...
darkboltyoutube 10y ago
People die doing this: https://www.youtube.com/watch?v=B2KXVfnw4rg https://www.youtube.com/watch?v=B2KXVfnw4rg

780 points by patchoulol 10y ago

gesman 10y ago

So the solution is to create a throw away gmail account, I guess? Or not bother playing at all.

minimaxir 10y ago

Better/more neutral title: Pokemon Go asks for full Google permissions

BenoitEssiambre 10y ago
It doesn't ask though: "Normally you’d see a little message saying what data the app is going to be able to access - something like “This app will be able to view your email address and name”. For some reason that’s not shown in this case"
- minimaxir 10y ago
  You're right, "asks" isn't the correct word and I apologize. The title could still be more neutral/explanatory, though.
ceejayoz 10y ago
I was not asked. I put in my username, password, 2FA, and that was it. No permissions dialog - I certainly wouldn't have given it admin rights to my Google Account.
mortenjorck 10y ago
Not really. There is absolutely no reason for a game, or pretty much any other kind of software, apart from maybe an operating system, to have full access to your Google account. It adds a new single point of failure for everything somewhere you have no control over – I don't think "huge security risk" is unnecessary editorial in this case.
criley2 10y ago
Even better title: "iOS users using Google Account sign-up affected by Pokemon Go permissions bug, Android unaffected"

Alexsandros 10y ago

I fond of e-sport. So it’s interesting for me to test new game. Pokemon go stole the scene at a grate pace. But this game is a really risky for cybersecurity. Maybe we don’t need such program.

seagray 10y ago

I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions I am running on a Nexus 6 and signed in with my Google Account when I first launched the app. Try revoking access and see what happens. Worst case, it might ask you to sign in again.

jdc0589 10y ago
ditto. Recent android phone. This worries me almost as much as the full access issue, cause I definitely signed it to my google account via the app yesterday.
shkkmo 10y ago
I also don't see any access granted to Pokemon Go, I signed in on my nexus 5x and was also in the field test.
btown 10y ago
It's possible it only does this on iOS, because I signed up normally using iOS and I see this at that link: https://dl.dropbox.com/s/bgii07rzoddj504/Screenshot%202016-07-11%2013.04.21.png?dl=0 https://dl.dropbox.com/s/bgii07rzoddj504/Screenshot%202016-0...
mordocai 10y ago
Just chiming in that I am another person (using a OnePlus One with cyanogenmod) that does not even see pokemon go in my "Apps Connected to your Account".
criley2 10y ago
I also do not have a Pokemon/Niantic entry in my list there. No idea what happened for OP
chipgap98 10y ago
Yeah I'm on a Galaxy S7 and signed up with my google account as well and see no mention of it on my connected apps page

Darsstar 10y ago

So, Pokemon Go is not listed under my account... Could it be the mallware version?

castis 10y ago
Should be listed as "Pokemon Go Release" here: https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions
rtkwe 10y ago
If you're on Android it's done properly through app permissions and doesn't encounter this issue.

randomh3r0 10y ago

Any idea how long the signup page is down? I made my account yesterday and, when forced between using my google auth and making some pokemon.com account, it was a no brainer to not use my google account. It took me a few tries but since this is a game and not something in the realm of life-and-death, I found it wasn't horrible to actually wait. And try again. The entire issue is predicated on using your google account credentials which isn't really mandatory. Maybe I'm overly cautious but I don't use my google account to auth anywhere. If that's the only option, and it's not a google product.. then it looks like I'm not using that service.

arielweisberg 10y ago
It's been down since at least last Thursday. The way I hear it it's been much longer.
- randomh3r0 10y ago
  But, again, I made an account yesterday. <24h ago. So, is it _actually_ offline, or are people hitting the friendly little google button instead of just waiting? If it's the latter, then while I don't disagree about the gravity of requiring "All Perms" for a stupid game, I kind of feel like people deserve whatever happens for their impatience. Don't just throw around account access, no matter how pervasive, in the name of impatience. Ever.
  - arielweisberg 10y ago
    That's great news. I can't do it, but the error message has changed from 504 to try again.
  - MBCook 10y ago
    The game never asks for access, it's not clear in any way how much information you're giving them. In the past I've tried to use Google to sign in to some games and been given a screen that I noped out of because of what it was asking for. That didn't happen here. I assumed they only got my email address (if that), not full email/contact/calendar history. I checked my Google permissions. iOS has a fair amount, Mac OS X has a fair amount, Pokémon GO has more than both put together. Without asking. That's crazy.

arielweisberg 10y ago

And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that they didn't hoover up all the information they had access to they can be unbanned after a year. Unlikely though considering they used to be a part of Google.

Alex3917 10y ago
This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.
- maxerickson 10y ago
  Google recommends using the browser workflow for installed apps too. https://developers.google.com/identity/protocols/OAuth2InstalledApp https://developers.google.com/identity/protocols/OAuth2Insta... Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not. Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use an app password: https://support.google.com/accounts/answer/185833?hl=en https://support.google.com/accounts/answer/185833?hl=en
  - jasalo 10y ago
    Did you try using an App password? Doesn't seem to work for me
    - maxerickson 10y ago
      No I haven't tried it.
  - 10y ago

NeonVice 10y ago

"[T]his section of the privacy page on the Google account settings website is only showing up for those that have played on iOS and signed in using the Google button. Android users who used the same login method are not seeing the “Pokemon Go Release” at all on the permissions site (nor do they see Ingress), so we’re not sure yet if those users have trusted Niantic with their entire Google account as well." source: http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-google-accounts-iphone/ http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-...

onetwotree 10y ago
Yeah it's not showing anything in my google app permissions. I assume it signed in using google play services (it was automatic, I never selected anything), and that's where the in app purchases seem to go.
thevibesman 10y ago
> Android users who used the same login method are not seeing the “Pokemon Go Release” at all on the permissions site (nor do they see Ingress) This is interesting, I can't test this myself as I have previously played Ingress on both iPhone and Android. My Android device is mostly for development/testing, so I'm not nearly as regular a user of the platform as I am for iOS. Could any Android users comment on if this is normal to not see Android apps like Ingress on this authorization list?
- mr_potato_face 10y ago
  I've never played Ingress, but I've played PGO for android. Google account settings (https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions) shows an empty list for me.

thoreauway 10y ago

Doesn't Google OWN Niantic? So now Google has access to our Google data? Don't see the issue.

andrewguenther 10y ago
They no longer own them. They were spun during the housecleaning before the Alphabet announcement.
- jfoster 10y ago
  Yep, though they also soon after made a further investment in Niantic. It may sound bizarre at first, but there might be good reasons why they did that. For instance, Nintendo might've been less likely to team up with a wholly Google-owned Niantic. (purely speculation on my part) https://nianticlabs.com/blog/niantic-tpc-nintendo/ https://nianticlabs.com/blog/niantic-tpc-nintendo/
  - pg_is_a_butt 10y ago
    more like google wants 2 layers of protection from the inevitable lawsuits from stalking victims and families of car crash victims caused by ingress or go.
  - ocdtrekkie 10y ago
    I strongly suspect a direct Google/Nintendo tie was considered less favorable than some little ex-Google company that still uses Google servers working on a Nintendo game. The announcement timing was pretty close.
joelg 10y ago
1. Google no longer owns Niantic, they spun off as their own company last year. 2. The security risk isn't that Niantic is going to turn evil, it's that Niantic becomes an access point for other (evil) hackers.
deleted 10y ago
[deleted]

Mendenhall 10y ago

Thing like this is why i dont use google, facebook etc and only have 4 apps. I love technology but it looks like hardly anyone is looking out for the consumer,let alone a non tech savvy consumer.

deleted 10y ago

[deleted]

godisdad 10y ago

Am I the only one who read this url as "adamEEVIE.tumblr.com" ?

toufka 10y ago

Isn't Niantic actually affiliated with (part of?) Google in some way? So it would seem natural, if odd, that it doesn't ask for full permissions for the account is actually already has full permissions to. In the same way google docs doesn't ask, but gets, full permissions to your google account, or google+ doesn't ask, but gets, full permissions to your google account.

pritambaral 10y ago
Google no longer owns Niantic
- toufka 10y ago
  Well then that is a strange security lapse on Google's part. A spin-off company that had internal high-level access privileges, is spun off, and can still retains those high-level access privileges? That seems like a mistake somewhere.
  - pritambaral 10y ago
    I don't think there are any internal privileges involved here. Why do you think so?
  - ihsw 10y ago
    You can make an app that does the same thing right now. What are you talking about? It's developer laziness.
    - toufka 10y ago
      I don't know the android ecosystem well. Can any random app ask for and be granted full access without informing the user of that elevated access request?
      - ihsw 10y ago
        That is a feature of the Google sign-in system. The security policies for that sign-in system are not as granular as Android's security policies. Normally an app would request permissions at run-time or install-time.

kamac 10y ago

> I really wish I could play, it looks like great fun, but there’s no way it’s worth the risk. Why not just create a separate google account if one's so eager to play?

duaneb 10y ago
Seriously; I created one just to avoid entering 2fa every time servers go down.
- rickyc091 10y ago
  The pokemon trainer site does work, just requires a lot of refreshing...
  - duaneb 10y ago
    I tend to trust easy to revoke, well tried auth mechanisms over someone's home-grown version—especially judging by e.g. playstation network's terrible history. I simply don't trust Nintendo to not require me to reset my password with a breach, and I'm lazy as hell.
  - duaneb 10y ago
    Yikes, I had no idea who Monte Davidoff was. I've actually read his floating point routines! This is embarrassing; I wish I could edit my other post still. Anyway, my point stands—Bill started as a coder, good enough to code on the pdp-11(?); Steve never was one.
MBCook 10y ago
Why should I? Why should this be legal in the first place without asking my permission?
nommm-nommm 10y ago
Who uses their "main" Google account for these one off services anyway? I can't imagine it would be too popular to keep pseudo-anonymity. you don't want to post lol cats from the same account you use to send your resume, I would think.

nickpsecurity 10y ago

Here I thought the article was going to be on how Pokemon Go encourages people to wonder into dangerous or restricted areas while paying attention to their phone. The odds of someone getting attacked in a rough area would seem to go up with such an app given how critical situational awareness is. I don't know enough about how the app works to assess that, though. One app that got me thinking about these things was Google Maps. I noticed it directed me through The Hood of a murder capital to save 3 minutes on a route. An area where people are known to surround cars or level guns on their owners. I had to wonder how much more risk like this is in any GPS-enabled app that sends you from point A to B.

teofilow 10y ago
What city is this? Just curious. I don't know any such city in the United States
- nickpsecurity 10y ago
  Just look up top 10 cities or metro areas for violent crime. Memphis Metro Area, in and around Memphis TN, is one of them on most years. We have lots of good areas and things going on with the worst stuff mainly in impoverished, minority areas. Lots of street gangs that maintain efficiency and image with armed robbery, murder to solve disputes, and/or initiation by murder of innocent, harmless people. Impoverished, white areas are fairly safe with their crooks mainly doing property crime or con jobs. Rarely violent. Most impoverished areas I've been have a mix, though. Middle-class and upper-class areas are also fairly safe outside property crime regardless of mix. Last I checked, city was going mostly Black with lots of Latinos coming in and Whites moving out due to crime. Actually, exits from all races for that. Often outside of Memphis but having jobs inside it. Economy & education keep going downhill predictably. Many companies refuse to deliver to certain areas or leave the city since theft overtakes profits quickly. Many make it, though, with beefed up security. Local grocer has 8 security guards for one store. Police themselves guard best, Chinese, food place. Haha. That's backdrop. Relevant here, North and South Memphis are largely the worst in terms of violence. You do not want to be in certain neighborhoods regardless of color. Even cops avoid them. Others are a risk more if you're white or look like you have property to take. Local media & cops suppress the worst of it to maintain tourism revenue (eg Elvis, BBQ) although the murders naturally get reported. Examples of censorship were kicking out The First 48 show and rape kit scandal. That Google Maps takes you right near those areas is probably why lots of people think the whole city is hood and trashed rather than just those parts. They never see the good parts unless specifically visiting them family, friends, jobs, or tourism. So, yeah, it's a real issue. I double-check Google Maps if I'm going anywhere Downtown, Midtown, North, or South as it doesn't differentiate risky vs non-risky areas. I regularly have to force it to make safer routes. Straight-up avoid certain areas of the city unless I'm packing heat & with backup. Otherwise, still all kinds of good things to get involved in over there with most folks being alright. We just in a rough area and economy. :) Note: As another example, BLM protestors sieged our Interstate (I-40) last night for hours then dispersed into Downtown. Local news cautioned everyone to stay away from that area for safety as it's normally dangerous but now unpredictable. Bad route at the least. Google routes still offering me a speedy trip through there, though. Unreal.

BadassFractal 10y ago

I detected that immediately when I signed up with google at first. No double-checking what I was ok with sharing with the company. Had to remove their permission from my account settings right away. Signed up with their email/password system, much better.

pg_is_a_butt 10y ago

uh... genius... niantic IS google. they can already read all your email. they already have full access. they have more access than you've ever had or could ever grant to anyone else. adam reeve is an idiot.

rwallace 10y ago

Caveat: I've seen a number of players state or imply that playing this game has been the first decent exercise they've had in years. Lack of exercise is a far greater threat to your well-being than having your Google account hacked, so if that's what it takes, go ahead and play the game anyway.

ceejayoz 10y ago
> Lack of exercise is a far greater threat to your well-being than having your Google account hacked... This is by no means universally true. Plenty of people get enough exercise outside of the app, and plenty of people have Google accounts for which compromise could be very significant. It should at the very least be disclosed in the OAuth flow that I'm giving away admin rights to the app. Facebook's flow won't even let me give away my email address without an explicit decision to do so. The current silent-but-deadly flow is inexcusably risky.
- smilingtom 10y ago
  You're saying having your Google account hacked is worse for your health than never exercising? What is wrong with you?
jonny_eh 10y ago
Pokemon Go, like most apps, is likely just a fad. In a few months, only a few thousand die hards will still be playing it. But the full access permissions will still be there.
- rwallace 10y ago
  Point. If you use a lot of things that require access permissions, maybe it should be part of your spring cleaning or some such to look through what you've given permission for, and cancel anything you haven't used in the last six months or whatever.
- TheOneTrueKyle 10y ago
  That's what my parents said 20 years ago... hasn't died yet

gregorkas 10y ago

On Android 6.0 I got the correct permissions dialog and I was able to select what the app sees and what it can do. Is this just me?

hortonew 10y ago
I also see this. It asked for I think 4 separate permissions that you could allow or deny.
chipgap98 10y ago
But isn't that what the app needs from your phone? I always thought that was difference then what you are giving an app permission to do when using OAuth
- rtkwe 10y ago
  On Android they're able to use the OS APIs to access that information because the google account is closely tied to the OS so the permissions there are basically permissions to the phone data because with Android they're pretty much one and the same.

drivers99 10y ago

"Pokemon Go Release" has "full access" and yet "Ingress" (a game very similar to Pokemon Go from the same company) only has "basic account info". I removed the access and when I started the app, it crashed right away. (I'm on iOS, by the way.) Subsequent launch I'm stuck on the "LOADING..." screen, and then it says "Failed to get player information from the server." I hope the servers are just down and I didn't lock myself out. (Or maybe I should be glad until this fix this breach.) Edit: Deleting the app and reinstalling allowed me to log in again. It appears to be the iOS version only that's doing this, according to this article: http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-google-accounts-iphone/ http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-...

surge 10y ago
When I signed up, it only said basic account info or that they'd like to know who I am. Nothing else.
BryantD 10y ago
When I checked this morning Ingress also had full perms. I revoked and reconnected and Ingress only had basic account info. I was also queried appropriately. Possibly this was fixed on Ingress sometime in the last X months but not on Pokemon Go.
- biehl 10y ago
  Same here. I granted Ingress access in Nov 2015
jaxondu 10y ago
Apparently Google Maps also has full access to your Google account: http://sanziro.com/2016/07/pokemon-go-has-full-access-to-your-google-account.html http://sanziro.com/2016/07/pokemon-go-has-full-access-to-you...

ceejayoz 10y ago

This seems like a massive security fail on Google's part. There's no reason the OAuth flow should be able to request admin privileges silently. As a user, I really must get a prompt asking me (and warning me!).

zeffr 10y ago

It's a free game everyone. When something is free to play, and involves you walking around with geo services and a camera on, you and your data are the product. This is just massive data collection disguised as a video game.

MBCook 10y ago
No, they make their money through IAPs. No one signed up to let Niantic read their email in exchange for free items.
- zeffr 10y ago
  Maybe no one on HN or in your circle of friends, but I think you massively overestimate the average user's sense of data protection.
  - MBCook 10y ago
    I'm willing to bet if you put a warning that said "This app will read your email" a ton of people would react. Not 100%, but a ton. Especially parents.
- chrisdbaldwin 10y ago
  Okay. They are also selling user data.
Mtinie 10y ago
While that may be true, it isn't relevant to the conversation about how deep into the permissions forest the app is reaching. Pokemon Go can collect the bunches of the data it wants without having admin-level access to their users' Google accounts.

MBCook 10y ago

There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement. How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.

greggman 10y ago
Kids (under 13 in USA, under 16 in Netherlands) aren't allowed to have gmail accounts AFAIK https://support.google.com/accounts/answer/1350409?hl=en https://support.google.com/accounts/answer/1350409?hl=en
- nommm-nommm 10y ago
  That's due to a Clinton era law Children's Online Privacy Protection Act of 1998 (COPPA). It forbids companies form collecting personal info from children under 13 without their parents permission.
  - Pxtl 10y ago
    What's funny is that nobody seems to provide a workflow to actually create accounts for kids. I want to set up a supervised google account for my son for hangouts et al... and I have no idea how. I guess that's not a thing.
    - nommm-nommm 10y ago
      It is for some services/websites that have policies in place. Google probably doesn't care enough to have a process, not worth it for them.
      - nommm-nommm 10y ago
        Since I can't edit here is an example: http://www.neopets.com/coppa/consentform.phtml http://www.neopets.com/coppa/consentform.phtml Google doesn't care because it takes more effort for them to obey by the law than its worth for them at this time.

carsonreinke 10y ago

Why in the world would they do this? Or was this just merely an accident?

sp332 10y ago
Niantic used to be owned by Google, so they should know what they're doing.
- rtkwe 10y ago
  It does work properly on Android. It only asks for access to Location, Contacts, Camera, and Storage.
  - sp332 10y ago
    Those are just things it has access to on your phone. That's not the permissions you give it on your Google account, which might include sending email as you. Those you can find here https://security.google.com/settings/security/permissions?pli=1 https://security.google.com/settings/security/permissions?pl...
    - pmlamotte 10y ago
      It doesn't appear in that list for me, curious if this is only affecting iPhone users and/or Android 5 and below.
      - sp332 10y ago
        According to https://techcrunch.com/2016/07/11/pokemon-go-shouldnt-have-full-access-to-your-gmail-docs-and-google-account-but-it-does/ https://techcrunch.com/2016/07/11/pokemon-go-shouldnt-have-f... it also happens sporadically on Android 5 and 6, and iPhones.
    - rtkwe 10y ago
      I checked that page already. I can only speak for myself but for me it has no listing on the Google Permissions page so it looks like it does permissions correctly to me.

hughes 10y ago

If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.

rickyc091 10y ago
So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.
- rbjorklin 10y ago
  Seriously? What happens if I delete the app? Do I delete all of my progress?
  - rickyc091 10y ago
    I've yet to try that, but I can. I'll report back in a few. Having trouble logging into my iPod... will see if I can get my coworker to remove it from his older device.
  - russjr08 10y ago
    Then you reinstall and all is fine. I went from using it on my Nexus 7 to my Nexus 5X and all of my progress was there.
- h1fra 10y ago
  Not true, don't worry :)
  - rickyc091 10y ago
    This was the case on an android phone using Google login. His nexus 6X was on a beta build so he was unable to install the app. He started playing the game on an older device while he downgraded his 6X. After it was complete, he logged into his 6X using his google credentials and it prompted him to start over.

test6554 10y ago

Could you not simply create a new google account strictly for use with pokemon go?

pritambaral 10y ago
One could, but will everyone do that?

test6554 10y ago

Could you simply create a new google account for the sole purpose of playing pokemon go?

beckler 10y ago

It should be noted that it sounds like only iOS users are seeing this. I signed in with my Android, and I didn't see anything from Niantic or Pokemon Go in my security settings.

generalledger 10y ago
Same here (Android user), and I just double checked what apps have access to my google account, and nothing from Niantic or Pokemon Go listed at all.

eth1 10y ago

http://boards.4chan.org/pol/thread/80610796/pokemon-go-is-bad#p80618256 http://boards.4chan.org/pol/thread/80610796/pokemon-go-is-ba...

dopu 10y ago

I'm running iOS 9.3.2, and signing in to Pokemon Go caused it to have full access to my Google account. Just revoked it and looks like I can still play the game just fine. Perhaps they misconfigured the Google auth sign-in? It's rather worrisome that it's this easy for an application to gain full access to your account, though.

quantumhobbit 10y ago
I did the same. The app worked for a little while but bugged me to sign in again after a close and restart of the app. No thanks.
csolo93 10y ago
Did you check the permissions again? I did the same, running the same iOS version, and it just restored the same full-access when I opened the app again.
- dopu 10y ago
  Yep, just checked. It's not here at all. Were you asked to sign in again after you revoked?

gg97 10y ago

I read people are chasing "pokemon" everywhere. I do not even know what a Pokemon is but I'm pretty sure Descartes would not care. Reading the press, I understand we may expect to see random people looking in their phone on the street chasing virtual pets. And still some people complains about the security risk of sharing his google account. Nobody seems to see the big picture. I guess that is the "Idiocracy" future we are being sold every day. Of course I will never ever chase a virtual pet in the street with my "dumb-phone". But this does raise questions for the future of humanity if hundred thousands of people do. That must be the end of the world.

detaro 10y ago
How is this any more "end of the world" than people watching TV?
- gg97 10y ago
  Oh, are you chasing virtual pets 43 minutes 23 secondes per day in average too ? I'm sorry, really, I should think more positively of the future. My bad, will improve, promess ! Let's start by creating a facebook account, we will learn the pokemon thing after, one benefit per humanity at a time.
dopu 10y ago
The amount of self-aggrandizing and general contempt for people I see on HN really astounds me sometimes.
- gg97 10y ago
  I'm all with you for general contempt for people on HN. I read everyday here the HN crowd claiming urgent need for an elite to set up a globalized centralized European Federal Union to get rid of nations and populism. I see people being bashed and insulted for supporting their own nation and not living for the NYSE. Let's just throw away states, cultures, religions, and build a global free market where everyone would be happy consumer. Maybe facebook and Jp Morgan can help in this mission. Let's celebrate the day when everyone will be chasing virtual pets on their phone. We're so in love with the people ! Pikachu !

mschuster91 10y ago

On a sidenote: does anyone know why the fuck are the servers so overcrowded? In a world with a whole bunch of automated cloud management solutions and auto-scaling, where is the problem?

nostrademons 10y ago

A lot of aspects of Pokemon Go are less than polished from an app dev perspective. The way they ask for device permissions doesn't follow best practices at all (no explanation of why they need them). The interface has too much explanatory text in some places (how much useless backstory did I need to click through to start playing?) and not enough in others (it took me forever to figure out what I was supposed to do once I found a pokemon). My sister-in-law was complaining about how all the pokemon graphics are very 2D, when they could easily have sprung for some shading or shadows. I suspect they built an MVP and launched it and it happened to take off, and we'll see some more polish in the future. For this particular issue though - I'd bet that Niantic has some sort of data-sharing agreement with Google, anyway, making this point moot. They started as an internal startup at Google, and they make really heavy use of the Maps & Places APIs that would probably cost a fortune if they didn't have some sort of bulk data sharing agreement.

tlrobinson 10y ago

Report it here: https://support.pokemongo.nianticlabs.com/hc/en-us/requests/new?ticket_form_id=319988 https://support.pokemongo.nianticlabs.com/hc/en-us/requests/...

throw7 10y ago

I see google Chrome gets full account access... I guess this is required? Or not?

cheshire137 10y ago

I know Google lets you see which apps are connected to your account via https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions but is there any page where I can see what activity was done on my account by particular apps?

RKoutnik 10y ago

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security risk"? No more than putting your stuff in Google's hands in the first place. Niantic are also the folks behind Ingress, if you've heard of that. [0] Specifically, Alphabet owns a significant portion of Niantic, along with Nintendo: https://nianticlabs.com/blog/niantic-tpc-nintendo/ https://nianticlabs.com/blog/niantic-tpc-nintendo/ (they were previously wholly-owned by Google).

deleted 10y ago
[deleted]
ja27 10y ago
Google's own apps often don't request this much permission. Basic security principles.
- cheshire137 10y ago
  Correct. Google Drive, for example, requires fewer permissions: https://pbs.twimg.com/media/CnG3kslW8AA1iZM.jpg:large https://pbs.twimg.com/media/CnG3kslW8AA1iZM.jpg:large
- nissehulth 10y ago
  If you connect Chrome to your account it does get full permissions for some reason. Perhaps Chromebook-related?
  - Ezhik 10y ago
    Pretty much. Google was trying to cram the entire Chrome OS platform in their browser a while back (remember Chrome's Windows 8 mode?), although they've kind of taken a step back from it lately.
10y ago

Zigurd 10y ago

I got a number of permission requests at runtime the first time launching the app. If anything, it appears to be running into more of the Android 6 runtime permissions.

thecourier 10y ago

I'm usingn the android version. they aren't even a connected application. so no risk in Android.

julionc 10y ago

Jesus Christ, They wants to catch 'em all

ultramancool 10y ago

Title isn't exactly accurate - can we edit this to indicate iOS only?

Animats 10y ago

Where there's a security hole, there's an exploit.[1] [1] https://thestack.com/security/2016/07/11/infected-pokemon-go-apk-carries-dangerous-android-backdoor/ https://thestack.com/security/2016/07/11/infected-pokemon-go...

Nadya 10y ago
This is completely unrelated because it isn't exploiting anything (other than humanware) Any modified APK for any App could be loaded in with a RAT asking for full permissions. It just happens PKMNGO is popular and people are trying to get their hands on it before it is officially released in their region.

lowbloodsugar 10y ago

I'm more worried about my daughter getting hit by a car (because she walks in front of it, or because the driver is playing) than I am about my google account being hijacked!

rasz_pl 10y ago
How about your daughters naked selfies leaking because someone breached Niantic and leveraged access to gdrive?

raoulduke 10y ago

Here's a weird question. https://www.facebook.com/NationalMallNPS/photos/a.379580652053692.97287.151776458167447/1186299898048426/?type=3&theater https://www.facebook.com/NationalMallNPS/photos/a.3795806520... Pokemon Go is designed to not only augment places where people already are but also to direct them to other places. My friend just ran down the Ninatic/Google connection. Can the app be used to direct people away from polling places and/or to congest areas around polling places? To wit, would anyone be interested in tracking (I can do it for at least some locations) the locations of gyms in comparison to polling places? (I haven't used the app; can one get a location of gyms?) [lol. let me clarify my interest would be in thwarting rather than harnessing this possibility.]

rasz_pl 10y ago
screw pooling places, what about locations of businesses (restaurants etc) that spend serious $$ for Google advertising?
- raoulduke 10y ago
  I mean... that'd be an issue. I don't think it'd be as big an issue as widespread electoral fraud or electioneering. But it'd probably be an issue...
raoulduke 10y ago
Also... the Clinton campaign just announced it would be having an event at a 'Pokestop,' and Clinton referenced the game. http://thehill.com/blogs/ballot-box/presidential-races/287792-clinton-campaign-holding-event-at-pokestop http://thehill.com/blogs/ballot-box/presidential-races/28779...

deleted 10y ago

[deleted]

peterjlee 10y ago

Seem like a issue with Google Auth on iOS. I've logged into Pokemon Go from my Android and iPhone. I revoked the access of "Pokemon Go release" from Connected Apps page then logged in again from my Android phone. "Pokemon Go release" doesn't show up in my Connected Apps page anymore even after a login from Android.

auganov 10y ago

Wow. This game must be the fastest thing to skyrocket into worldwide popularity. Yesterday I noticed someone on social media talking about it. "Some random game pokemon fans like" - I figured. Today it seems like everyone around the world is playing it. And it was released just a week ago? Never seen anything quite like it.

maknz 10y ago

Full access is bad enough, but the really dodgy thing going on is that you never get asked to approve or deny that access for Pokemon Go when doing the OAuth flow. You just log in, proceed through 2fa, and you're magically logged into the app. Pokemon Go Release then shows up as an authorised app... except I never authorised it. My theory is that they're injecting JavaScript into the web view to automatically press the 'Approve' button and hiding that from the user. If true, that's very worrying. They'd be effectively circumventing the whole OAuth framework by forging the user's approval of the app. Every user should have been asked up-front whether or not they wanted to approve or deny Pokemon Go's full access.

nappy-doo 10y ago

I spoke with a friend of mine at Niantic. They are in communication with the oauth group at Google, and are fixing the issue.

voltagex_ 10y ago
Can you also tell them to read a few Reddit threads, or Twitter? There are many, many issues which will limit the lifetime of this game.

lllorddino 10y ago

Just revoked access because the app never disclosed this information on signing up with my Google account. This is sick.

Dowwie 10y ago

I can't tell whether this game is the most heavily marketed social-media blitz of all time or truly viral. A virtual treasure hunt game finally gets people outside? Come on.

ChrisLTD 10y ago

Update from Niantic in this Game Informer article http://www.gameinformer.com/b/news/archive/2016/07/11/pokemon-go-has-access-to-your-entire-google-account.aspx http://www.gameinformer.com/b/news/archive/2016/07/11/pokemo... "We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves."

eeeeeeeeeeeee 10y ago
Impressed by the quick turnaround on this!
andyjdavis 10y ago
I actually just finished wrangling social log in for a system that is waaaay less popular than Pokemon GO. Rather amusing to see an organization operating at a vastly bigger scale still hitting the same sorts of speed bumps.

guillegette 10y ago

Funny enough, when I installed the game I didn't use my official Google account and I used my test one thinking about this. Glad I did it.

guillegette 10y ago

Funny enough when I downloaded the app I didn't use my official account and I logged in with a secondary account wondering exactly about this.

131hn 10y ago

kind of a scam, just a bad wording from google "full access" and old oauth workflow - but no real security threat TLDR: Pokemon Go can't read your gmail - he checked https://gist.github.com/arirubinstein/fd5453537436a8757266f908c3e41538 https://gist.github.com/arirubinstein/fd5453537436a8757266f9...

meowsus 10y ago

This article, though rife with paranoia, brings up some interesting points. http://blackbag.gawker.com/pokemon-go-is-a-government-surveillance-psyop-conspirac-1783461240 http://blackbag.gawker.com/pokemon-go-is-a-government-survei...

darkboltyoutube 10y ago

People die doing this: https://www.youtube.com/watch?v=B2KXVfnw4rg https://www.youtube.com/watch?v=B2KXVfnw4rg