6 ms·

And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me,

And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that they didn't hoover up all the information they had access to they can be unbanned after a year. Unlikely though considering they used to be a part of Google.

Alex3917 10y ago
This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.
- maxerickson 10y ago
  Google recommends using the browser workflow for installed apps too. https://developers.google.com/identity/protocols/OAuth2InstalledApp https://developers.google.com/identity/protocols/OAuth2Insta... Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not. Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use an app password: https://support.google.com/accounts/answer/185833?hl=en https://support.google.com/accounts/answer/185833?hl=en
  - jasalo 10y ago
    Did you try using an App password? Doesn't seem to work for me
    - maxerickson 10y ago
      No I haven't tried it.
  - horizone 10y ago
    2 Factor works. I'm forced to log back in when ever there is server troubles, which is annoying, but what ever.
ocdtrekkie 10y ago
The other day someone's web app I clicked on, and it automagically signed me in with Google and added itself to my connected apps. Cloudcraft.co, I think it was. When I hit their signup link, it auto-signed in with Google without me even clicking their Google button. After I disconnected it, it didn't behave that way a second time. So I am kinda mystified what happened there. But it was pretty strange.
- fattire 10y ago
  Could the app be intercepting the confirm screen and auto-agreeing w/o user interaction?
  - ocdtrekkie 10y ago
    I am very hesitant to accuse the app of doing something intentionally shady like that. I don't really :know: what happened, and I couldn't replicate it myself after removing the app from my account and visiting it again.
serge2k 10y ago
> I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. Is that the case? Doesn't this still require going through the standard prompts?
- criley2 10y ago
  Anecdote: On Android 6.0 the Pokemon Go game requested 4 permissions on first launch. Account, Camera, Storage, and one other I believe. I had to individually approve each one.
  - sp332 10y ago
    That's just access to your phone, not your Google account. Those permissions don't cover the app's ability to read your email.
    - criley2 10y ago
      I also do not have an entry on my Google permissions page (https://security.google.com/settings/security/permissions?pli=1 https://security.google.com/settings/security/permissions?pl...), this appears to be an iOS only bug, explaining why no Android user can recreate this bug
      - mohaine 10y ago
        I can verify this. I logged in with Google and see no permission given to the app.
      - trhaynes 10y ago
        I do have an entry on that page! "Pokemon Go Release - Has full access to your Google account" Revoking access now. Glad I read HN!
- sp332 10y ago
  According to the article, it does not.
chatmasta 10y ago
This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a traditional safari page, the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website. There is no technical limitation to an app engaging in very nefarious activity. For example an app could modify the DOM on the sign-in screen to grab your password after you enter it. Of course the accountability of MITM and security reviews might mitigate this risk, but passwords are generally only a few bytes and could easily be obfuscated and passed surreptitiously over the wire. I've seen a (quite popular) app implement this for facebook invitations, which should only have a limit of 50 friends, to secretly (in the background, without any action on your behalf other than logging in, or perhaps pressing a "continue" button) invite every one of your friends to download the app. Since facebook does not notify you when you send an inviation, you would not even know the app did this unless one of your friends who you invited asked you about it. [0] https://news.ycombinator.com/item?id=11637209 https://news.ycombinator.com/item?id=11637209 (thanks molecule)
- molecule 10y ago
  > how do I permalink to a comment? The comment's timestamp is a link.
- crescentfresh 10y ago
  > the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website Uh, seriously? I just suggested to our mobile team to integrate this way on Android (I implemented the OAuth 2 server). I would've made the same suggestion to a 3rd party app vendor when the day comes.
  - russjr08 10y ago
    A Chrome Custom Tab is probably the better way to go.
jack_pp 10y ago
or just use a burner email for stuff you don't trust
danudey 10y ago
Elsewhere in the thread it is alleged that this is a bug (or misbehaviour) with Google's iOS authentication library. It's possible that Niantic is not requesting any permissions and the library defaults that to 'full access' and not 'no access'. I've yet to see it confirmed, though.
SirensOfTitan 10y ago
> In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that they didn't hoover up all the information they had access to they can be unbanned after a year. I'm really glad you're not making that decision then. Banning some company based on their use of public, legal APIs would be an absolutely toxic decision for Google's platform. It's Google's fault for allowing this kind of access with no notification (yes, the fault here might lie somewhere in OAuth, but there's plenty that Google could do to make this less serious). Don't blame people for leveraging options at their disposal.

Alex3917 10y ago

This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.

maxerickson 10y ago
Google recommends using the browser workflow for installed apps too. https://developers.google.com/identity/protocols/OAuth2InstalledApp https://developers.google.com/identity/protocols/OAuth2Insta... Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not. Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use an app password: https://support.google.com/accounts/answer/185833?hl=en https://support.google.com/accounts/answer/185833?hl=en
- jasalo 10y ago
  Did you try using an App password? Doesn't seem to work for me
  - maxerickson 10y ago
    No I haven't tried it.
- horizone 10y ago
  2 Factor works. I'm forced to log back in when ever there is server troubles, which is annoying, but what ever.

ocdtrekkie 10y ago

The other day someone's web app I clicked on, and it automagically signed me in with Google and added itself to my connected apps. Cloudcraft.co, I think it was. When I hit their signup link, it auto-signed in with Google without me even clicking their Google button. After I disconnected it, it didn't behave that way a second time. So I am kinda mystified what happened there. But it was pretty strange.

fattire 10y ago
Could the app be intercepting the confirm screen and auto-agreeing w/o user interaction?
- ocdtrekkie 10y ago
  I am very hesitant to accuse the app of doing something intentionally shady like that. I don't really :know: what happened, and I couldn't replicate it myself after removing the app from my account and visiting it again.

serge2k 10y ago

> I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. Is that the case? Doesn't this still require going through the standard prompts?

criley2 10y ago
Anecdote: On Android 6.0 the Pokemon Go game requested 4 permissions on first launch. Account, Camera, Storage, and one other I believe. I had to individually approve each one.
- sp332 10y ago
  That's just access to your phone, not your Google account. Those permissions don't cover the app's ability to read your email.
  - criley2 10y ago
    I also do not have an entry on my Google permissions page (https://security.google.com/settings/security/permissions?pli=1 https://security.google.com/settings/security/permissions?pl...), this appears to be an iOS only bug, explaining why no Android user can recreate this bug
    - mohaine 10y ago
      I can verify this. I logged in with Google and see no permission given to the app.
    - trhaynes 10y ago
      I do have an entry on that page! "Pokemon Go Release - Has full access to your Google account" Revoking access now. Glad I read HN!
sp332 10y ago
According to the article, it does not.

chatmasta 10y ago

This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a traditional safari page, the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website. There is no technical limitation to an app engaging in very nefarious activity. For example an app could modify the DOM on the sign-in screen to grab your password after you enter it. Of course the accountability of MITM and security reviews might mitigate this risk, but passwords are generally only a few bytes and could easily be obfuscated and passed surreptitiously over the wire. I've seen a (quite popular) app implement this for facebook invitations, which should only have a limit of 50 friends, to secretly (in the background, without any action on your behalf other than logging in, or perhaps pressing a "continue" button) invite every one of your friends to download the app. Since facebook does not notify you when you send an inviation, you would not even know the app did this unless one of your friends who you invited asked you about it. [0] https://news.ycombinator.com/item?id=11637209 https://news.ycombinator.com/item?id=11637209 (thanks molecule)

molecule 10y ago
> how do I permalink to a comment? The comment's timestamp is a link.
crescentfresh 10y ago
> the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website Uh, seriously? I just suggested to our mobile team to integrate this way on Android (I implemented the OAuth 2 server). I would've made the same suggestion to a 3rd party app vendor when the day comes.
- russjr08 10y ago
  A Chrome Custom Tab is probably the better way to go.

jack_pp 10y ago

or just use a burner email for stuff you don't trust

danudey 10y ago

Elsewhere in the thread it is alleged that this is a bug (or misbehaviour) with Google's iOS authentication library. It's possible that Niantic is not requesting any permissions and the library defaults that to 'full access' and not 'no access'. I've yet to see it confirmed, though.

SirensOfTitan 10y ago

> In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that they didn't hoover up all the information they had access to they can be unbanned after a year. I'm really glad you're not making that decision then. Banning some company based on their use of public, legal APIs would be an absolutely toxic decision for Google's platform. It's Google's fault for allowing this kind of access with no notification (yes, the fault here might lie somewhere in OAuth, but there's plenty that Google could do to make this less serious). Don't blame people for leveraging options at their disposal.