4 ms·

If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's inten

by hughes 10y ago

If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.

rickyc091 10y ago
So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.
- rbjorklin 10y ago
  Seriously? What happens if I delete the app? Do I delete all of my progress?
  - rickyc091 10y ago
    I've yet to try that, but I can. I'll report back in a few. Having trouble logging into my iPod... will see if I can get my coworker to remove it from his older device.
  - russjr08 10y ago
    Then you reinstall and all is fine. I went from using it on my Nexus 7 to my Nexus 5X and all of my progress was there.
- h1fra 10y ago
  Not true, don't worry :)
  - rickyc091 10y ago
    This was the case on an android phone using Google login. His nexus 6X was on a beta build so he was unable to install the app. He started playing the game on an older device while he downgraded his 6X. After it was complete, he logged into his 6X using his google credentials and it prompted him to start over.
    - ja27 10y ago
      Probably because he was previously playing the Pokemon Go field test. All of the field test data was wiped, accounts and all. Everyone started over.
    - jeeva 10y ago
      I've gone between three phones this week for various reasons, and this has not been an issue.
  - ja27 10y ago
    Not true at all. I've wiped the app from multiple devices and accounts today and it's always restored the player's progress after you log back in.
bouncingsoul 10y ago
Yes! I did notice there wasn't a "This app will have access to…" screen when I signed up (I've never seen that before), but that just made me assume they were asking for like the absolute minimal permissions possible or something. "[random game on a whim] has Full Access to your Google Account" is scary
mtrpcic 10y ago
Yeah, I agree. I strongly suspect that the scope of permissions requests was an oversight (e.g. Just ask for everything now, we'll pair it down once we know what data we need). Additionally, while I don't like the idea of having Niantic having access to my entire Google account, let's remember that Niantic started as a Google company, and is now under the Alphabet umbrella, so have a vested interest in keeping things on the up-and-up. Lastly, Nintendo is up 35% thanks to this game (about $7B), and I strongly doubt that there is anything they could gain from scraping/abusing these Google accounts that would come even close to that type of impact. My money is on "bad development process and oversight", and this is just one of many rough edges that I've already noticed in the software.
- ceejayoz 10y ago
  > I strongly doubt that there is anything they could gain from scraping/abusing these Google accounts that would come even close to that type of impact. I'd have said the same about VW's emissions cheating scandal before it broke.
- bbcbasic 10y ago
  Hanlon's Razor
bt3 10y ago
To my knowledge, this is known bug in iOS that the Google auth grant inadvertently gives all permissions. You'll note that other users below report this only happening on iOS and not Android which shifts the risk away from Niantic/ Pokemon Go and towards Google itself, as you've mentioned.
- jonny_eh 10y ago
  How could iOS be responsible for the auth between two third-party services? Isn't it more likely to be a bug in the iOS version of Pokemon Go?
  - russjr08 10y ago
    They probably meant the Google Auth library for iOS.
    - bt3 10y ago
      Yes, thanks for clarifying.
cheshire137 10y ago
Yeah, I had no idea when I signed into Pokemon Go with my Google account that it was doing anything scary. I didn't even consider it would be granting full access to my account. It's almost like Google treats that as the default case, and it's an exception that they style differently when the app requests a particular scope to limit its access.

by hughes 10y ago

rickyc091 10y ago

So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.

rbjorklin 10y ago
Seriously? What happens if I delete the app? Do I delete all of my progress?
- rickyc091 10y ago
  I've yet to try that, but I can. I'll report back in a few. Having trouble logging into my iPod... will see if I can get my coworker to remove it from his older device.
- russjr08 10y ago
  Then you reinstall and all is fine. I went from using it on my Nexus 7 to my Nexus 5X and all of my progress was there.
h1fra 10y ago
Not true, don't worry :)
- rickyc091 10y ago
  This was the case on an android phone using Google login. His nexus 6X was on a beta build so he was unable to install the app. He started playing the game on an older device while he downgraded his 6X. After it was complete, he logged into his 6X using his google credentials and it prompted him to start over.
  - ja27 10y ago
    Probably because he was previously playing the Pokemon Go field test. All of the field test data was wiped, accounts and all. Everyone started over.
  - jeeva 10y ago
    I've gone between three phones this week for various reasons, and this has not been an issue.
- ja27 10y ago
  Not true at all. I've wiped the app from multiple devices and accounts today and it's always restored the player's progress after you log back in.

bouncingsoul 10y ago

Yes! I did notice there wasn't a "This app will have access to…" screen when I signed up (I've never seen that before), but that just made me assume they were asking for like the absolute minimal permissions possible or something. "[random game on a whim] has Full Access to your Google Account" is scary

mtrpcic 10y ago

Yeah, I agree. I strongly suspect that the scope of permissions requests was an oversight (e.g. Just ask for everything now, we'll pair it down once we know what data we need). Additionally, while I don't like the idea of having Niantic having access to my entire Google account, let's remember that Niantic started as a Google company, and is now under the Alphabet umbrella, so have a vested interest in keeping things on the up-and-up. Lastly, Nintendo is up 35% thanks to this game (about $7B), and I strongly doubt that there is anything they could gain from scraping/abusing these Google accounts that would come even close to that type of impact. My money is on "bad development process and oversight", and this is just one of many rough edges that I've already noticed in the software.

ceejayoz 10y ago
> I strongly doubt that there is anything they could gain from scraping/abusing these Google accounts that would come even close to that type of impact. I'd have said the same about VW's emissions cheating scandal before it broke.
bbcbasic 10y ago
Hanlon's Razor

bt3 10y ago

To my knowledge, this is known bug in iOS that the Google auth grant inadvertently gives all permissions. You'll note that other users below report this only happening on iOS and not Android which shifts the risk away from Niantic/ Pokemon Go and towards Google itself, as you've mentioned.

jonny_eh 10y ago
How could iOS be responsible for the auth between two third-party services? Isn't it more likely to be a bug in the iOS version of Pokemon Go?
- russjr08 10y ago
  They probably meant the Google Auth library for iOS.
  - bt3 10y ago
    Yes, thanks for clarifying.

cheshire137 10y ago

Yeah, I had no idea when I signed into Pokemon Go with my Google account that it was doing anything scary. I didn't even consider it would be granting full access to my account. It's almost like Google treats that as the default case, and it's an exception that they style differently when the app requests a particular scope to limit its access.