8 ms·

Pokemon Go – Permissions Update

335 points by nate_martin 10y ago

minimaxir 10y ago
This is the same message that was released to the press yesterday. I'm surprised Google itself has not said anything, as they are also at fault for not showing the permissions workflow in the first place.
- 8bitben 10y ago
  Exactly, that's what I'm more worried about - Google needs to present clear information about what access is provided BEFORE I accept the account connection. It's not necessarily Niantic's fault for asking for too much, it's Google's for not at least making me aware.
  - eridius 10y ago
    It's entirely plausible that Niantic didn't realize they were asking for too much specifically because Google didn't show the permissions being asked. So any time they tested their own app, they would have just seen what everybody else saw, which is that the app asked for access to the Google Account with no mention of what permissions.
    - kaspiCZ 10y ago
      Despite that, it is wexing that they wouldn't come across this issue during testing. Maybe it's a production issue. I am very interested in a technical explanation from either Google or Niantic. They surely had to test iOS app and check their Google permission page. Otherwise it would be really sloppy testing.
  - idunno246 10y ago
    the thing is...as long as its a frame inside the app i have zero way of knowing whether im actually looking at googles login page, or if niantic is reading the traffic/javascript. At least when I get bounced out to safari I only have to trust apple, which I already implicitly do.
    - tedmiston 10y ago
      If you want to be paranoid, you could run a MITM proxy from your computer between your phone and Niantic's servers.
      - joosters 10y ago
        And see TLS traffic? How would this help anyone?
        kiallmacinnes 10y ago
        A MITM proxy typically means a decrypting proxy, so you can see all the traffic, irregardless of if it's wrapped in TLS.
        joosters 10y ago
        I thought that Google and other app writers weren't keen on blindly accepting generated certificates, and used certificate pinning. Do they really accept anyone's google.com certificates?
        trakout 10y ago
        Cert pinning can be circumvented w/ a rooted or jailbroken device.
        tedmiston 10y ago
        I haven't tried it with a Google API specifically but here's their description: > Charles does this by becoming a man-in-the-middle. Instead of your browser seeing the server’s certificate, Charles dynamically generates a certificate for the server and signs it with its own root certificate (the Charles CA Certificate). Charles receives the server’s certificate, while your browser receives Charles’s certificate. Therefore you will see a security warning, indicating that the root authority is not trusted. If you add the Charles CA Certificate to your trusted certificates you will no longer see any warnings – see below for how to do this. https://www.charlesproxy.com/documentation/proxying/ssl-proxying/ https://www.charlesproxy.com/documentation/proxying/ssl-prox... It seems you are correct if they use pinning: > Note that some apps implement SSL certificate pinning which means they specifically validate the root certificate. Because the app is itself verifying the root certificate it will not accept Charles's certificate and will fail the connection. If you have successfully installed the Charles root SSL certificate and can browse SSL websites using SSL Proxying in Safari, but an app fails, then SSL Pinning is probably the issue. https://www.charlesproxy.com/documentation/faqs/ssl-connections-from-within-iphone-applications/ https://www.charlesproxy.com/documentation/faqs/ssl-connecti...
  - deleted 10y ago
    [deleted]
- dwc 10y ago
  > Google ... are also at fault Primarily at fault.
- scosman 10y ago
  I went through the updated app (v1.0.1) and the oAuth flow clearly indicated what I was granting access to. I'd be very curious if this was a fix by Google, a Google bug where requesting "full access" is missing that step, or Niantic changed the way they do oAuth (still a Google issue, the method lacking confirmation shouldn't exist).
  - HappyTypist 10y ago
    It was some JavaScript injected into the WebView that automatically clicked confirm and sent a message to reposition the WebView offscreen as soon as that happens.
    - revelation 10y ago
      They did that? That doesn't sound like a mistake, that sounds like a CFAA felony.
    - illumin8 10y ago
      If they did that, they don't deserve a second chance at trust. That is outright malicious, and definitely a dark pattern. Their app deserves to be deleted and not used again. Oauth2 has some serious holes - I have no idea if the Google login page is served by Google, or is simply a copy of their landing page designed to phish for credentials. This needs to be fixed as Oauth is becoming increasingly prevalent. We need some type of web of trust like SSL EV that gives me attestation the Oauth login page is being served by the company that I think it is.
      - madeofpalk 10y ago
        This is why providers like FitBit require that you use APIs such as Chrome Custom Tabs or SafariViewController, where the OS presents an out-of-process limited web view that the host app doesn't have access to.
    - blixt 10y ago
      Terrible if true. Is there a source for this claim?
- bluecmd 10y ago
  Are you sure the login flow used the official flow API and not collected the login credentials themselves to "helpfully" register the user? I haven't used to app so I have no idea, just a thought.
  - ajoy39 10y ago
    it's the google login flow
    - pg_is_a_butt 10y ago
      you don't HAVE to use it though. there are many different APIs you can use, OAuth tokens are just one of them. if you have username and password, you can use that.
- ljk 10y ago
  Google probably doesn't want to draw that kind of attention to itself
saturdaysaint 10y ago
From the 1.01 iOS release notes: "-Fixed Google account scope"
- sigmar 10y ago
  Link to July 12th release notes: https://itunes.apple.com/us/app/pokemon-go/id1094591345?mt=8 https://itunes.apple.com/us/app/pokemon-go/id1094591345?mt=8
- minimaxir 10y ago
  Not documented, Pokemon Go now asks for Notification permissions. (Which is typical of mobile games and should have been done at launch, but ironic given current circumstances.)
  - qzervaas 10y ago
    > should have been done at launch Generally speaking, this is the worst way to do it, as the app hasn't made a case for why it needs to send notifications. It should do it in a contextual way so the user understands that notifications will enhance their experience of the app.
    - bpchaps 10y ago
      Why is it the worst way? It would make total sense to combine those ideas.
      - Wofiel 10y ago
        Typically the user should be primed, given reason for what the notifications will entail, how frequent they might be and so on. It makes users much more receptive to them if you tell then why they should want to have this optional feature enabled, rather than a blind notification popup in first launch.
        bpchaps 10y ago
mark_l_watson 10y ago
I didn't think they were doing anything nefarious but you never know. I think I will install it now, to see what my grandchildren have been talking about.
- 2bitencryption 10y ago
  Seeing as the Android version only required the LOWEST possible Google permissions scope, my guess is someone checked the wrong box, or for some reason was doing something in development that required slightly more permissions and simply forgot to switch it back.
- ryanschneider 10y ago
  The concern (at least for me) wasn't that Niantic was doing anything nefarious, it was that if they didn't even know they were asking for full permission are they professional enough to prevent that full permission from being misused by a malicious actor? The app is so popular that an exploit could be a gold mine for black hats. Glad to see Google patching the permissions server-side, as I bet a lot of people just checked the app out once out of curiosity and won't launch the updated version.
biogeneration 10y ago
I really appreciate that they were able to make a change quickly and provide transparency about the issue and resolution.
- sliverstorm 10y ago
  Though, I always feel kind of bad about the whole torch-and-pitchforks almost certainly resulting in some poor sap(s) working 24/7 to fix the issue ASAP when it really could have been fixed, oh, Thursday. (assuming the absence of malice, it's just important it get fixed reasonably soon) Especially considering they doubtless have all kinds of other major issues on their plate- like the server load problems.
  - gwbas1c 10y ago
    As much as I don't like the torch and pitchforks approach; this is the kind of oversight that should be found long before an app is released. It also shows that the market won't tolerate broad security overreaches. I certainly want to try Pokemon Go, but after seeing these articles, I decided to wait.
aftbit 10y ago
Perfect response! :)
cocotino 10y ago
Bit of OT Played Pokémon GO yesterday (iOS 1.0 version) and it was very buggy. Many bugs looked like they were server side (requests freezing), but there were strange rendering errors (like seeing only waves on the ground where Pokémon are, and not the actual Pokémon on them) that could be fixed by restarting the app several times. The phone also got absurdly hot, I never play on it, I don't know if it's normal for it to get like that, but I could barely hold it in my hand. I literally couldn't understand all the fuss about the game, it was unplayable for me...
- CDotDot 10y ago
  I've also had all of these happen to me. It's quite annoying, (especially the burning hot phone and battery drain), but I'm still enjoying it. Nostalgia is a powerful force.
  - MBCook 10y ago
    When the network is up it's surprisingly fun for a game with so many problems. Makes me hope they actually fix some of them soon we can play the game it should be.
- minimaxir 10y ago
  For those with battery concerns, turn on Battery Saver in the settings. With that enabled, when the phone is rotated upside-down (i.e put in your pocket), brightness drops to 0% and 3D rendering is disabled, both of which help. A little. Constant GPS and battery sucking can't be fully mitigated.
  - cocotino 10y ago
    I did that. The screen turned black, and there was no way to bring the game back, other than killing the app. Ridiculous.
    - bhtru 10y ago
      What iPhone do you have?
unimpressive 10y ago
Oh good, I can finally feel comfortable about installing it.
matt_wulfeck 10y ago
I'm glad they involved google to make sure the change happens to anyone and also to verify their claims about access. This is the type of response we should expect/demand from other companies. Well done.
- Someone1234 10y ago
  I agree it is helpful to involve Google so it can be changed for existing Pokemon Go users. But I don't see how Google has verified the claim, since Google themselves have yet to release a statement. By the way, Google indorsed this comment. Believe me?
  - matt_wulfeck 10y ago
    Web of trust I suppose. I trust Nintendo and I also don't think Google would allow such a brazen and public endorsement if it were untrue. If google does indeed reset permissions then you know they've at least been in contact. If it were a smaller company I'd like to see proof.
    - sev 10y ago
      > If it were a smaller company I'd like to see proof. Amazing how much trust the mere size of a company ensues.
      - MattHeard 10y ago
        It's not size directly, but the risk of goodwill. A bigger company stands to lose more goodwill.
        aioprisan 10y ago
        That and stock value
        aplummer 10y ago
        I think it can also be size directly, the more people involved the more chance that one of them would tell-all.
e12e 10y ago
Isn't this a bit: "Accidentally left open gate to castle. Now closed. No fix in place to make sure other people working closely with Alphabet/Google won't leave door open again. Share and enjoy." ? On another note, from the "privacy policy": 1. REVISIONS TO THIS PRIVACY POLICY Any information that is collected via our services is covered by the privacy policy in effect at the time such information is collected we may revise this privacy policy from time to time if we make any material changes to this privacy policy, including any change that we propose that will have retroactive effect, we’ll notify you of those changes by posting them on the services or by sending you an email or other notification, and we’ll update the “last updated date” above to indicate when those changes were made So, they'll let you know if they apply retroactive changes to the policy? How is that any different from "lol, you give data, we do what we want, ok?"
- DominikR 10y ago
  > No fix in place to make sure other people working closely with Alphabet/Google won't leave door open again. Niantic Labs did not create and does not own the permission model and therefore by definition they can't fix it. All they can do is improve their review process to reduce chances that bad code somehow makes it into production. (as probably most of us do) That is not to say that there aren't valid and reasonable use cases for even the most powerful/dangerous permissions. People even root their phones to give some of their apps access to permissions they otherwise couldn't use because there's a lot of cool/interesting stuff you can do that way.
- Freak_NL 10y ago
  > So, they'll let you know if they apply retroactive changes to the policy? Pretty standard for a lot of apps and web services. The alternative is not to use them, or to be very conscious about what data you supply them with. Most people just click accept (as with any EULA).
  - e12e 10y ago
    Seems like a privacy policy that amounts to "lol, whatever" can't possibly be lagally binding in the EU at least. If it is (found to be) void they could be required to delete all customer data - as they have no legal grant to store it or use it for any purpose?
chromaton 10y ago
On Android, Pokemon Go requests permission to access your contacts. I declined this access, and the app still seems to work (modulo the crashes & bugs that others have reported). Accessing the camera and location I can understand, but I don't want to give Pokemon Go access to my contacts.
- disgruntledphd2 10y ago
  I assume that its for a yet to be implemented find friends feature, but I was also concerned at that permission request.
- po1nter 10y ago
  I works even if you disable access to the camera (on android that is) but you obviously won't be able to use the AR view.
- joshschreuder 10y ago
  The contacts request doesn't happen on iOS (yet)
rtanaka 10y ago
It is indeed fixed but updating iOS app alone does not change the permissions. I had to sign out of the app, revoke the permissions on google and then sign back in.
- ajoy39 10y ago
  thats why they're involving google, Google is handling the permissions changes
deleted 10y ago
[deleted]
quaffapint 10y ago
Keep in mind you dont have to login with your google account - you can create a free pokemon club account and use that.
- jaflo 10y ago
  Or create a dummy Google account.
- sp332 10y ago
  That site has been down continuously for days, so it might not be a real option. Edit: OK, continually since it does seem to be up sometimes!
  - quaffapint 10y ago
    I just did it this morning - just refreshed the page once and it worked fine.
sl1e 10y ago
Is the button that takes me to login with Google account the same as using a Google email address to create an account?
qwertyuiop924 10y ago
Great. Although this is really a left-pad situation: it's good that they fixed it, but that fact that it was a problem in the first place is pretty damn disturbing.
callesgg 10y ago
Inital thought: Wow that company is so great... that they did the right thing... ...Wait a second do i think a company is great just cause they do things the way they should do them.
- TeMPOraL 10y ago
  Yes. Because it's an uncommon thing for a company to do right by their customers, and everyone that does IMO deserves praise (and more business).
foota 10y ago
I wonder how many applications do the same thing and haven't been called out on it.
- cavisne 10y ago
  The difference here is the "grant full access" screen was never shown to users. That shouldn't be possible and speculation is that either the app somehow hijacked past the screen, or Niantic being an ex-google company was whitelisted to avoid this. I can easily see how the second would happen, I wonder if Ingress (their previous inside google app) even showed up on your list of authorized third parties?
  - foota 10y ago
    From what others have posted here, any native app that loads the oauth flow in a web view control or whatever it's called, has full control over it, and so can do anything it wants.
panic 10y ago
This update completely broke login for people with Pokemon Trainer Club accounts. It doesn't even send the HTTP request: https://www.reddit.com/r/pokemongo/comments/4sjbeq/ios_users_who_login_using_pokemon_trainers_club/ https://www.reddit.com/r/pokemongo/comments/4sjbeq/ios_users...
stephenyeargin 10y ago
Take a look at this list of potential things you can ask for as a developer: https://developers.google.com/identity/protocols/googlescopes https://developers.google.com/identity/protocols/googlescope... And most folks will click "Approve" without really reviewing the list. That said, Twitter and Facebook (two other popular OAuth providers) heavily restrict certain "full" access to only trusted applications that they either have a business relationship with or otherwise review the application before allowing those scopes to be requested or used. This incident may prompt Google to do more of that, which isn't entirely great news for the more responsible developers with purpose-built apps.
- tommorris 10y ago
  That's why Facebook changed their APIs in 2014. Before any app could ask for anything. Now apps can only ask for public profile data, email address and a list of your friends that have also installed the app. Before you could also get stuff like education and work history, family relationships, relationship status, sexual orientation and a whole load of other stuff that could potentially cause a lot of trouble. And people would happily click OK just to play FarmVille or whatever. Now Facebook makes it so any app needing advanced permissions data has to be reviewed by Facebook first. See https://developers.facebook.com/blog/post/2014/04/30/the-new-facebook-login/ https://developers.facebook.com/blog/post/2014/04/30/the-new...
mattlutze 10y ago
I'm slightly curious how we prove the statements to be true. There wasn't the normal "this app wants ___ permissions, is that cool?" message from the Google OAuth dialog. I had not idea I'd authorized Niantic to go scrape all my emails, access Google's own processing on them for advertisement system training or review my location history, for example. I'm not so sure why I should believe they didn't do that.

335 points by nate_martin 10y ago

This is the same message that was released to the press yesterday. I'm surprised Google itself has not said anything, as they are also at fault for not showing the permissions workflow in the first place.

8bitben 10y ago
Exactly, that's what I'm more worried about - Google needs to present clear information about what access is provided BEFORE I accept the account connection. It's not necessarily Niantic's fault for asking for too much, it's Google's for not at least making me aware.
- eridius 10y ago
  It's entirely plausible that Niantic didn't realize they were asking for too much specifically because Google didn't show the permissions being asked. So any time they tested their own app, they would have just seen what everybody else saw, which is that the app asked for access to the Google Account with no mention of what permissions.
  - kaspiCZ 10y ago
    Despite that, it is wexing that they wouldn't come across this issue during testing. Maybe it's a production issue. I am very interested in a technical explanation from either Google or Niantic. They surely had to test iOS app and check their Google permission page. Otherwise it would be really sloppy testing.
- idunno246 10y ago
  the thing is...as long as its a frame inside the app i have zero way of knowing whether im actually looking at googles login page, or if niantic is reading the traffic/javascript. At least when I get bounced out to safari I only have to trust apple, which I already implicitly do.
  - tedmiston 10y ago
    If you want to be paranoid, you could run a MITM proxy from your computer between your phone and Niantic's servers.
    - joosters 10y ago
      And see TLS traffic? How would this help anyone?
      - kiallmacinnes 10y ago
        A MITM proxy typically means a decrypting proxy, so you can see all the traffic, irregardless of if it's wrapped in TLS.
        joosters 10y ago
        I thought that Google and other app writers weren't keen on blindly accepting generated certificates, and used certificate pinning. Do they really accept anyone's google.com certificates?
        trakout 10y ago
        Cert pinning can be circumvented w/ a rooted or jailbroken device.
        tedmiston 10y ago
        I haven't tried it with a Google API specifically but here's their description: > Charles does this by becoming a man-in-the-middle. Instead of your browser seeing the server’s certificate, Charles dynamically generates a certificate for the server and signs it with its own root certificate (the Charles CA Certificate). Charles receives the server’s certificate, while your browser receives Charles’s certificate. Therefore you will see a security warning, indicating that the root authority is not trusted. If you add the Charles CA Certificate to your trusted certificates you will no longer see any warnings – see below for how to do this. https://www.charlesproxy.com/documentation/proxying/ssl-proxying/ https://www.charlesproxy.com/documentation/proxying/ssl-prox... It seems you are correct if they use pinning: > Note that some apps implement SSL certificate pinning which means they specifically validate the root certificate. Because the app is itself verifying the root certificate it will not accept Charles's certificate and will fail the connection. If you have successfully installed the Charles root SSL certificate and can browse SSL websites using SSL Proxying in Safari, but an app fails, then SSL Pinning is probably the issue. https://www.charlesproxy.com/documentation/faqs/ssl-connections-from-within-iphone-applications/ https://www.charlesproxy.com/documentation/faqs/ssl-connecti...
- deleted 10y ago
  [deleted]
dwc 10y ago
> Google ... are also at fault Primarily at fault.
scosman 10y ago
I went through the updated app (v1.0.1) and the oAuth flow clearly indicated what I was granting access to. I'd be very curious if this was a fix by Google, a Google bug where requesting "full access" is missing that step, or Niantic changed the way they do oAuth (still a Google issue, the method lacking confirmation shouldn't exist).
- HappyTypist 10y ago
  It was some JavaScript injected into the WebView that automatically clicked confirm and sent a message to reposition the WebView offscreen as soon as that happens.
  - revelation 10y ago
    They did that? That doesn't sound like a mistake, that sounds like a CFAA felony.
  - illumin8 10y ago
    If they did that, they don't deserve a second chance at trust. That is outright malicious, and definitely a dark pattern. Their app deserves to be deleted and not used again. Oauth2 has some serious holes - I have no idea if the Google login page is served by Google, or is simply a copy of their landing page designed to phish for credentials. This needs to be fixed as Oauth is becoming increasingly prevalent. We need some type of web of trust like SSL EV that gives me attestation the Oauth login page is being served by the company that I think it is.
    - madeofpalk 10y ago
      This is why providers like FitBit require that you use APIs such as Chrome Custom Tabs or SafariViewController, where the OS presents an out-of-process limited web view that the host app doesn't have access to.
  - blixt 10y ago
    Terrible if true. Is there a source for this claim?
bluecmd 10y ago
Are you sure the login flow used the official flow API and not collected the login credentials themselves to "helpfully" register the user? I haven't used to app so I have no idea, just a thought.
- ajoy39 10y ago
  it's the google login flow
  - pg_is_a_butt 10y ago
    you don't HAVE to use it though. there are many different APIs you can use, OAuth tokens are just one of them. if you have username and password, you can use that.
ljk 10y ago
Google probably doesn't want to draw that kind of attention to itself

saturdaysaint 10y ago

From the 1.01 iOS release notes: "-Fixed Google account scope"

sigmar 10y ago
Link to July 12th release notes: https://itunes.apple.com/us/app/pokemon-go/id1094591345?mt=8 https://itunes.apple.com/us/app/pokemon-go/id1094591345?mt=8
minimaxir 10y ago
Not documented, Pokemon Go now asks for Notification permissions. (Which is typical of mobile games and should have been done at launch, but ironic given current circumstances.)
- qzervaas 10y ago
  > should have been done at launch Generally speaking, this is the worst way to do it, as the app hasn't made a case for why it needs to send notifications. It should do it in a contextual way so the user understands that notifications will enhance their experience of the app.
  - bpchaps 10y ago
    Why is it the worst way? It would make total sense to combine those ideas.
    - Wofiel 10y ago
      Typically the user should be primed, given reason for what the notifications will entail, how frequent they might be and so on. It makes users much more receptive to them if you tell then why they should want to have this optional feature enabled, rather than a blind notification popup in first launch.
      - bpchaps 10y ago

mark_l_watson 10y ago

I didn't think they were doing anything nefarious but you never know. I think I will install it now, to see what my grandchildren have been talking about.

2bitencryption 10y ago
Seeing as the Android version only required the LOWEST possible Google permissions scope, my guess is someone checked the wrong box, or for some reason was doing something in development that required slightly more permissions and simply forgot to switch it back.
ryanschneider 10y ago
The concern (at least for me) wasn't that Niantic was doing anything nefarious, it was that if they didn't even know they were asking for full permission are they professional enough to prevent that full permission from being misused by a malicious actor? The app is so popular that an exploit could be a gold mine for black hats. Glad to see Google patching the permissions server-side, as I bet a lot of people just checked the app out once out of curiosity and won't launch the updated version.

biogeneration 10y ago

I really appreciate that they were able to make a change quickly and provide transparency about the issue and resolution.

sliverstorm 10y ago
Though, I always feel kind of bad about the whole torch-and-pitchforks almost certainly resulting in some poor sap(s) working 24/7 to fix the issue ASAP when it really could have been fixed, oh, Thursday. (assuming the absence of malice, it's just important it get fixed reasonably soon) Especially considering they doubtless have all kinds of other major issues on their plate- like the server load problems.
- gwbas1c 10y ago
  As much as I don't like the torch and pitchforks approach; this is the kind of oversight that should be found long before an app is released. It also shows that the market won't tolerate broad security overreaches. I certainly want to try Pokemon Go, but after seeing these articles, I decided to wait.

aftbit 10y ago

Perfect response! :)

cocotino 10y ago

Bit of OT Played Pokémon GO yesterday (iOS 1.0 version) and it was very buggy. Many bugs looked like they were server side (requests freezing), but there were strange rendering errors (like seeing only waves on the ground where Pokémon are, and not the actual Pokémon on them) that could be fixed by restarting the app several times. The phone also got absurdly hot, I never play on it, I don't know if it's normal for it to get like that, but I could barely hold it in my hand. I literally couldn't understand all the fuss about the game, it was unplayable for me...

CDotDot 10y ago
I've also had all of these happen to me. It's quite annoying, (especially the burning hot phone and battery drain), but I'm still enjoying it. Nostalgia is a powerful force.
- MBCook 10y ago
  When the network is up it's surprisingly fun for a game with so many problems. Makes me hope they actually fix some of them soon we can play the game it should be.
minimaxir 10y ago
For those with battery concerns, turn on Battery Saver in the settings. With that enabled, when the phone is rotated upside-down (i.e put in your pocket), brightness drops to 0% and 3D rendering is disabled, both of which help. A little. Constant GPS and battery sucking can't be fully mitigated.
- cocotino 10y ago
  I did that. The screen turned black, and there was no way to bring the game back, other than killing the app. Ridiculous.
  - bhtru 10y ago
    What iPhone do you have?

unimpressive 10y ago

Oh good, I can finally feel comfortable about installing it.

matt_wulfeck 10y ago

I'm glad they involved google to make sure the change happens to anyone and also to verify their claims about access. This is the type of response we should expect/demand from other companies. Well done.

Someone1234 10y ago
I agree it is helpful to involve Google so it can be changed for existing Pokemon Go users. But I don't see how Google has verified the claim, since Google themselves have yet to release a statement. By the way, Google indorsed this comment. Believe me?
- matt_wulfeck 10y ago
  Web of trust I suppose. I trust Nintendo and I also don't think Google would allow such a brazen and public endorsement if it were untrue. If google does indeed reset permissions then you know they've at least been in contact. If it were a smaller company I'd like to see proof.
  - sev 10y ago
    > If it were a smaller company I'd like to see proof. Amazing how much trust the mere size of a company ensues.
    - MattHeard 10y ago
      It's not size directly, but the risk of goodwill. A bigger company stands to lose more goodwill.
      - aioprisan 10y ago
        That and stock value
      - aplummer 10y ago
        I think it can also be size directly, the more people involved the more chance that one of them would tell-all.

e12e 10y ago

Isn't this a bit: "Accidentally left open gate to castle. Now closed. No fix in place to make sure other people working closely with Alphabet/Google won't leave door open again. Share and enjoy." ? On another note, from the "privacy policy": 1. REVISIONS TO THIS PRIVACY POLICY Any information that is collected via our services is covered by the privacy policy in effect at the time such information is collected we may revise this privacy policy from time to time if we make any material changes to this privacy policy, including any change that we propose that will have retroactive effect, we’ll notify you of those changes by posting them on the services or by sending you an email or other notification, and we’ll update the “last updated date” above to indicate when those changes were made So, they'll let you know if they apply retroactive changes to the policy? How is that any different from "lol, you give data, we do what we want, ok?"

DominikR 10y ago
> No fix in place to make sure other people working closely with Alphabet/Google won't leave door open again. Niantic Labs did not create and does not own the permission model and therefore by definition they can't fix it. All they can do is improve their review process to reduce chances that bad code somehow makes it into production. (as probably most of us do) That is not to say that there aren't valid and reasonable use cases for even the most powerful/dangerous permissions. People even root their phones to give some of their apps access to permissions they otherwise couldn't use because there's a lot of cool/interesting stuff you can do that way.
Freak_NL 10y ago
> So, they'll let you know if they apply retroactive changes to the policy? Pretty standard for a lot of apps and web services. The alternative is not to use them, or to be very conscious about what data you supply them with. Most people just click accept (as with any EULA).
- e12e 10y ago
  Seems like a privacy policy that amounts to "lol, whatever" can't possibly be lagally binding in the EU at least. If it is (found to be) void they could be required to delete all customer data - as they have no legal grant to store it or use it for any purpose?

chromaton 10y ago

On Android, Pokemon Go requests permission to access your contacts. I declined this access, and the app still seems to work (modulo the crashes & bugs that others have reported). Accessing the camera and location I can understand, but I don't want to give Pokemon Go access to my contacts.

disgruntledphd2 10y ago
I assume that its for a yet to be implemented find friends feature, but I was also concerned at that permission request.
po1nter 10y ago
I works even if you disable access to the camera (on android that is) but you obviously won't be able to use the AR view.
joshschreuder 10y ago
The contacts request doesn't happen on iOS (yet)

rtanaka 10y ago

It is indeed fixed but updating iOS app alone does not change the permissions. I had to sign out of the app, revoke the permissions on google and then sign back in.

ajoy39 10y ago
thats why they're involving google, Google is handling the permissions changes

deleted 10y ago

[deleted]

quaffapint 10y ago

Keep in mind you dont have to login with your google account - you can create a free pokemon club account and use that.

jaflo 10y ago
Or create a dummy Google account.
sp332 10y ago
That site has been down continuously for days, so it might not be a real option. Edit: OK, continually since it does seem to be up sometimes!
- quaffapint 10y ago
  I just did it this morning - just refreshed the page once and it worked fine.

sl1e 10y ago

Is the button that takes me to login with Google account the same as using a Google email address to create an account?

qwertyuiop924 10y ago

Great. Although this is really a left-pad situation: it's good that they fixed it, but that fact that it was a problem in the first place is pretty damn disturbing.

callesgg 10y ago

Inital thought: Wow that company is so great... that they did the right thing... ...Wait a second do i think a company is great just cause they do things the way they should do them.

TeMPOraL 10y ago
Yes. Because it's an uncommon thing for a company to do right by their customers, and everyone that does IMO deserves praise (and more business).

foota 10y ago

I wonder how many applications do the same thing and haven't been called out on it.

cavisne 10y ago
The difference here is the "grant full access" screen was never shown to users. That shouldn't be possible and speculation is that either the app somehow hijacked past the screen, or Niantic being an ex-google company was whitelisted to avoid this. I can easily see how the second would happen, I wonder if Ingress (their previous inside google app) even showed up on your list of authorized third parties?
- foota 10y ago
  From what others have posted here, any native app that loads the oauth flow in a web view control or whatever it's called, has full control over it, and so can do anything it wants.

panic 10y ago

This update completely broke login for people with Pokemon Trainer Club accounts. It doesn't even send the HTTP request: https://www.reddit.com/r/pokemongo/comments/4sjbeq/ios_users_who_login_using_pokemon_trainers_club/ https://www.reddit.com/r/pokemongo/comments/4sjbeq/ios_users...

stephenyeargin 10y ago

Take a look at this list of potential things you can ask for as a developer: https://developers.google.com/identity/protocols/googlescopes https://developers.google.com/identity/protocols/googlescope... And most folks will click "Approve" without really reviewing the list. That said, Twitter and Facebook (two other popular OAuth providers) heavily restrict certain "full" access to only trusted applications that they either have a business relationship with or otherwise review the application before allowing those scopes to be requested or used. This incident may prompt Google to do more of that, which isn't entirely great news for the more responsible developers with purpose-built apps.

tommorris 10y ago
That's why Facebook changed their APIs in 2014. Before any app could ask for anything. Now apps can only ask for public profile data, email address and a list of your friends that have also installed the app. Before you could also get stuff like education and work history, family relationships, relationship status, sexual orientation and a whole load of other stuff that could potentially cause a lot of trouble. And people would happily click OK just to play FarmVille or whatever. Now Facebook makes it so any app needing advanced permissions data has to be reviewed by Facebook first. See https://developers.facebook.com/blog/post/2014/04/30/the-new-facebook-login/ https://developers.facebook.com/blog/post/2014/04/30/the-new...

mattlutze 10y ago

I'm slightly curious how we prove the statements to be true. There wasn't the normal "this app wants ___ permissions, is that cool?" message from the Google OAuth dialog. I had not idea I'd authorized Niantic to go scrape all my emails, access Google's own processing on them for advertisement system training or review my location history, for example. I'm not so sure why I should believe they didn't do that.