Better/more neutral title: Pokemon Go asks for full Google permissions
I was not asked. I put in my username, password, 2FA, and that was it. No permissions dialog - I certainly wouldn't have given it admin rights to my Google Account.
Pokemon Go is a huge security risk
31–40 of 269 posts
Re: Pokemon Go is a huge security risk
#32And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…
This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.
Re: Pokemon Go is a huge security risk
#33And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…
The other day someone's web app I clicked on, and it automagically signed me in with Google and added itself to my connected apps. Cloudcraft.co, I think it was. When I hit their signup link, it auto-signed in with Google without me even clicking their Google button.
After I disconnected it, it didn't behave that way a second time. So I am kinda mystified what happened there. But it was pretty strange.
Re: Pokemon Go is a huge security risk
#34I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: https://security.google.com/settings/security/permissions I am running on a Nexus 6 and signed in with my Google Account when I first launched the app. Try revoking access and see what happens. Worst case, it might ask you to sign in again.
It's possible it only does this on iOS, because I signed up normally using iOS and I see this at that link:
https://dl.dropbox.com/s/bgii07rzoddj504/Screenshot%202016-0...
Re: Pokemon Go is a huge security risk
#35Earlier quoted context omitted.
They no longer own them. They were spun during the housecleaning before the Alphabet announcement.
Yep, though they also soon after made a further investment in Niantic. It may sound bizarre at first, but there might be good reasons why they did that. For instance, Nintendo might've been less likely to team up with a wholly Google-owned Niantic. (purely speculation on my part) https://nianticlabs.com/blog/niantic-tpc-nintendo/
more like google wants 2 layers of protection from the inevitable lawsuits from stalking victims and families of car crash victims caused by ingress or go.
Re: Pokemon Go is a huge security risk
#36And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…
> I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app.
Is that the case? Doesn't this still require going through the standard prompts?
Re: Pokemon Go is a huge security risk
#37Caveat: I've seen a number of players state or imply that playing this game has been the first decent exercise they've had in years. Lack of exercise is a far greater threat to your well-being than having your Google account hacked, so if that's what it takes, go ahead and play the game anyway.
Re: Pokemon Go is a huge security risk
#38Better/more neutral title: Pokemon Go asks for full Google permissions
Not really. There is absolutely no reason for a game, or pretty much any other kind of software, apart from maybe an operating system, to have full access to your Google account. It adds a new single point of failure for everything somewhere you have no control over – I don't think "huge security risk" is unnecessary editorial in this case.
Re: Pokemon Go is a huge security risk
#39On Android 6.0 I got the correct permissions dialog and I was able to select what the app sees and what it can do. Is this just me?
Re: Pokemon Go is a huge security risk
#40I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: https://security.google.com/settings/security/permissions I am running on a Nexus 6 and signed in with my Google Account when I first launched the app. Try revoking access and see what happens. Worst case, it might ask you to sign in again.
Just chiming in that I am another person (using a OnePlus One with cyanogenmod) that does not even see pokemon go in my "Apps Connected to your Account".