Pokemon Go is a huge security risk • Hacker News Board

Re: Pokemon Go is a huge security risk

#61

Post by surge » Mon, Jul 11, 2016, 5:10 PM UTC

drivers99 wrote: post #45

"Pokemon Go Release" has "full access" and yet "Ingress" (a game very similar to Pokemon Go from the same company) only has "basic account info". I removed the access and when I started the app, it crashed right away. (I'm on iOS, by the way.) Subsequent launch I'm stuck on the "LOADING..." screen, and then it says "Failed to get player information from the server." I hope the servers are just down and I didn't lock…

When I signed up, it only said basic account info or that they'd like to know who I am. Nothing else.

Re: Pokemon Go is a huge security risk

#62

Post by MBCook » Mon, Jul 11, 2016, 5:10 PM UTC

kamac wrote: post #21

> I really wish I could play, it looks like great fun, but there’s no way it’s worth the risk. Why not just create a separate google account if one's so eager to play?

Why should I? Why should this be legal in the first place without asking my permission?

Re: Pokemon Go is a huge security risk

#63

Post by Mtinie » Mon, Jul 11, 2016, 5:11 PM UTC

zeffr wrote: post #49

It's a free game everyone. When something is free to play, and involves you walking around with geo services and a camera on, you and your data are the product. This is just massive data collection disguised as a video game.

While that may be true, it isn't relevant to the conversation about how deep into the permissions forest the app is reaching.

Pokemon Go can collect the bunches of the data it wants without having admin-level access to their users' Google accounts.

Re: Pokemon Go is a huge security risk

#64

Post by zeffr » Mon, Jul 11, 2016, 5:11 PM UTC

MBCook wrote: post #56

zeffr wrote: post #49

It's a free game everyone. When something is free to play, and involves you walking around with geo services and a camera on, you and your data are the product. This is just massive data collection disguised as a video game.

No, they make their money through IAPs. No one signed up to let Niantic read their email in exchange for free items.

Maybe no one on HN or in your circle of friends, but I think you massively overestimate the average user's sense of data protection.

Re: Pokemon Go is a huge security risk

#65

Post by test6554 » Mon, Jul 11, 2016, 5:11 PM UTC

Could you not simply create a new google account strictly for use with pokemon go?

Re: Pokemon Go is a huge security risk

#66

Post by test6554 » Mon, Jul 11, 2016, 5:12 PM UTC

Could you simply create a new google account for the sole purpose of playing pokemon go?

Re: Pokemon Go is a huge security risk

#67

Post by greggman » Mon, Jul 11, 2016, 5:14 PM UTC

MBCook wrote: post #51

There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement. How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.

Kids (under 13 in USA, under 16 in Netherlands) aren't allowed to have gmail accounts AFAIK

https://support.google.com/accounts/answer/1350409?hl=en

Re: Pokemon Go is a huge security risk

#68

Post by nommm-nommm » Mon, Jul 11, 2016, 5:14 PM UTC

kamac wrote: post #21

> I really wish I could play, it looks like great fun, but there’s no way it’s worth the risk. Why not just create a separate google account if one's so eager to play?

Who uses their "main" Google account for these one off services anyway? I can't imagine it would be too popular to keep pseudo-anonymity. you don't want to post lol cats from the same account you use to send your resume, I would think.

Re: Pokemon Go is a huge security risk

#69

Post by chipgap98 » Mon, Jul 11, 2016, 5:14 PM UTC

seagray wrote: post #6

I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: https://security.google.com/settings/security/permissions I am running on a Nexus 6 and signed in with my Google Account when I first launched the app. Try revoking access and see what happens. Worst case, it might ask you to sign in again.

Yeah I'm on a Galaxy S7 and signed up with my google account as well and see no mention of it on my connected apps page

Re: Pokemon Go is a huge security risk

#70

Post by DCoder » Mon, Jul 11, 2016, 5:14 PM UTC

nickpsecurity wrote: post #23

Here I thought the article was going to be on how Pokemon Go encourages people to wonder into dangerous or restricted areas while paying attention to their phone. The odds of someone getting attacked in a rough area would seem to go up with such an app given how critical situational awareness is. I don't know enough about how the app works to assess that, though. One app that got me thinking about these things was Go…