Pokemon Go is a huge security risk • Hacker News Board

Re: Pokemon Go is a huge security risk

#81

Post by chatmasta » Mon, Jul 11, 2016, 5:23 PM UTC

arielweisberg wrote: post #9

And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…

This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a traditional safari page, the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website.

There is no technical limitation to an app engaging in very nefarious activity. For example an app could modify the DOM on the sign-in screen to grab your password after you enter it. Of course the accountability of MITM and security reviews might mitigate this risk, but passwords are generally only a few bytes and could easily be obfuscated and passed surreptitiously over the wire.

I've seen a (quite popular) app implement this for facebook invitations, which should only have a limit of 50 friends, to secretly (in the background, without any action on your behalf other than logging in, or perhaps pressing a "continue" button) invite every one of your friends to download the app. Since facebook does not notify you when you send an inviation, you would not even know the app did this unless one of your friends who you invited asked you about it.

[0] https://news.ycombinator.com/item?id=11637209 (thanks molecule)

Re: Pokemon Go is a huge security risk

#82

Post by jaxondu » Mon, Jul 11, 2016, 5:23 PM UTC

drivers99 wrote: post #45

"Pokemon Go Release" has "full access" and yet "Ingress" (a game very similar to Pokemon Go from the same company) only has "basic account info". I removed the access and when I started the app, it crashed right away. (I'm on iOS, by the way.) Subsequent launch I'm stuck on the "LOADING..." screen, and then it says "Failed to get player information from the server." I hope the servers are just down and I didn't lock…

Apparently Google Maps also has full access to your Google account: http://sanziro.com/2016/07/pokemon-go-has-full-access-to-you...

Re: Pokemon Go is a huge security risk

#83

Post by MBCook » Mon, Jul 11, 2016, 5:24 PM UTC

jerf wrote: post #79

MBCook wrote: post #51

There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement. How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.

The FTC is already involved by default: https://en.wikipedia.org/wiki/Children's_Online_Privacy_Prot... I have no comment as to whether this is a violation or not; I know nothing about Pokemon Go. I'm just pointing out there is already extensive regulation here.

Right, I meant I hoped they'd actually do some saber rattling or action.

When you first sign up you have to enter your age, I don't know if there is a minimum age for the game. As an adult I'm old enough to get through that prompt.

Re: Pokemon Go is a huge security risk

#84

Post by MBCook » Mon, Jul 11, 2016, 5:25 PM UTC

zeffr wrote: post #64

MBCook wrote: post #56

Earlier quoted context omitted.

No, they make their money through IAPs. No one signed up to let Niantic read their email in exchange for free items.

Maybe no one on HN or in your circle of friends, but I think you massively overestimate the average user's sense of data protection.

I'm willing to bet if you put a warning that said "This app will read your email" a ton of people would react. Not 100%, but a ton.

Especially parents.

Re: Pokemon Go is a huge security risk

#85

Post by dopu » Mon, Jul 11, 2016, 5:27 PM UTC

I'm running iOS 9.3.2, and signing in to Pokemon Go caused it to have full access to my Google account. Just revoked it and looks like I can still play the game just fine.

Perhaps they misconfigured the Google auth sign-in? It's rather worrisome that it's this easy for an application to gain full access to your account, though.

Re: Pokemon Go is a huge security risk

#86

Post by MBCook » Mon, Jul 11, 2016, 5:27 PM UTC

randomh3r0 wrote: post #11

arielweisberg wrote: post #10

Earlier quoted context omitted.

It's been down since at least last Thursday. The way I hear it it's been much longer.

But, again, I made an account yesterday. Don't just throw around account access, no matter how pervasive, in the name of impatience. Ever.

The game never asks for access, it's not clear in any way how much information you're giving them.

In the past I've tried to use Google to sign in to some games and been given a screen that I noped out of because of what it was asking for. That didn't happen here. I assumed they only got my email address (if that), not full email/contact/calendar history.

I checked my Google permissions. iOS has a fair amount, Mac OS X has a fair amount, Pokémon GO has more than both put together. Without asking. That's crazy.

Re: Pokemon Go is a huge security risk

#87

Post by gg97 » Mon, Jul 11, 2016, 5:28 PM UTC

I read people are chasing "pokemon" everywhere. I do not even know what a Pokemon is but I'm pretty sure Descartes would not care.

Reading the press, I understand we may expect to see random people looking in their phone on the street chasing virtual pets.

And still some people complains about the security risk of sharing his google account. Nobody seems to see the big picture. I guess that is the "Idiocracy" future we are being sold every day.

Of course I will never ever chase a virtual pet in the street with my "dumb-phone". But this does raise questions for the future of humanity if hundred thousands of people do.

That must be the end of the world.

Re: Pokemon Go is a huge security risk

#88

Post by molecule » Mon, Jul 11, 2016, 5:29 PM UTC

chatmasta wrote: post #81

arielweisberg wrote: post #9

And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…

This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…

> how do I permalink to a comment?

The comment's timestamp is a link.

Re: Pokemon Go is a huge security risk

#89

Post by detaro » Mon, Jul 11, 2016, 5:31 PM UTC

gg97 wrote: post #87

I read people are chasing "pokemon" everywhere. I do not even know what a Pokemon is but I'm pretty sure Descartes would not care. Reading the press, I understand we may expect to see random people looking in their phone on the street chasing virtual pets. And still some people complains about the security risk of sharing his google account. Nobody seems to see the big picture. I guess that is the "Idiocracy" future…

How is this any more "end of the world" than people watching TV?

Re: Pokemon Go is a huge security risk

#90

Post by csolo93 » Mon, Jul 11, 2016, 5:34 PM UTC

dopu wrote: post #85

I'm running iOS 9.3.2, and signing in to Pokemon Go caused it to have full access to my Google account. Just revoked it and looks like I can still play the game just fine. Perhaps they misconfigured the Google auth sign-in? It's rather worrisome that it's this easy for an application to gain full access to your account, though.

Did you check the permissions again? I did the same, running the same iOS version, and it just restored the same full-access when I opened the app again.