121–130 of 269 posts
Earlier quoted context omitted.
Niantic used to be owned by Google, so they should know what they're doing.
It does work properly on Android. It only asks for access to Location, Contacts, Camera, and Storage.
If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.
And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…
This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…
I'm curious how exactly this is specific to the UIWebView implementation.
I read people are chasing "pokemon" everywhere. I do not even know what a Pokemon is but I'm pretty sure Descartes would not care. Reading the press, I understand we may expect to see random people looking in their phone on the street chasing virtual pets. And still some people complains about the security risk of sharing his google account. Nobody seems to see the big picture. I guess that is the "Idiocracy" future…
I bet you are in your underwear inside your room with several half empty cans of warm beer around your desk.
Knee on the ground i beg you, ô master of wisdom : Teach Me.
If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.
To my knowledge, this is known bug in iOS that the Google auth grant inadvertently gives all permissions. You'll note that other users below report this only happening on iOS and not Android which shifts the risk away from Niantic/ Pokemon Go and towards Google itself, as you've mentioned.
Isn't it more likely to be a bug in the iOS version of Pokemon Go?
Earlier quoted context omitted.
To my knowledge, this is known bug in iOS that the Google auth grant inadvertently gives all permissions. You'll note that other users below report this only happening on iOS and not Android which shifts the risk away from Niantic/ Pokemon Go and towards Google itself, as you've mentioned.
How could iOS be responsible for the auth between two third-party services? Isn't it more likely to be a bug in the iOS version of Pokemon Go?
And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…
This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…
Earlier quoted context omitted.
That's just access to your phone, not your Google account. Those permissions don't cover the app's ability to read your email.
I also do not have an entry on my Google permissions page ( https://security.google.com/settings/security/permissions?pl... ), this appears to be an iOS only bug, explaining why no Android user can recreate this bug
Earlier quoted context omitted.
This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…
> the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website Uh, seriously? I just suggested to our mobile team to integrate this way on Android (I implemented the OAuth 2 server). I would've made the same suggestion to a 3rd party app vendor when the day comes.