Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pokemon Go is a huge security risk

adamreeve.tumblr.com

Post reply on HN
Print view View original

141–150 of 269 posts

Re: Pokemon Go is a huge security risk

#141

Post by jpreiland »

seagray wrote: post #6

I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: https://security.google.com/settings/security/permissions I am running on a Nexus 6 and signed in with my Google Account when I first launched the app. Try revoking access and see what happens. Worst case, it might ask you to sign in again.

on iPhone 6s, checked and saw it had full access. I revoked access and opened the app up. It was stuck loading so I logged out and back in. Went back to check app permissions on google and it had full access again.

Re: Pokemon Go is a huge security risk

#143

Post by pmlamotte »

sp332 wrote: post #121
rtkwe wrote: post #113

Earlier quoted context omitted.

It does work properly on Android. It only asks for access to Location, Contacts, Camera, and Storage.

Those are just things it has access to on your phone. That's not the permissions you give it on your Google account, which might include sending email as you. Those you can find here https://security.google.com/settings/security/permissions?pl...

It doesn't appear in that list for me, curious if this is only affecting iPhone users and/or Android 5 and below.

Re: Pokemon Go is a huge security risk

#144

Post by RKoutnik »

wlesieutre wrote: post #135
RKoutnik wrote: post #134

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…

They were an Alphabet company, but were spun off last year: https://www.theguardian.com/technology/2015/aug/14/niantic-l...

Right, so not only did they spend a significant amount of time steeping in Google itself, the big G then invested a significant amount of cash into the now-spun-out company. I'd say that qualifies as 'owned'.

Re: Pokemon Go is a huge security risk

#146

Post by ceejayoz »

mtrpcic wrote: post #105
hughes wrote: post #54

If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.

Yeah, I agree. I strongly suspect that the scope of permissions requests was an oversight (e.g. Just ask for everything now, we'll pair it down once we know what data we need). Additionally, while I don't like the idea of having Niantic having access to my entire Google account, let's remember that Niantic started as a Google company, and is now under the Alphabet umbrella, so have a vested interest in keeping things…

> I strongly doubt that there is anything they could gain from scraping/abusing these Google accounts that would come even close to that type of impact.

I'd have said the same about VW's emissions cheating scandal before it broke.

Re: Pokemon Go is a huge security risk

#147

Post by ceejayoz »

jonny_eh wrote: post #127
chatmasta wrote: post #81

Earlier quoted context omitted.

This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…

If an app does this, won't Google revoke their API key?

They have to detect it. The app could quietly collect credentials for months/years, and revoking the API key won't change those passwords.

Re: Pokemon Go is a huge security risk

#148

Post by qzervaas »

chatmasta wrote: post #81
arielweisberg wrote: post #9

And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…

This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…

In iOS 9 there is SFSafariViewController which doesn't give such control.

Some providers (e.g. Fitbit) require you use this instead of UIWebView in order to access their API, presumably to avoid accessing the DOM.

Not sure exactly how they are enforcing this though, since they don't provide their own OAuth library.

Re: Pokemon Go is a huge security risk

#149

Post by [deleted] »

RKoutnik wrote: post #134

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…

[deleted]

Re: Pokemon Go is a huge security risk

#150

Post by rickyc091 »

hughes wrote: post #54

If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.

So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.
Post reply on HN