Pokemon Go is a huge security risk • Hacker News Board

Re: Pokemon Go is a huge security risk

#151

Post by chatmasta » Mon, Jul 11, 2016, 6:47 PM UTC

qzervaas wrote: post #148

chatmasta wrote: post #81

Earlier quoted context omitted.

This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…

In iOS 9 there is SFSafariViewController which doesn't give such control. Some providers (e.g. Fitbit) require you use this instead of UIWebView in order to access their API, presumably to avoid accessing the DOM. Not sure exactly how they are enforcing this though, since they don't provide their own OAuth library.

Yeah, you could always override the method in the Fitbit library that implements that requirement.

Re: Pokemon Go is a huge security risk

#152

Post by falcolas » Mon, Jul 11, 2016, 6:51 PM UTC

RKoutnik wrote: post #144

wlesieutre wrote: post #135

Earlier quoted context omitted.

They were an Alphabet company, but were spun off last year: https://www.theguardian.com/technology/2015/aug/14/niantic-l...

Right, so not only did they spend a significant amount of time steeping in Google itself, the big G then invested a significant amount of cash into the now-spun-out company. I'd say that qualifies as 'owned'.

How does that make the permission creep OK? If they were part of Google, and already had access to the data, that's one thing. But they aren't, and they don't.

Re: Pokemon Go is a huge security risk

#153

Post by rbjorklin » Mon, Jul 11, 2016, 6:53 PM UTC

rickyc091 wrote: post #150

hughes wrote: post #54

If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.

So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.

Seriously? What happens if I delete the app? Do I delete all of my progress?

Re: Pokemon Go is a huge security risk

#154

Post by rickyc091 » Mon, Jul 11, 2016, 6:54 PM UTC

rbjorklin wrote: post #153

rickyc091 wrote: post #150

Earlier quoted context omitted.

So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.

Seriously? What happens if I delete the app? Do I delete all of my progress?

I've yet to try that, but I can. I'll report back in a few. Having trouble logging into my iPod... will see if I can get my coworker to remove it from his older device.

Re: Pokemon Go is a huge security risk

#155

Post by h1fra » Mon, Jul 11, 2016, 6:55 PM UTC

rickyc091 wrote: post #150

hughes wrote: post #54

If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.

So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.

Not true, don't worry :)

Re: Pokemon Go is a huge security risk

#156

Post by quantumhobbit » Mon, Jul 11, 2016, 6:57 PM UTC

dopu wrote: post #85

I'm running iOS 9.3.2, and signing in to Pokemon Go caused it to have full access to my Google account. Just revoked it and looks like I can still play the game just fine. Perhaps they misconfigured the Google auth sign-in? It's rather worrisome that it's this easy for an application to gain full access to your account, though.

I did the same. The app worked for a little while but bugged me to sign in again after a close and restart of the app. No thanks.

Re: Pokemon Go is a huge security risk

#157

Post by skewart » Mon, Jul 11, 2016, 7:00 PM UTC

KirinDave wrote: post #123

chatmasta wrote: post #81

Earlier quoted context omitted.

This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…

In summary, if you give a nefarious app your password it can do a nefarious thing? I'm curious how exactly this is specific to the UIWebView implementation.

It's because the app has access to and control over the DOM of the UIWebView. Suppose some app called EvilGameFoo is asking you to authenticate with your Google account. They should kick you to a UI controlled by Google, which EvilGameFoo cannot in any way inspect or access, where you enter your credentials. Google then tells EvilGameFoo that they can vouch for you. Instead, UIWebView lets the app asking you to sign in via an identity provider inspect the DOM of the UK where you enter your credentials. Hence it lets EvilGameFoo read your password.

Re: Pokemon Go is a huge security risk

#158

Post by rickyc091 » Mon, Jul 11, 2016, 7:01 PM UTC

h1fra wrote: post #155

rickyc091 wrote: post #150

Earlier quoted context omitted.

So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.

Not true, don't worry :)

This was the case on an android phone using Google login. His nexus 6X was on a beta build so he was unable to install the app. He started playing the game on an older device while he downgraded his 6X. After it was complete, he logged into his 6X using his google credentials and it prompted him to start over.

Re: Pokemon Go is a huge security risk

#159

Post by onetwotree » Mon, Jul 11, 2016, 7:07 PM UTC

NeonVice wrote: post #13

"[T]his section of the privacy page on the Google account settings website is only showing up for those that have played on iOS and signed in using the Google button. Android users who used the same login method are not seeing the “Pokemon Go Release” at all on the permissions site (nor do they see Ingress), so we’re not sure yet if those users have trusted Niantic with their entire Google account as well." source: h…

Yeah it's not showing anything in my google app permissions. I assume it signed in using google play services (it was automatic, I never selected anything), and that's where the in app purchases seem to go.

Re: Pokemon Go is a huge security risk

#160

Post by bradleyjg » Mon, Jul 11, 2016, 7:12 PM UTC

skewart wrote: post #157

KirinDave wrote: post #123

Earlier quoted context omitted.

In summary, if you give a nefarious app your password it can do a nefarious thing? I'm curious how exactly this is specific to the UIWebView implementation.

It's because the app has access to and control over the DOM of the UIWebView. Suppose some app called EvilGameFoo is asking you to authenticate with your Google account. They should kick you to a UI controlled by Google, which EvilGameFoo cannot in any way inspect or access, where you enter your credentials. Google then tells EvilGameFoo that they can vouch for you. Instead, UIWebView lets the app asking you to sign…

How are you supposed to know that it is actually a UI controlled by google and not a simulation of a UI controlled by google?

The OAuth model not only enables phishing directly even worse than that, it disarms people's natural skepticism towards phishing attempts. Its adoption was a terrible idea.