Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pokemon Go is a huge security risk

adamreeve.tumblr.com

Post reply on HN
Print view View original

171–180 of 269 posts

Re: Pokemon Go is a huge security risk

#171

Post by ja27 »

rickyc091 wrote: post #158
h1fra wrote: post #155

Earlier quoted context omitted.

Not true, don't worry :)

This was the case on an android phone using Google login. His nexus 6X was on a beta build so he was unable to install the app. He started playing the game on an older device while he downgraded his 6X. After it was complete, he logged into his 6X using his google credentials and it prompted him to start over.

Probably because he was previously playing the Pokemon Go field test. All of the field test data was wiped, accounts and all. Everyone started over.

Re: Pokemon Go is a huge security risk

#172

Post by ja27 »

h1fra wrote: post #155
rickyc091 wrote: post #150

Earlier quoted context omitted.

So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.

Not true, don't worry :)

Not true at all. I've wiped the app from multiple devices and accounts today and it's always restored the player's progress after you log back in.

Re: Pokemon Go is a huge security risk

#173

Post by fattire »

ocdtrekkie wrote: post #33
arielweisberg wrote: post #9

And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that…

The other day someone's web app I clicked on, and it automagically signed me in with Google and added itself to my connected apps. Cloudcraft.co, I think it was. When I hit their signup link, it auto-signed in with Google without me even clicking their Google button. After I disconnected it, it didn't behave that way a second time. So I am kinda mystified what happened there. But it was pretty strange.

Could the app be intercepting the confirm screen and auto-agreeing w/o user interaction?

Re: Pokemon Go is a huge security risk

#174

Post by ja27 »

greggman wrote: post #67
MBCook wrote: post #51

There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement. How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.

Kids (under 13 in USA, under 16 in Netherlands) aren't allowed to have gmail accounts AFAIK https://support.google.com/accounts/answer/1350409?hl=en

That's their stated policy, but we've previously been able to get an under-13 child account though support by verifying parental consent, which is all COPPA requires in the U.S.

Re: Pokemon Go is a huge security risk

#175

Post by skewart »

bradleyjg wrote: post #160
skewart wrote: post #157

Earlier quoted context omitted.

It's because the app has access to and control over the DOM of the UIWebView. Suppose some app called EvilGameFoo is asking you to authenticate with your Google account. They should kick you to a UI controlled by Google, which EvilGameFoo cannot in any way inspect or access, where you enter your credentials. Google then tells EvilGameFoo that they can vouch for you. Instead, UIWebView lets the app asking you to sign…

How are you supposed to know that it is actually a UI controlled by google and not a simulation of a UI controlled by google? The OAuth model not only enables phishing directly even worse than that, it disarms people's natural skepticism towards phishing attempts. Its adoption was a terrible idea.

Well, on the web you're generally following redirects to a URL. You can verify the owner and authenticity of the host. (A phone app could kick you out to a browser app (not a web view) to authenticate.) Then after you've signed in and granted permission on, say, Google, Google will redirect you to a URL that the other app configured with Google. On a phone that URL should have a host or protocol that the app has registered with so your phone's OS will kick you back to the app after you signed in on the web browser.

Of course, you're absolutely right that it would be trivial to spoof, say, Google or Facebook or Twitter and collect credentials. I would _hope_ that behavior would be detected by Apple or Google during app security screening, but maybe not. Regardless, I totally agree with you about OAuth and security. It does present a lot of problems.

Re: Pokemon Go is a huge security risk

#176

Post by cheshire137 »

ja27 wrote: post #169
RKoutnik wrote: post #134

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…

Google's own apps often don't request this much permission. Basic security principles.

Correct. Google Drive, for example, requires fewer permissions: https://pbs.twimg.com/media/CnG3kslW8AA1iZM.jpg:large

Re: Pokemon Go is a huge security risk

#178

Post by dcosson »

RKoutnik wrote: post #134

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…

Even if they are a startup within Google, what does that mean for my security as a user?

Do they store this API key with full access to a Google account the same way that an official Google app (e.g. Gmail itself) stores my secret data? If so, I probably trust it. Or do they just throw it in a GCE database without a whole lot of thought around a security policy since they're still a fast-moving startup, and maybe my credentials get logged somewhere, or synced to an analytics system that's not treated as classified and a whole bunch of employees can inadvertantly access, etc

Seems like I have no way of knowing (unless maybe it's in their terms of service?). It could very well be a "Huge security risk"

Re: Pokemon Go is a huge security risk

#179

Post by [deleted] »

crescentfresh wrote: post #106
chatmasta wrote: post #81

Earlier quoted context omitted.

This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web-based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a tra…

> the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website Uh, seriously? I just suggested to our mobile team to integrate this way on Android (I implemented the OAuth 2 server). I would've made the same suggestion to a 3rd party app vendor when the day comes.

[deleted]

Re: Pokemon Go is a huge security risk

#180

Post by chrisper »

RKoutnik wrote: post #134

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…

Interestingly, it does not work on Android Nougat.
Post reply on HN