Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pokemon Go is a huge security risk

adamreeve.tumblr.com

Post reply on HN
Print view View original

181–190 of 269 posts

Re: Pokemon Go is a huge security risk

#181

Post by trhaynes »

criley2 wrote: post #58
sp332 wrote: post #55

Earlier quoted context omitted.

That's just access to your phone, not your Google account. Those permissions don't cover the app's ability to read your email.

I also do not have an entry on my Google permissions page ( https://security.google.com/settings/security/permissions?pl... ), this appears to be an iOS only bug, explaining why no Android user can recreate this bug

I do have an entry on that page!

"Pokemon Go Release - Has full access to your Google account"

Revoking access now. Glad I read HN!

Re: Pokemon Go is a huge security risk

#182

Post by bt3 »

russjr08 wrote: post #126
jonny_eh wrote: post #125

Earlier quoted context omitted.

How could iOS be responsible for the auth between two third-party services? Isn't it more likely to be a bug in the iOS version of Pokemon Go?

They probably meant the Google Auth library for iOS.

Yes, thanks for clarifying.

Re: Pokemon Go is a huge security risk

#185

Post by RKoutnik »

dcosson wrote: post #178
RKoutnik wrote: post #134

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…

Even if they are a startup within Google, what does that mean for my security as a user? Do they store this API key with full access to a Google account the same way that an official Google app (e.g. Gmail itself) stores my secret data? If so, I probably trust it. Or do they just throw it in a GCE database without a whole lot of thought around a security policy since they're still a fast-moving startup, and maybe my…

You're absolutely right - Niantic's history with Google does not preclude them having crummy security practices that we aren't aware of.

However, "Popular thing possibly has crummy security practices (we just don't know)" isn't HN-worthy, it's just FUD. I think both of us would prefer a HN full of well-researched articles over one full of clickbait FUD.

Re: Pokemon Go is a huge security risk

#186

Post by Nadya »

Animats wrote: post #184

Where there's a security hole, there's an exploit.[1] [1] https://thestack.com/security/2016/07/11/infected-pokemon-go...

This is completely unrelated because it isn't exploiting anything (other than humanware)

Any modified APK for any App could be loaded in with a RAT asking for full permissions. It just happens PKMNGO is popular and people are trying to get their hands on it before it is officially released in their region.

Re: Pokemon Go is a huge security risk

#187

Post by rtkwe »

sp332 wrote: post #121
rtkwe wrote: post #113

Earlier quoted context omitted.

It does work properly on Android. It only asks for access to Location, Contacts, Camera, and Storage.

Those are just things it has access to on your phone. That's not the permissions you give it on your Google account, which might include sending email as you. Those you can find here https://security.google.com/settings/security/permissions?pl...

I checked that page already. I can only speak for myself but for me it has no listing on the Google Permissions page so it looks like it does permissions correctly to me.

Re: Pokemon Go is a huge security risk

#188

Post by rwallace »

jonny_eh wrote: post #131
rwallace wrote: post #37

Caveat: I've seen a number of players state or imply that playing this game has been the first decent exercise they've had in years. Lack of exercise is a far greater threat to your well-being than having your Google account hacked, so if that's what it takes, go ahead and play the game anyway.

Pokemon Go, like most apps, is likely just a fad. In a few months, only a few thousand die hards will still be playing it. But the full access permissions will still be there.

Point. If you use a lot of things that require access permissions, maybe it should be part of your spring cleaning or some such to look through what you've given permission for, and cancel anything you haven't used in the last six months or whatever.

Re: Pokemon Go is a huge security risk

#189

Post by st3fan »

RKoutnik wrote: post #134

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…

This doesn't mean shit. You still give another legal entity access to your data. Different company, different people, different management, different EULA.

Re: Pokemon Go is a huge security risk

#190

Post by jasalo »

maxerickson wrote: post #93
Alex3917 wrote: post #32

Earlier quoted context omitted.

This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.

Google recommends using the browser workflow for installed apps too. https://developers.google.com/identity/protocols/OAuth2Insta... Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not. Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use…

Did you try using an App password? Doesn't seem to work for me
Post reply on HN