Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pokemon Go is a huge security risk

adamreeve.tumblr.com

Post reply on HN
Print view View original

201–210 of 269 posts

Re: Pokemon Go is a huge security risk

#201

Post by raoulduke »

Here's a weird question. https://www.facebook.com/NationalMallNPS/photos/a.3795806520... Pokemon Go is designed to not only augment places where people already are but also to direct them to other places. My friend just ran down the Ninatic/Google connection. Can the app be used to direct people away from polling places and/or to congest areas around polling places?

To wit, would anyone be interested in tracking (I can do it for at least some locations) the locations of gyms in comparison to polling places? (I haven't used the app; can one get a location of gyms?)

[lol. let me clarify my interest would be in thwarting rather than harnessing this possibility.]

Re: Pokemon Go is a huge security risk

#202

Post by TheOneTrueKyle »

jonny_eh wrote: post #131
rwallace wrote: post #37

Caveat: I've seen a number of players state or imply that playing this game has been the first decent exercise they've had in years. Lack of exercise is a far greater threat to your well-being than having your Google account hacked, so if that's what it takes, go ahead and play the game anyway.

Pokemon Go, like most apps, is likely just a fad. In a few months, only a few thousand die hards will still be playing it. But the full access permissions will still be there.

That's what my parents said 20 years ago... hasn't died yet

Re: Pokemon Go is a huge security risk

#204

Post by jpreiland »

towelrod wrote: post #191
jpreiland wrote: post #141

Earlier quoted context omitted.

on iPhone 6s, checked and saw it had full access. I revoked access and opened the app up. It was stuck loading so I logged out and back in. Went back to check app permissions on google and it had full access again.

Wait, you revoked access from within google, and then the pokemon app was able to give itself access again without asking for permission?

Yes. I'm not sure if I need to re-log in the app or not though. Maybe if it didn't freeze and I didn't have to re-log then it might have left the access revoked. But it seems that once I re-log the full access goes back into effect.

Re: Pokemon Go is a huge security risk

#205

Post by peterjlee »

Seem like a issue with Google Auth on iOS. I've logged into Pokemon Go from my Android and iPhone. I revoked the access of "Pokemon Go release" from Connected Apps page then logged in again from my Android phone. "Pokemon Go release" doesn't show up in my Connected Apps page anymore even after a login from Android.

Re: Pokemon Go is a huge security risk

#206

Post by ocdtrekkie »

fattire wrote: post #173
ocdtrekkie wrote: post #33

Earlier quoted context omitted.

The other day someone's web app I clicked on, and it automagically signed me in with Google and added itself to my connected apps. Cloudcraft.co, I think it was. When I hit their signup link, it auto-signed in with Google without me even clicking their Google button. After I disconnected it, it didn't behave that way a second time. So I am kinda mystified what happened there. But it was pretty strange.

Could the app be intercepting the confirm screen and auto-agreeing w/o user interaction?

I am very hesitant to accuse the app of doing something intentionally shady like that. I don't really :know: what happened, and I couldn't replicate it myself after removing the app from my account and visiting it again.

Re: Pokemon Go is a huge security risk

#207

Post by maxerickson »

jasalo wrote: post #190
maxerickson wrote: post #93

Earlier quoted context omitted.

Google recommends using the browser workflow for installed apps too. https://developers.google.com/identity/protocols/OAuth2Insta... Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not. Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use…

Did you try using an App password? Doesn't seem to work for me

No I haven't tried it.

Re: Pokemon Go is a huge security risk

#208

Post by auganov »

Wow. This game must be the fastest thing to skyrocket into worldwide popularity. Yesterday I noticed someone on social media talking about it. "Some random game pokemon fans like" - I figured. Today it seems like everyone around the world is playing it. And it was released just a week ago? Never seen anything quite like it.

Re: Pokemon Go is a huge security risk

#209

Post by nommm-nommm »

Pxtl wrote: post #161
nommm-nommm wrote: post #75

Earlier quoted context omitted.

That's due to a Clinton era law Children's Online Privacy Protection Act of 1998 (COPPA). It forbids companies form collecting personal info from children under 13 without their parents permission.

What's funny is that nobody seems to provide a workflow to actually create accounts for kids. I want to set up a supervised google account for my son for hangouts et al... and I have no idea how. I guess that's not a thing.

It is for some services/websites that have policies in place. Google probably doesn't care enough to have a process, not worth it for them.

Re: Pokemon Go is a huge security risk

#210

Post by DKnoll3 »

pritambaral wrote: post #98
toufka wrote: post #18

Isn't Niantic actually affiliated with (part of?) Google in some way? So it would seem natural, if odd, that it doesn't ask for full permissions for the account is actually already has full permissions to. In the same way google docs doesn't ask, but gets, full permissions to your google account, or google+ doesn't ask, but gets, full permissions to your google account.

Google no longer owns Niantic

Not fully, but they're still very much involved. Money talks, and they're invested.
Post reply on HN