Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pokemon Go is a huge security risk

adamreeve.tumblr.com

Post reply on HN
Print view View original

211–220 of 269 posts

Re: Pokemon Go is a huge security risk

#211

Post by aioprisan »

RKoutnik wrote: post #185
dcosson wrote: post #178

Earlier quoted context omitted.

Even if they are a startup within Google, what does that mean for my security as a user? Do they store this API key with full access to a Google account the same way that an official Google app (e.g. Gmail itself) stores my secret data? If so, I probably trust it. Or do they just throw it in a GCE database without a whole lot of thought around a security policy since they're still a fast-moving startup, and maybe my…

You're absolutely right - Niantic's history with Google does not preclude them having crummy security practices that we aren't aware of. However, "Popular thing possibly has crummy security practices (we just don't know)" isn't HN-worthy, it's just FUD. I think both of us would prefer a HN full of well-researched articles over one full of clickbait FUD.

Actually, that's all there is to "research" about this topic, as there is nothing available to read around what they could possibly use the full access tokens in any terms of service or application literature.

Re: Pokemon Go is a huge security risk

#212

Post by roghummal »

Pxtl wrote: post #161
nommm-nommm wrote: post #75

Earlier quoted context omitted.

That's due to a Clinton era law Children's Online Privacy Protection Act of 1998 (COPPA). It forbids companies form collecting personal info from children under 13 without their parents permission.

What's funny is that nobody seems to provide a workflow to actually create accounts for kids. I want to set up a supervised google account for my son for hangouts et al... and I have no idea how. I guess that's not a thing.

>I want to set up a supervised google account for my son for hangouts et al...

Why?

Re: Pokemon Go is a huge security risk

#213

Post by ksenzee »

greggman wrote: post #67
MBCook wrote: post #51

There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement. How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.

Kids (under 13 in USA, under 16 in Netherlands) aren't allowed to have gmail accounts AFAIK https://support.google.com/accounts/answer/1350409?hl=en

Kids know they have to lie about their age online to get access to anything worth having. My 9-year-old has been doing it as long as she's been allowed to use the internet.

Re: Pokemon Go is a huge security risk

#214

Post by horizone »

maxerickson wrote: post #93
Alex3917 wrote: post #32

Earlier quoted context omitted.

This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.

Google recommends using the browser workflow for installed apps too. https://developers.google.com/identity/protocols/OAuth2Insta... Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not. Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use…

2 Factor works. I'm forced to log back in when ever there is server troubles, which is annoying, but what ever.

Re: Pokemon Go is a huge security risk

#215

Post by nfm »

RKoutnik wrote: post #134

It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…

I really disagree with this.

Google has extremely strict safeguards in place to prevent eg. employee Joe from accessing ex-girlfriend Mary's Gmail. Very few people would have full access to individuals' Google accounts. This kind of privacy breach would be very damaging to Google.

Niantic is a tiny startup with around 50 employees. I would expect most developers within the team would have full access to the production database, or would be given access if they had a need for it. It's unlikely that there's any oversight over who can access data - it's just a 'game'.

Where are their backups stored? Are they encrypted? Who has access to the decryption keys? We don't know, but I would bet any amount of money that their systems are vastly less secure than Google's are.

The relationship between Google and Niantic isn't relevant as to whether they are capable of keeping these credentials secure.

Re: Pokemon Go is a huge security risk

#216

Post by maknz »

Full access is bad enough, but the really dodgy thing going on is that you never get asked to approve or deny that access for Pokemon Go when doing the OAuth flow. You just log in, proceed through 2fa, and you're magically logged into the app. Pokemon Go Release then shows up as an authorised app... except I never authorised it.

My theory is that they're injecting JavaScript into the web view to automatically press the 'Approve' button and hiding that from the user. If true, that's very worrying. They'd be effectively circumventing the whole OAuth framework by forging the user's approval of the app. Every user should have been asked up-front whether or not they wanted to approve or deny Pokemon Go's full access.

Re: Pokemon Go is a huge security risk

#217

Post by Sir_Substance »

RKoutnik wrote: post #185
dcosson wrote: post #178

Earlier quoted context omitted.

Even if they are a startup within Google, what does that mean for my security as a user? Do they store this API key with full access to a Google account the same way that an official Google app (e.g. Gmail itself) stores my secret data? If so, I probably trust it. Or do they just throw it in a GCE database without a whole lot of thought around a security policy since they're still a fast-moving startup, and maybe my…

You're absolutely right - Niantic's history with Google does not preclude them having crummy security practices that we aren't aware of. However, "Popular thing possibly has crummy security practices (we just don't know)" isn't HN-worthy, it's just FUD. I think both of us would prefer a HN full of well-researched articles over one full of clickbait FUD.

>However, "Popular thing possibly has crummy security practices (we just don't know)" isn't HN-worthy, it's just FUD.

Bullcrap. Best security policy is trust, but verify.

Assuming that well established businesses have good security practices without doing proper review is what allowed all those fraudulent SWIFT transactions to go through a few months ago. It's perfectly valid to ask why the hell Pokemon Go thinks it needs access to your private email.

Re: Pokemon Go is a huge security risk

#218

Post by casenjo »

seagray wrote: post #6

I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: https://security.google.com/settings/security/permissions I am running on a Nexus 6 and signed in with my Google Account when I first launched the app. Try revoking access and see what happens. Worst case, it might ask you to sign in again.

Same here, OnePlus One running CM13, I can't see it in the list (neither release or the previous field test).

Re: Pokemon Go is a huge security risk

#219

Post by TheGRS »

TheOneTrueKyle wrote: post #202
jonny_eh wrote: post #131

Earlier quoted context omitted.

Pokemon Go, like most apps, is likely just a fad. In a few months, only a few thousand die hards will still be playing it. But the full access permissions will still be there.

That's what my parents said 20 years ago... hasn't died yet

You should try the Go game. It may have some lasting power I haven't seen yet, but its not the normal Pokemon game by any stretch. The core gameplay is actually pretty boring once you've done it for a little while (i.e. once the initial euphoria of catching things wears off).

Re: Pokemon Go is a huge security risk

#220

Post by russjr08 »

rbjorklin wrote: post #153
rickyc091 wrote: post #150

Earlier quoted context omitted.

So here's the interesting thing... apparently if you sign in with the same google account on another phone, you have to start over as a new player.

Seriously? What happens if I delete the app? Do I delete all of my progress?

Then you reinstall and all is fine. I went from using it on my Nexus 7 to my Nexus 5X and all of my progress was there.
Post reply on HN