Funny enough when I downloaded the app I didn't use my official account and I logged in with a secondary account wondering exactly about this.
Pokemon Go is a huge security risk
251–260 of 269 posts
Re: Pokemon Go is a huge security risk
#252It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…
>Dollars to doughnuts they tried to use some internal-only API
Not at all necessary for this situation to occur. I just finished implementing a system (nothing to do with Pokemon) that also requests permission from external sites in a similar way. The mechanics for doing this are fiddly and checking this is actually set up correctly is likely well down the priority list provided things at least appear to work.
It is entirely possible that someone who had never done it before set it up in a hurry then everyone in the dev team just blindly clicked through without ever properly reading what was being requested because they were all in a rush to finish their stuff.
Re: Pokemon Go is a huge security risk
#253It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually owned by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security ri…
I really disagree with this. Google has extremely strict safeguards in place to prevent eg. employee Joe from accessing ex-girlfriend Mary's Gmail. Very few people would have full access to individuals' Google accounts. This kind of privacy breach would be very damaging to Google. Niantic is a tiny startup with around 50 employees. I would expect most developers within the team would have full access to the productio…
> Google has extremely strict safeguards in place to prevent eg. employee Joe from accessing ex-girlfriend Mary's Gmail
I know a bit about google's internal privacy safeguards (including how long they've been in place), and I know a bit (nothing that wasn't in the news) about the NSA's internal privacy safeguards from a certain point in time.
Obviously I don't know what it's like at the NSA today, but it's worth laughing (or crying) at the fact that there was a time when Google placed more restrictions and security in place to protect its users from rogue employees than the NSA did.
Not to get too political.
Re: Pokemon Go is a huge security risk
#254Earlier quoted context omitted.
It is for some services/websites that have policies in place. Google probably doesn't care enough to have a process, not worth it for them.
Since I can't edit here is an example: http://www.neopets.com/coppa/consentform.phtml Google doesn't care because it takes more effort for them to obey by the law than its worth for them at this time.
Haha, I remember getting this signed and then faxed by my dad when I was like 11. Funny seeing it here because I first learned HTML from Neopets (anyone else?). HTML brought me to javascript and computer programming in general. 15 years later, that form is still up and I guess kids are still playing Neopets. And now I am here, weird.
Re: Pokemon Go is a huge security risk
#255If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.
Yeah, I agree. I strongly suspect that the scope of permissions requests was an oversight (e.g. Just ask for everything now, we'll pair it down once we know what data we need). Additionally, while I don't like the idea of having Niantic having access to my entire Google account, let's remember that Niantic started as a Google company, and is now under the Alphabet umbrella, so have a vested interest in keeping things…
Hanlon's Razor
Re: Pokemon Go is a huge security risk
#256kind of a scam, just a bad wording from google "full access" and old oauth workflow - but no real security threat
TLDR: Pokemon Go can't read your gmail - he checked
https://gist.github.com/arirubinstein/fd5453537436a8757266f9...
Re: Pokemon Go is a huge security risk
#257Earlier quoted context omitted.
How are you supposed to know that it is actually a UI controlled by google and not a simulation of a UI controlled by google? The OAuth model not only enables phishing directly even worse than that, it disarms people's natural skepticism towards phishing attempts. Its adoption was a terrible idea.
Well, on the web you're generally following redirects to a URL. You can verify the owner and authenticity of the host. (A phone app could kick you out to a browser app (not a web view) to authenticate.) Then after you've signed in and granted permission on, say, Google, Google will redirect you to a URL that the other app configured with Google. On a phone that URL should have a host or protocol that the app has regi…
Google could send you a confirmation email which is the second factor in this oauth flow. It makes it more annoying, but more secure. It's always a trade off I guess.
Re: Pokemon Go is a huge security risk
#258Here's a weird question. https://www.facebook.com/NationalMallNPS/photos/a.3795806520... Pokemon Go is designed to not only augment places where people already are but also to direct them to other places. My friend just ran down the Ninatic/Google connection. Can the app be used to direct people away from polling places and/or to congest areas around polling places? To wit, would anyone be interested in tracking (I c…
screw pooling places, what about locations of businesses (restaurants etc) that spend serious $$ for Google advertising?
Re: Pokemon Go is a huge security risk
#259I'm more worried about my daughter getting hit by a car (because she walks in front of it, or because the driver is playing) than I am about my google account being hijacked!
How about your daughters naked selfies leaking because someone breached Niantic and leveraged access to gdrive?
Re: Pokemon Go is a huge security risk
#260This article, though rife with paranoia, brings up some interesting points.
http://blackbag.gawker.com/pokemon-go-is-a-government-survei...