Live data from Hacker News

Pokemon Go, Security, and Obsolescence

community.rapid7.com

31–40 of 109 posts

Re: Pokemon Go, Security, and Obsolescence

#31
post #19

Earlier quoted context omitted.

Furthermore, you can buy GPS spoofing devices anwyay which you can just carry around with you in your pocket.

To be fair, that's probably highly illegal if caught by the fcc.

The FCC only has business in the US though.

Re: Pokemon Go, Security, and Obsolescence

#32
You can unroot CyanogenMod running on the Nexus 4 & Pokemon Go will run just fine. You have to give the SuperSU app root privileges in order to unroot ironically, but it works just fine & you can always root your system from the bootloader in the future if it turns out that you need root for some reason.

There’s an app in the Play Store that runs the tests the Google library that Niantic is using to check whether a phone is rooted or not (it’s the same tests used by the Google Pay infrastructure IIRC).

Re: Pokemon Go, Security, and Obsolescence

#33
It should be pretty easy to get around this by using Magisk[0] systemless root, is it not? Magisk is able to pass Google's SafetyNet tamper detection API which IIRC is what Pokemon Go uses to detect root. Works for Android Pay at least, which also prevents use of the app on rooted devices.

[0]: http://forum.xda-developers.com/apps/magisk/official-magisk-...

Re: Pokemon Go, Security, and Obsolescence

#34
post #32

You can unroot CyanogenMod running on the Nexus 4 & Pokemon Go will run just fine. You have to give the SuperSU app root privileges in order to unroot ironically, but it works just fine & you can always root your system from the bootloader in the future if it turns out that you need root for some reason. There’s an app in the Play Store that runs the tests the Google library that Niantic is using to check whether a p…

This is the app I've used in the past: https://play.google.com/store/apps/details?id=com.scottyab.s...

Also I was under the impression that SafetyNet would only pass on stock ROMs (to include official CyanogenMod builds lacking root). Is that not true? Will it also pass on any custom ROM lacking root?

Edit: According to http://androiding.how/use-android-pay-cm14-cm13/, SafetyNet (the tamper detection API in use by Android Pay and Pokemon Go) will only pass on official stable (non-nightly) releases of CM13/CM14 that have root disabled in the Developer options. It will not pass on debug releases of firmwares/ROMs, including Android 7.0 Nougat based CM14 and Android 6.0 Marshmallow based CM13 ROMs.

Re: Pokemon Go, Security, and Obsolescence

#35
post #34
post #32

You can unroot CyanogenMod running on the Nexus 4 & Pokemon Go will run just fine. You have to give the SuperSU app root privileges in order to unroot ironically, but it works just fine & you can always root your system from the bootloader in the future if it turns out that you need root for some reason. There’s an app in the Play Store that runs the tests the Google library that Niantic is using to check whether a p…

This is the app I've used in the past: https://play.google.com/store/apps/details?id=com.scottyab.s... Also I was under the impression that SafetyNet would only pass on stock ROMs (to include official CyanogenMod builds lacking root). Is that not true? Will it also pass on any custom ROM lacking root? Edit: According to http://androiding.how/use-android-pay-cm14-cm13/ , SafetyNet (the tamper detection API in use by A…

SafetyNet passes on my Nexus 4 running an unrooted currentish CyanogenMod nightly build.

Haven’t tried any other Android custom roms.

Re: Pokemon Go, Security, and Obsolescence

#36
post #2

Now Niantic's decision to disallow root devices, imo, is pretty regretful, as serious botters will likely be able to get around that restriction regardless. This only serves to punish users who are stuck between having a root-enabled custom ROM or a stock ROM where critical root exploits may exist. One thing that I observed is that no one seems to be interested in producing a ROM that is both stable, has a variety of…

A few botters don't hurt Pokémon go. But when it's easy to bot, lots of people will bot. It's easy to circumvent anti root, but it's impossible to use the same way for lots of devices without niantic being able to block it again. So it really makes sense for them to go this way IMO.

Not really. It doesn't matter if the phone is rooted or not, what matters is whether it is feeding false gps data or not. Bots will soon find a way around this (non-rooted) restriction anyway.

That said, proper protection against cheating would involve using markers (other phones?) in vicinity, so it should be possible too.

Re: Pokemon Go, Security, and Obsolescence

#37
post #8

Earlier quoted context omitted.

The problem is that you don't need root for GPS spoofing. Botters also don't care about SafetyNet (used to detect root before the game starts), since they reverse engineer the API and make REST calls directly. Furthermore, there are ways around the root check - mostly involving hiding the su binary and some additional tweaks.

Furthermore, you can buy GPS spoofing devices anwyay which you can just carry around with you in your pocket.

Don't carry it around, though! Put the thing in a Faraday's cage, and use a cable through the mesh to get your Internet connection.

Re: Pokemon Go, Security, and Obsolescence

#38
post #24

Earlier quoted context omitted.

How so? I play Pokémon Go and can't think of a single thing they've done that has spoiled the experience for me. Neither can my friends. We love the game as it is. Bear in mind we are casual players, like most are.

Granted it's not the most representive sample but a glance through https://www.reddit.com/r/pokemongo shows that the majority of people are complaining. I live by a park where there are 3 Pokestops and a Gym and it used to be mildly crowded, now it's empty. It's obvious that the game has died down and it all can be traced back to when Niantic broke the tracking system and proceeded to go after Maps. Every "anti-cheat…

I wouldn't say that the vocal minority of reddit is representative of the player base in large but I see your point.

And yes, I've noticed the same thing. However, I don't think anyone thought it would continue like the crazy early days forever, where every other person you saw played. Just because that extreme hype died down doesn't mean no-one is playing.

I don't agree that it's due to the actions of Niantic though. I think it's just a natural fade of the hype. It would be completely insane if the player percentage had continued at that level until now. Even if they did all the right things I think the fade would have been inevitable.

Re: Pokemon Go, Security, and Obsolescence

#39
post #2

Now Niantic's decision to disallow root devices, imo, is pretty regretful, as serious botters will likely be able to get around that restriction regardless. This only serves to punish users who are stuck between having a root-enabled custom ROM or a stock ROM where critical root exploits may exist. One thing that I observed is that no one seems to be interested in producing a ROM that is both stable, has a variety of…

> This is not a solution for the mass majority of users.

root is not used by the mass majority of users.

Re: Pokemon Go, Security, and Obsolescence

#40
post #24

Surprised people are still playing Pokemon Go. Niantic made all the wrong moves.

How so? I play Pokémon Go and can't think of a single thing they've done that has spoiled the experience for me. Neither can my friends. We love the game as it is. Bear in mind we are casual players, like most are.

I left the game because:

+ Disabled footpad tracking made it less fun.

+ Some update made it sluggish on my 10-month-old phone.

+ They don't let you play with Root (I have a workaround, but it's a pain).

+ Gameplay is highly repetitive past lvl 20

I just feel constantly trampled on. I'll waste my time with someone who treats me like an adult.

Post reply on HN