Live data from Hacker News

Pokemon Go is a huge security risk

adamreeve.tumblr.com

51–60 of 269 posts

Re: Pokemon Go is a huge security risk

#51
There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement.

How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.

Re: Pokemon Go is a huge security risk

#54
If google auth as a platform grants full access to your google account without any sort of confirmation, isn't that the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.

Re: Pokemon Go is a huge security risk

#55
post #42
post #36

Earlier quoted context omitted.

> I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app. Is that the case? Doesn't this still require going through the standard prompts?

Anecdote: On Android 6.0 the Pokemon Go game requested 4 permissions on first launch. Account, Camera, Storage, and one other I believe. I had to individually approve each one.

That's just access to your phone, not your Google account. Those permissions don't cover the app's ability to read your email.

Re: Pokemon Go is a huge security risk

#56
post #49

It's a free game everyone. When something is free to play, and involves you walking around with geo services and a camera on, you and your data are the product. This is just massive data collection disguised as a video game.

No, they make their money through IAPs.

No one signed up to let Niantic read their email in exchange for free items.

Re: Pokemon Go is a huge security risk

#57
post #26
post #21

> I really wish I could play, it looks like great fun, but there’s no way it’s worth the risk. Why not just create a separate google account if one's so eager to play?

Seriously; I created one just to avoid entering 2fa every time servers go down.

The pokemon trainer site does work, just requires a lot of refreshing...

Re: Pokemon Go is a huge security risk

#58
post #55
post #42

Earlier quoted context omitted.

Anecdote: On Android 6.0 the Pokemon Go game requested 4 permissions on first launch. Account, Camera, Storage, and one other I believe. I had to individually approve each one.

That's just access to your phone, not your Google account. Those permissions don't cover the app's ability to read your email.

I also do not have an entry on my Google permissions page (https://security.google.com/settings/security/permissions?pl...), this appears to be an iOS only bug, explaining why no Android user can recreate this bug
Post reply on HN