It is indeed fixed but updating iOS app alone does not change the permissions. I had to sign out of the app, revoke the permissions on google and then sign back in.
thats why they're involving google, Google is handling the permissions changes
Pokemon Go – Permissions Update
51–60 of 112 posts
Re: Pokemon Go – Permissions Update
#52I'm glad they involved google to make sure the change happens to anyone and also to verify their claims about access. This is the type of response we should expect/demand from other companies. Well done.
I agree it is helpful to involve Google so it can be changed for existing Pokemon Go users. But I don't see how Google has verified the claim, since Google themselves have yet to release a statement. By the way, Google indorsed this comment. Believe me?
Web of trust I suppose. I trust Nintendo and I also don't think Google would allow such a brazen and public endorsement if it were untrue. If google does indeed reset permissions then you know they've at least been in contact.
If it were a smaller company I'd like to see proof.
Re: Pokemon Go – Permissions Update
#53Isn't this a bit: "Accidentally left open gate to castle. Now closed. No fix in place to make sure other people working closely with Alphabet/Google won't leave door open again. Share and enjoy." ? On another note, from the "privacy policy": 1. REVISIONS TO THIS PRIVACY POLICY Any information that is collected via our services is covered by the privacy policy in effect at the time such information is collected we may…
> No fix in place to make sure other people working closely with Alphabet/Google won't leave door open again.
Niantic Labs did not create and does not own the permission model and therefore by definition they can't fix it.
All they can do is improve their review process to reduce chances that bad code somehow makes it into production. (as probably most of us do)
That is not to say that there aren't valid and reasonable use cases for even the most powerful/dangerous permissions. People even root their phones to give some of their apps access to permissions they otherwise couldn't use because there's a lot of cool/interesting stuff you can do that way.
Re: Pokemon Go – Permissions Update
#54Earlier quoted context omitted.
Doesn't seem like they were anticipating the load their servers would get. I've had trouble logging in, and other lags from time to time that really seem to be server overload issues.
Not surprising given the incredible overwhelming number of people trying to play the game. I knew it would be huge, I never imagined it would be the phenomenon it is. (Go to a park at lunch or after work if you don't know what I'm talking about. Any park in the country.)
Being a semi-Google company, maybe the server code is written in Python, that's why the servers are always overloaded 8-)
Re: Pokemon Go – Permissions Update
#55This is the same message that was released to the press yesterday. I'm surprised Google itself has not said anything, as they are also at fault for not showing the permissions workflow in the first place.
Exactly, that's what I'm more worried about - Google needs to present clear information about what access is provided BEFORE I accept the account connection. It's not necessarily Niantic's fault for asking for too much, it's Google's for not at least making me aware.
the thing is...as long as its a frame inside the app i have zero way of knowing whether im actually looking at googles login page, or if niantic is reading the traffic/javascript. At least when I get bounced out to safari I only have to trust apple, which I already implicitly do.
Re: Pokemon Go – Permissions Update
#56This is the same message that was released to the press yesterday. I'm surprised Google itself has not said anything, as they are also at fault for not showing the permissions workflow in the first place.
Exactly, that's what I'm more worried about - Google needs to present clear information about what access is provided BEFORE I accept the account connection. It's not necessarily Niantic's fault for asking for too much, it's Google's for not at least making me aware.
[deleted]
Re: Pokemon Go – Permissions Update
#57This is the same message that was released to the press yesterday. I'm surprised Google itself has not said anything, as they are also at fault for not showing the permissions workflow in the first place.
I went through the updated app (v1.0.1) and the oAuth flow clearly indicated what I was granting access to. I'd be very curious if this was a fix by Google, a Google bug where requesting "full access" is missing that step, or Niantic changed the way they do oAuth (still a Google issue, the method lacking confirmation shouldn't exist).
It was some JavaScript injected into the WebView that automatically clicked confirm and sent a message to reposition the WebView offscreen as soon as that happens.
Re: Pokemon Go – Permissions Update
#58I'm glad they involved google to make sure the change happens to anyone and also to verify their claims about access. This is the type of response we should expect/demand from other companies. Well done.
I agree it is helpful to involve Google so it can be changed for existing Pokemon Go users. But I don't see how Google has verified the claim, since Google themselves have yet to release a statement. By the way, Google indorsed this comment. Believe me?
It's probably much easier to involve Google when you are a Google spinoff company.
Re: Pokemon Go – Permissions Update
#59Inital thought:
Wow that company is so great... that they did the right thing...
...Wait a second do i think a company is great just cause they do things the way they should do them.
Re: Pokemon Go – Permissions Update
#60Earlier quoted context omitted.
I went through the updated app (v1.0.1) and the oAuth flow clearly indicated what I was granting access to. I'd be very curious if this was a fix by Google, a Google bug where requesting "full access" is missing that step, or Niantic changed the way they do oAuth (still a Google issue, the method lacking confirmation shouldn't exist).
It was some JavaScript injected into the WebView that automatically clicked confirm and sent a message to reposition the WebView offscreen as soon as that happens.
They did that? That doesn't sound like a mistake, that sounds like a CFAA felony.