Pokemon Go is a huge security risk • Hacker News Board

Re: Pokemon Go is a huge security risk

#71

Post by chipgap98 » Mon, Jul 11, 2016, 5:16 PM UTC

gregorkas wrote: post #39

On Android 6.0 I got the correct permissions dialog and I was able to select what the app sees and what it can do. Is this just me?

But isn't that what the app needs from your phone? I always thought that was difference then what you are giving an app permission to do when using OAuth

Re: Pokemon Go is a huge security risk

#72

Post by beckler » Mon, Jul 11, 2016, 5:17 PM UTC

It should be noted that it sounds like only iOS users are seeing this.

I signed in with my Android, and I didn't see anything from Niantic or Pokemon Go in my security settings.

Re: Pokemon Go is a huge security risk

#73

Post by BryantD » Mon, Jul 11, 2016, 5:19 PM UTC

drivers99 wrote: post #45

"Pokemon Go Release" has "full access" and yet "Ingress" (a game very similar to Pokemon Go from the same company) only has "basic account info". I removed the access and when I started the app, it crashed right away. (I'm on iOS, by the way.) Subsequent launch I'm stuck on the "LOADING..." screen, and then it says "Failed to get player information from the server." I hope the servers are just down and I didn't lock…

When I checked this morning Ingress also had full perms. I revoked and reconnected and Ingress only had basic account info. I was also queried appropriately.

Possibly this was fixed on Ingress sometime in the last X months but not on Pokemon Go.

Re: Pokemon Go is a huge security risk

#74

Post by elwell » Mon, Jul 11, 2016, 5:19 PM UTC

thoreauway wrote: post #14

Doesn't Google OWN Niantic? So now Google has access to our Google data? Don't see the issue.

Having been created by ex-Googlers you would think they knowingly chose to get full-access permissions. I wonder if there is a some ulterior motive to the app. Some have suggested up-to-date street-view mining; that wouldn't require full google account access though.

Re: Pokemon Go is a huge security risk

#75

Post by nommm-nommm » Mon, Jul 11, 2016, 5:19 PM UTC

greggman wrote: post #67

MBCook wrote: post #51

There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement. How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.

Kids (under 13 in USA, under 16 in Netherlands) aren't allowed to have gmail accounts AFAIK https://support.google.com/accounts/answer/1350409?hl=en

That's due to a Clinton era law Children's Online Privacy Protection Act of 1998 (COPPA). It forbids companies form collecting personal info from children under 13 without their parents permission.

Re: Pokemon Go is a huge security risk

#76

Post by handruin » Mon, Jul 11, 2016, 5:19 PM UTC

seagray wrote: post #6

I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: https://security.google.com/settings/security/permissions I am running on a Nexus 6 and signed in with my Google Account when I first launched the app. Try revoking access and see what happens. Worst case, it might ask you to sign in again.

I also don't see any app access granted for Pokemon Go under my LG V10 and Google account.

Re: Pokemon Go is a huge security risk

#77

Post by generalledger » Mon, Jul 11, 2016, 5:20 PM UTC

beckler wrote: post #72

It should be noted that it sounds like only iOS users are seeing this. I signed in with my Android, and I didn't see anything from Niantic or Pokemon Go in my security settings.

Same here (Android user), and I just double checked what apps have access to my google account, and nothing from Niantic or Pokemon Go listed at all.

Re: Pokemon Go is a huge security risk

#78

Post by eth1 » Mon, Jul 11, 2016, 5:20 PM UTC

http://boards.4chan.org/pol/thread/80610796/pokemon-go-is-ba...

Re: Pokemon Go is a huge security risk

#79

Post by jerf » Mon, Jul 11, 2016, 5:21 PM UTC

MBCook wrote: post #51

There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement. How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.

The FTC is already involved by default: https://en.wikipedia.org/wiki/Children's_Online_Privacy_Prot...

I have no comment as to whether this is a violation or not; I know nothing about Pokemon Go. I'm just pointing out there is already extensive regulation here.

Re: Pokemon Go is a huge security risk

#80

Post by [deleted] » Mon, Jul 11, 2016, 5:21 PM UTC

teofilow wrote: post #28

nickpsecurity wrote: post #23

Here I thought the article was going to be on how Pokemon Go encourages people to wonder into dangerous or restricted areas while paying attention to their phone. The odds of someone getting attacked in a rough area would seem to go up with such an app given how critical situational awareness is. I don't know enough about how the app works to assess that, though. One app that got me thinking about these things was Go…

What city is this? Just curious. I don't know any such city in the United States

[deleted]