Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pokemon Go – Permissions Update

support.pokemongo.nianticlabs.com

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Pokemon Go – Permissions Update

#81

Post by madeofpalk »

HappyTypist wrote: post #57
scosman wrote: post #27

Earlier quoted context omitted.

I went through the updated app (v1.0.1) and the oAuth flow clearly indicated what I was granting access to. I'd be very curious if this was a fix by Google, a Google bug where requesting "full access" is missing that step, or Niantic changed the way they do oAuth (still a Google issue, the method lacking confirmation shouldn't exist).

It was some JavaScript injected into the WebView that automatically clicked confirm and sent a message to reposition the WebView offscreen as soon as that happens.

[citation needed]

Re: Pokemon Go – Permissions Update

#82

Post by madeofpalk »

illumin8 wrote: post #72
HappyTypist wrote: post #57

Earlier quoted context omitted.

It was some JavaScript injected into the WebView that automatically clicked confirm and sent a message to reposition the WebView offscreen as soon as that happens.

If they did that, they don't deserve a second chance at trust. That is outright malicious, and definitely a dark pattern. Their app deserves to be deleted and not used again. Oauth2 has some serious holes - I have no idea if the Google login page is served by Google, or is simply a copy of their landing page designed to phish for credentials. This needs to be fixed as Oauth is becoming increasingly prevalent. We need…

This is why providers like FitBit require that you use APIs such as Chrome Custom Tabs or SafariViewController, where the OS presents an out-of-process limited web view that the host app doesn't have access to.

Re: Pokemon Go – Permissions Update

#83

Post by imron »

poorman wrote: post #58
Someone1234 wrote: post #46

Earlier quoted context omitted.

I agree it is helpful to involve Google so it can be changed for existing Pokemon Go users. But I don't see how Google has verified the claim, since Google themselves have yet to release a statement. By the way, Google indorsed this comment. Believe me?

It's probably much easier to involve Google when you are a Google spinoff company.

Yeah, because they likely have the phone number of someone they can call.

Re: Pokemon Go – Permissions Update

#84

Post by MattHeard »

sev wrote: post #77
matt_wulfeck wrote: post #52

Earlier quoted context omitted.

Web of trust I suppose. I trust Nintendo and I also don't think Google would allow such a brazen and public endorsement if it were untrue. If google does indeed reset permissions then you know they've at least been in contact. If it were a smaller company I'd like to see proof.

> If it were a smaller company I'd like to see proof. Amazing how much trust the mere size of a company ensues.

It's not size directly, but the risk of goodwill. A bigger company stands to lose more goodwill.

Re: Pokemon Go – Permissions Update

#85

Post by qwertyuiop924 »

lnanek2 wrote: post #79
qwertyuiop924 wrote: post #39

Earlier quoted context omitted.

Yep. Lots of other people are getting this, too. And it sucks. They all seem to be server load problems, but what gets me is that some things just don't need server updates, and they do them anyway. Oh, so you need to check in with the server every time I toss a pokéball. Niantic, it's like you've never heard of caching, combining packets, and client side prediction, or anything clientside for that matter. Sure it's…

Yeah, the server loading indicator every ball toss is grueling. It would be OK if it was reliable and always loaded after a few minutes, but a large portion of the time it locks up after several failed attempts to talk to the server and you have to kill the app. Then starting the app again shows the server error page 9/10 times, then you have to try the ball toss again, which may or may not work.

Well then, why do it? Sure, it lessens the chance of a ball dupe, but is that really worth ddosing yourself over?

Re: Pokemon Go – Permissions Update

#87

Post by aioprisan »

MattHeard wrote: post #84
sev wrote: post #77

Earlier quoted context omitted.

> If it were a smaller company I'd like to see proof. Amazing how much trust the mere size of a company ensues.

It's not size directly, but the risk of goodwill. A bigger company stands to lose more goodwill.

That and stock value

Re: Pokemon Go – Permissions Update

#88

Post by stephenyeargin »

Take a look at this list of potential things you can ask for as a developer:

https://developers.google.com/identity/protocols/googlescope...

And most folks will click "Approve" without really reviewing the list. That said, Twitter and Facebook (two other popular OAuth providers) heavily restrict certain "full" access to only trusted applications that they either have a business relationship with or otherwise review the application before allowing those scopes to be requested or used. This incident may prompt Google to do more of that, which isn't entirely great news for the more responsible developers with purpose-built apps.

Re: Pokemon Go – Permissions Update

#89

Post by aplummer »

MattHeard wrote: post #84
sev wrote: post #77

Earlier quoted context omitted.

> If it were a smaller company I'd like to see proof. Amazing how much trust the mere size of a company ensues.

It's not size directly, but the risk of goodwill. A bigger company stands to lose more goodwill.

I think it can also be size directly, the more people involved the more chance that one of them would tell-all.

Re: Pokemon Go – Permissions Update

#90

Post by kaspiCZ »

eridius wrote: post #8
8bitben wrote: post #4

Earlier quoted context omitted.

Exactly, that's what I'm more worried about - Google needs to present clear information about what access is provided BEFORE I accept the account connection. It's not necessarily Niantic's fault for asking for too much, it's Google's for not at least making me aware.

It's entirely plausible that Niantic didn't realize they were asking for too much specifically because Google didn't show the permissions being asked. So any time they tested their own app, they would have just seen what everybody else saw, which is that the app asked for access to the Google Account with no mention of what permissions.

Despite that, it is wexing that they wouldn't come across this issue during testing. Maybe it's a production issue. I am very interested in a technical explanation from either Google or Niantic. They surely had to test iOS app and check their Google permission page. Otherwise it would be really sloppy testing.
Post reply on HN