Pokémon Go May Be a Security Risk

Time to delete my app! Was fun while it lasted.

 

It's crazy how many Twitter replies I've seen that say something along the lines of "I don't care, I just gotta catch these things."

 

Say it ain't so

 

F - looks like I need to delete this.

 

I just downloaded this too. God damn...

 

urrrgh I don't want to start over :(

 

gmail account name: ashketchum182
password: pikachu

 

My phone is set up with a dummy email. I dont get my real email pushed to my phone, but it eases my mind about having all these apps having access to everything.

 

Just revoke access and you can still play

 

I have a feeling they will patch this. I hope.

 

can you revoke access and go to a different account with all the same stuff? I'm in too deep to throw it all in the trash now lol

 

How do you go about revoking access?

 

How do you revoke access?

 

nope, its not

Niantic released a statement saying that “Pokémon GO only accesses basic Google profile information.” Here’s the full statement:

We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves.

http://gizmodo.com/can-pokemon-go-really-read-all-your-emails-1783479136

sounds like the guy who made the original blog post had no idea what he was talking about.

 

I am so glad I have NO clue what any of this Pokemon stuff even means.

 

Update: A fix is coming:

iOS version of Pokémon Go is a possible privacy trainwreck [Updated]

 

What they are saying is that they haven't, not that they can't. They absolutely do have the access to your full Google Account to do this and absolutely did skip the verification process on login. The original blog post remains true right now and a fix has not been rolled out. It is, right now, still unfixed and a privacy disaster if you don't want all of your Google data accessible to a third party.

I highly recommend everyone revoke access immediately.

 

can anyone actually access the information if niantic hasn't? it sounds like "full access" doesn't actually mean "full access" from that article. i revoked access hours ago either way so i guess it's whatever to me

 

The issue is that Ninatic can. If they have or not is based on trust. I personally don't trust third parties and with the amount of data in most people's emails and such — I don't think that's paranoid. What Ninatic is saying is: we fucked up and ask for more permission than we really need, we're gonna fix that, and we haven't looked at anything except your email address and ID we promise. Google has apparently verified that is currently the case (unsure how much I trust them either, but that makes me feel better). However, until a fix is rolled out there's no way I want any third party having full access to my Google account. The access is very real:



... I just really hope they're telling the truth on what happened in the last few days while they had that access.

 

the real risk is people getting jumped, walking blindly in to traffic, fall off shit and all the other bizarre oddities that have happened since people suddenly forgot how the world works while walking around with a phone attached to your face. although, oddly, people have had phones attached to their face for a decade now so i'm actually surprised by all the accidents and injuries i've seen since this was released

 

I'm going to remove it from Gmail until they have it fixed.

 

I'm trying to think about and process what info of mine they have by having access to my google....

 

I basically have a google account I use purely for this kind of stuff. Not even slightly worried.

 

Another update to the link I posted seems to suggest the token used by Pokemon Go doesn't grant access to emails at all and never did. I guess a slack employee tested it? ¯\_(ツ)_/¯ better safe than sorry tho.