Pokemon Go is a huge security risk
adamreeve.tumblr.com
adamreeve.tumblr.com
Niantic are also the folks behind Ingress, if you've heard of that.
[0] Specifically, Alphabet owns a significant portion of Niantic, along with Nintendo: https://nianticlabs.com/blog/niantic-tpc-nintendo/ (they were previously wholly-owned by Google).
A third-party company, even with significant investment and history with Alphabet, requesting full access to my Google account despite needing ZERO access (i.e. for what they need, requesting no permissions would suffice) is sketchy and inherently untrustworthy.
Do they store this API key with full access to a Google account the same way that an official Google app (e.g. Gmail itself) stores my secret data? If so, I probably trust it. Or do they just throw it in a GCE database without a whole lot of thought around a security policy since they're still a fast-moving startup, and maybe my credentials get logged somewhere, or synced to an analytics system that's not treated as classified and a whole bunch of employees can inadvertantly access, etc
Seems like I have no way of knowing (unless maybe it's in their terms of service?). It could very well be a "Huge security risk"
However, "Popular thing possibly has crummy security practices (we just don't know)" isn't HN-worthy, it's just FUD. I think both of us would prefer a HN full of well-researched articles over one full of clickbait FUD.
Bullcrap. Best security policy is trust, but verify.
Assuming that well established businesses have good security practices without doing proper review is what allowed all those fraudulent SWIFT transactions to go through a few months ago. It's perfectly valid to ask why the hell Pokemon Go thinks it needs access to your private email.
Google has extremely strict safeguards in place to prevent eg. employee Joe from accessing ex-girlfriend Mary's Gmail. Very few people would have full access to individuals' Google accounts. This kind of privacy breach would be very damaging to Google.
Niantic is a tiny startup with around 50 employees. I would expect most developers within the team would have full access to the production database, or would be given access if they had a need for it. It's unlikely that there's any oversight over who can access data - it's just a 'game'.
Where are their backups stored? Are they encrypted? Who has access to the decryption keys? We don't know, but I would bet any amount of money that their systems are vastly less secure than Google's are.
The relationship between Google and Niantic isn't relevant as to whether they are capable of keeping these credentials secure.
I know a bit about google's internal privacy safeguards (including how long they've been in place), and I know a bit (nothing that wasn't in the news) about the NSA's internal privacy safeguards from a certain point in time.
Obviously I don't know what it's like at the NSA today, but it's worth laughing (or crying) at the fact that there was a time when Google placed more restrictions and security in place to protect its users from rogue employees than the NSA did.
Not to get too political.
Not at all necessary for this situation to occur. I just finished implementing a system (nothing to do with Pokemon) that also requests permission from external sites in a similar way. The mechanics for doing this are fiddly and checking this is actually set up correctly is likely well down the priority list provided things at least appear to work.
It is entirely possible that someone who had never done it before set it up in a hurry then everyone in the dev team just blindly clicked through without ever properly reading what was being requested because they were all in a rush to finish their stuff.
Also Gmail allows you to create more than one account. Instead of all this alarmism in media just tell people they should create a separate account in Gmail just for games instead of using the one you are worried about some big billion dollar company accessing it (which they already do).
"We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves."
"[random game on a whim] has Full Access to your Google Account" is scary
I'd have said the same about VW's emissions cheating scandal before it broke.
Isn't it more likely to be a bug in the iOS version of Pokemon Go?
In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that they didn't hoover up all the information they had access to they can be unbanned after a year.
Unlikely though considering they used to be a part of Google.
https://developers.google.com/identity/protocols/OAuth2Insta...
Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not.
Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use an app password:
After I disconnected it, it didn't behave that way a second time. So I am kinda mystified what happened there. But it was pretty strange.
Is that the case? Doesn't this still require going through the standard prompts?
"Pokemon Go Release - Has full access to your Google account"
Revoking access now. Glad I read HN!
There is no technical limitation to an app engaging in very nefarious activity. For example an app could modify the DOM on the sign-in screen to grab your password after you enter it. Of course the accountability of MITM and security reviews might mitigate this risk, but passwords are generally only a few bytes and could easily be obfuscated and passed surreptitiously over the wire.
I've seen a (quite popular) app implement this for facebook invitations, which should only have a limit of 50 friends, to secretly (in the background, without any action on your behalf other than logging in, or perhaps pressing a "continue" button) invite every one of your friends to download the app. Since facebook does not notify you when you send an inviation, you would not even know the app did this unless one of your friends who you invited asked you about it.
[0] https://news.ycombinator.com/item?id=11637209 (thanks molecule)
The comment's timestamp is a link.
Uh, seriously? I just suggested to our mobile team to integrate this way on Android (I implemented the OAuth 2 server).
I would've made the same suggestion to a 3rd party app vendor when the day comes.
I'm curious how exactly this is specific to the UIWebView implementation.
The OAuth model not only enables phishing directly even worse than that, it disarms people's natural skepticism towards phishing attempts. Its adoption was a terrible idea.
Of course, you're absolutely right that it would be trivial to spoof, say, Google or Facebook or Twitter and collect credentials. I would _hope_ that behavior would be detected by Apple or Google during app security screening, but maybe not. Regardless, I totally agree with you about OAuth and security. It does present a lot of problems.
I have a certificate signed by Symantec guaranteeing that it's authentic!
Outside of the Android model where it does the auth for you upon request and only hands the app a token, I don't really see how you don't open yourself to this attack.
iOS really doesn't provide a way for other vendors in an inner ring of consumer trust and power to deal with this. While I'm not a fan of the decision to give full access to Pokemon Go, I didn't find it surprising that it did so on iOS and I had to make a conscious decision to "trust" Pokemon Go as part of the process.
If UIWebView didn't allow the app access to the DOM then it wouldn't be possible this way. But,of course, the user has no way to know how the UI is implemented.
Some providers (e.g. Fitbit) require you use this instead of UIWebView in order to access their API, presumably to avoid accessing the DOM.
Not sure exactly how they are enforcing this though, since they don't provide their own OAuth library.
I've yet to see it confirmed, though.
I'm really glad you're not making that decision then. Banning some company based on their use of public, legal APIs would be an absolutely toxic decision for Google's platform.
It's Google's fault for allowing this kind of access with no notification (yes, the fault here might lie somewhere in OAuth, but there's plenty that Google could do to make this less serious). Don't blame people for leveraging options at their disposal.
It appears to be the iOS version only that's doing this, according to this article:
http://9to5google.com/2016/07/11/psa-pokemon-go-full-access-...
Possibly this was fixed on Ingress sometime in the last X months but not on Pokemon Go.
I am running on a Nexus 6 and signed in with my Google Account when I first launched the app.
Try revoking access and see what happens. Worst case, it might ask you to sign in again.
https://dl.dropbox.com/s/bgii07rzoddj504/Screenshot%202016-0...
Screen: http://imgur.com/YX9K8Ds
This is interesting, I can't test this myself as I have previously played Ingress on both iPhone and Android.
My Android device is mostly for development/testing, so I'm not nearly as regular a user of the platform as I am for iOS.
Could any Android users comment on if this is normal to not see Android apps like Ingress on this authorization list?
This is by no means universally true. Plenty of people get enough exercise outside of the app, and plenty of people have Google accounts for which compromise could be very significant.
It should at the very least be disclosed in the OAuth flow that I'm giving away admin rights to the app. Facebook's flow won't even let me give away my email address without an explicit decision to do so. The current silent-but-deadly flow is inexcusably risky.
I have honestly never used an app that has brought me closer together to the people around me. I don't see this being a fad.
My theory is that they're injecting JavaScript into the web view to automatically press the 'Approve' button and hiding that from the user. If true, that's very worrying. They'd be effectively circumventing the whole OAuth framework by forging the user's approval of the app. Every user should have been asked up-front whether or not they wanted to approve or deny Pokemon Go's full access.
I suspect they built an MVP and launched it and it happened to take off, and we'll see some more polish in the future.
For this particular issue though - I'd bet that Niantic has some sort of data-sharing agreement with Google, anyway, making this point moot. They started as an internal startup at Google, and they make really heavy use of the Maps & Places APIs that would probably cost a fortune if they didn't have some sort of bulk data sharing agreement.
How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving anything except my email address.
http://www.neopets.com/coppa/consentform.phtml
Google doesn't care because it takes more effort for them to obey by the law than its worth for them at this time.
Why?
I have no comment as to whether this is a violation or not; I know nothing about Pokemon Go. I'm just pointing out there is already extensive regulation here.
When you first sign up you have to enter your age, I don't know if there is a minimum age for the game. As an adult I'm old enough to get through that prompt.
Why not just create a separate google account if one's so eager to play?
Anyway, my point stands—Bill started as a coder, good enough to code on the pdp-11(?); Steve never was one.
What are you talking about?
It's developer laziness.
The security policies for that sign-in system are not as granular as Android's security policies.
Normally an app would request permissions at run-time or install-time.
One app that got me thinking about these things was Google Maps. I noticed it directed me through The Hood of a murder capital to save 3 minutes on a route. An area where people are known to surround cars or level guns on their owners. I had to wonder how much more risk like this is in any GPS-enabled app that sends you from point A to B.
That's backdrop. Relevant here, North and South Memphis are largely the worst in terms of violence. You do not want to be in certain neighborhoods regardless of color. Even cops avoid them. Others are a risk more if you're white or look like you have property to take. Local media & cops suppress the worst of it to maintain tourism revenue (eg Elvis, BBQ) although the murders naturally get reported. Examples of censorship were kicking out The First 48 show and rape kit scandal. That Google Maps takes you right near those areas is probably why lots of people think the whole city is hood and trashed rather than just those parts. They never see the good parts unless specifically visiting them family, friends, jobs, or tourism.
So, yeah, it's a real issue. I double-check Google Maps if I'm going anywhere Downtown, Midtown, North, or South as it doesn't differentiate risky vs non-risky areas. I regularly have to force it to make safer routes. Straight-up avoid certain areas of the city unless I'm packing heat & with backup. Otherwise, still all kinds of good things to get involved in over there with most folks being alright. We just in a rough area and economy. :)
Note: As another example, BLM protestors sieged our Interstate (I-40) last night for hours then dispersed into Downtown. Local news cautioned everyone to stay away from that area for safety as it's normally dangerous but now unpredictable. Bad route at the least. Google routes still offering me a speedy trip through there, though. Unreal.
[0] http://www.npr.org/2012/01/25/145337346/this-app-was-made-fo... [1] www.citylab.com/tech/2012/01/gps-smartphones-and-dumbing-down-personal-navigation/1036/
https://news.ycombinator.com/item?id=12073592
A prior comment related to Amazon Prime's apparent discrimination. I pointed out that Prime was avoiding crime not minorities. Local drivers, which Amazon outsources to, confirmed it for me personally in an unofficial sense where they agreed & personally wouldn't deliver to those areas.
https://news.ycombinator.com/item?id=11545009
So, it's a recurring theme but the crime angle is usually downplayed by left-leaning media. I agree with Microsoft's approach but I urge companies focus on crime statistics. There are many areas that are white and have tons of violent crime. Many areas are black with little violent crime. It needs to be about avoiding violent areas rather than minority areas specifically.
I signed in with my Android, and I didn't see anything from Niantic or Pokemon Go in my security settings.
2. The security risk isn't that Niantic is going to turn evil, it's that Niantic becomes an access point for other (evil) hackers.
Even if they were still owned by Google, a compromised phone with Pokemon Go has a nice juicy access token with admin rights to your account to siphon off.
Perhaps they misconfigured the Google auth sign-in? It's rather worrisome that it's this easy for an application to gain full access to your account, though.
To wit, would anyone be interested in tracking (I can do it for at least some locations) the locations of gyms in comparison to polling places? (I haven't used the app; can one get a location of gyms?)
[lol. let me clarify my interest would be in thwarting rather than harnessing this possibility.]
The entire issue is predicated on using your google account credentials which isn't really mandatory. Maybe I'm overly cautious but I don't use my google account to auth anywhere. If that's the only option, and it's not a google product.. then it looks like I'm not using that service.
Don't just throw around account access, no matter how pervasive, in the name of impatience. Ever.
In the past I've tried to use Google to sign in to some games and been given a screen that I noped out of because of what it was asking for. That didn't happen here. I assumed they only got my email address (if that), not full email/contact/calendar history.
I checked my Google permissions. iOS has a fair amount, Mac OS X has a fair amount, Pokémon GO has more than both put together. Without asking. That's crazy.
[1] https://thestack.com/security/2016/07/11/infected-pokemon-go...
Any modified APK for any App could be loaded in with a RAT asking for full permissions. It just happens PKMNGO is popular and people are trying to get their hands on it before it is officially released in their region.
http://blackbag.gawker.com/pokemon-go-is-a-government-survei...
TLDR: Pokemon Go can't read your gmail - he checked
https://gist.github.com/arirubinstein/fd5453537436a8757266f9...
"Normally you’d see a little message saying what data the app is going to be able to access - something like “This app will be able to view your email address and name”. For some reason that’s not shown in this case"
The title could still be more neutral/explanatory, though.
When something is free to play, and involves you walking around with geo services and a camera on, you and your data are the product.
This is just massive data collection disguised as a video game.
No one signed up to let Niantic read their email in exchange for free items.
Especially parents.
Pokemon Go can collect the bunches of the data it wants without having admin-level access to their users' Google accounts.