Hacker News Reader

Isn't Niantic actually affiliated with (part of?) Google in some way? So it would seem natural, if odd, that it doesn't ask for full permissions for the account is actually already has full permissions to. In the same way google docs doesn't ask, but gets, full permissions to your google account, or google+ doesn't ask, but gets, full permissions to your google account.

View on HN

Google no longer owns Niantic

Well then that is a strange security lapse on Google's part. A spin-off company that had internal high-level access privileges, is spun off, and can still retains those high-level access privileges? That seems like a mistake somewhere.

I don't think there are any internal privileges involved here. Why do you think so?

You can make an app that does the same thing right now.

What are you talking about?

It's developer laziness.

I don't know the android ecosystem well. Can any random app ask for and be granted full access without informing the user of that elevated access request?

That is a feature of the Google sign-in system.

The security policies for that sign-in system are not as granular as Android's security policies.

Normally an app would request permissions at run-time or install-time.

Not fully, but they're still very much involved. Money talks, and they're invested.

Reply on news.ycombinator.com