The Twitters told me today that Pokémon Go's Google account sign-in takes full access privileges, which is pretty obviously not good.

From Kotaku:

Update - 10:07pm: Niantic says it was a mistake that will be fixed soon. Here’s their statement to press:

We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. ... Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves.s

Let's look at that last line again...

Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves.

What does that mean, exactly? I mean, they do have full access, I guess. ;^)

Anyhow, my first and continued response to this is...

If only there was some way we could create fake, throwaway Google accounts with no personal data whatsoever to use for trivial purposes like this one.

Update: So this is the "real" issue, and one I wondered about when I created a login with my [throwaway] Google account:

Either Google goofed, or Niantic is doing browser automation to programmatically agree to Google's security warning. Major issue either way.

— SecuriTay (@SwiftOnSecurity) July 11, 2016

I didn't see the, "Pokémon GO is requesting these permissions" screen either. And that's the real issue with OAuth in any application that isn't a browser made, downloaded, and run from a trusted source: You can't tell for sure that you're not using an embedded browser, one where every keystroke is easily viewed by the app authors.

In fact, if someone was after your information, they'd almost do better (if you don't have two-factor security) to sniff your password as part of an OAuth workflow that asked for the appropriate level of permissions (ID and email only) to stop from raising the red flag we're seeing here.

Labels: pokemon, security