Slashdot Mirror
Pokemon Go Was Never Able To Read Your Email (gizmodo.com)
Last week a security researcher noted that Pokemon Go's iOS app -- for whatever reason -- was gleaning complete hold of one's Google account. But is that really the case? Gizmodo contacted Adam Reeve, the security researcher in question (who also happens to be a former senior engineering manager at Tumblr) to get more details on his claims, upon which Reeve, now Principal Architect at Red Owl Analytics, said he wasn't "100 percent sure" his blog was true. From the report: Cybersecurity expert and CEO of Trail of Bits Dan Guido has also cast serious doubt on Reeve's claim, saying Google tech support told him "full account access" does not mean a third party can read or send or send email, access your files or anything else Reeve claimed. It means Niantic can only read biographical information like email address and phone number.In a statement, Google tech support said:In this case, we checked that the Full account access permission refers to most of the My account settings. Specific actions such as sending emails, modifying folders, etc, require explicit permissions to that service (the permission will say "Has access to Gmail")Niantic, the company behind Pokemon Go app also assures that its app doesn't access anyone's email. Moreover, it is working with Google to ensure that only a user's profile data is accessed by the app. In a statement to Gizmodo, the company said:We recently discovered that the Pokemon GO account creation process on iOS erroneously requests full access permission for the user's Google account. However, Pokemon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokemon GO or Niantic. Google will soon reduce Pokemon GO's permission to only the basic profile data that Pokemon GO needs, and users do not need to take any actions themselves.Perhaps people should be more careful about the accusations they make.
Perhaps people should be more careful about the accusations they make.
Why?
Accusations are often all that is needed in this world to create the effect you desire. Accusations work, because people think that an accusation = "Guilty" or at least "suspicious" and that is all that is needed to trigger the "fear" response. It works, because most people don't actually THINK, don't want to think, they only care about Kardashians or Taylor Swift.
Seriously, WE (us people) should require people making accusations to start putting up or shutting up. Guilty until proven innocent sucks.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
"Perhaps people should be more careful about the accusations they make."
Uh, people should be more careful?
Ironically, while we're busy being paranoid about this app, damn near every other app installed on your phone is sucking your privacy dry.
Right or wrong, let's not pretend this accusation was birthed from sheer stupidity or an addiction to tin-foil hats. There's a damn good reason to be wary of app privacy today, as in there is no such thing.
Uh, no.
It's given full account access.
It may not USE full account access, but it's given it. And there's nothing to say that they can't exploit this access in the future.
If you're using iOS, do not install this game until this is properly fixed.
Although we request you approve "full access" we don't use it, and we promise we won't in the future...
No thank you...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
The accusation was that the app had "full access" to google account data. Hence Slashdot's previous headline, PSA: Pokemon Go Has Full Access To Your Google Account Data
This previous story was accurate and true, because by the developers own admission,
They are fixing it, and kudos for fixing it, and they've confirmed with Google that they didn't access any additional information, but they still fucked up and have admitted they fucked up.
Go to hell
The Android version requests access to Contacts. I deny the access and it seems to work fine.
Unfounded speculative claims? FUD and hype?
In "Cyber" Security? Inconceivable!
Slashdot had been forwarding a lot of false rumors over the last few weeks. It appears to be serving its purpose.
“He’s not deformed, he’s just drunk!”
I'd be careful, I mean what if this one could read your email and send it to its parent company! The same parent company who installed an app without your permission on your android phone! I believe it's called "gmail"...
Spin all you like, but even the hearsay security researched accepts it has full account access.
And a google search tells you what full account access is:
"When you grant full account access, the application can see and modify nearly all information in your Google Account (but it can’t change your password, delete your account, or pay with Google Wallet on your behalf)."
"Certain Google applications may be listed under full account access. For example, you might see that the Google Maps application you downloaded for your iPhone has full account access."
"This "Full account access" privilege should only be granted to applications you fully trust, and which are installed on your personal computer, phone, or tablet."
"If you've granted full account access to an app you don't trust or recognize, we recommend that you revoke this permission by clicking the Revoke access button."
Also, the *settings* in your google account said that Pokemon had access to your email.
Not sure what other proof was needed.
They may not have accessed it, because it wasn't designed to do this, but that's not the same as not *having* access.
I think app developers should write a short sentence justifying their need for the permissions they require. Some apps are just ridiculous. Why does a streaming audio app need to access my call history?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Pokemon Go is a psyops brought to you via the same data-mining shill that developed Ingress as well... Niantic, which was formed by John Hanke. Hanke was the original founder of Keyhole (which was acquired by Google, by the way...) a program that received a large chunk of its funding from In-Q-Tel, a government-controlled venture capital firm that, in turn, is supported largely by National Geospatial-Intelligence Agency (NGA), whose primary mission is “collecting, analyzing, and distributing geospatial intelligence.” Very easy to spot the true intent behind these 'games'.
Well, as a principled robber, and by that i mean a robber who will only attack manchildren playing Pokemon GO (FUCK YOURSELF) while ignoring anyone looking under the age of 18 and anyone who is female, i am very nuts about this game because it will basically make manchildren send themselves voluntarily to more remote locations where i can await them and take all their stuff. Better yet when they are too plastered to the screen to notice me.
As far as kids go, i ignore them mainly because the pedophiles are in charge of that group, while rapists will be the ones in charge of waiting for females.
Now you know why Pokemon GO (FUCK YOURSELF) is of such relevance and importance.
... about believing what they read on slashdot, considering this is where I read the initial accusations 14 hours ago.
...and everyone looses their minds.
This is probably a Joker meme by now...
Common Sense isn't as Common as people think...
Maybe my iPhone is too old, but what does iOS have to do with a Google account?
And is a Google account needed to play Pokémon Go?
Yes, there is no privacy. And privacy is already hard enough without naming permissions "full account access" when it does not include full access to an account, rather than to a certain subset of the account. It sounds like somebody did that.
The reporting error wasn't the blogger's fault; it was the fault of whoever named the permission "full account access." And it is still good that he reported it, because it highlighted a problem where the app programmer requested broader permission than needed. The blogger's confusion was understandable, and people should feel absolutely free to blog about their security concerns.
The right thing is then to ask Google or the app owner before publishing an article in the real media. Gizmodo did the right thing: vetted it with experts and tried to get a statement from Google.
Real lawyers write in C++
"Perhaps people should be more careful about the accusations they make."
Perhaps what really needs to happen is better definition of what 'full access' means and that app should be more 'careful' about which permissions they request.
"Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information,"
Look deeper, this is just noise to try and shift focus away from Niantic/Google cause they are in bed with the US Govt and CIA via In-Q-Tel.
Perhaps people should be more careful about what they name account permission settings.
Here is the proof
http://i.imgur.com/TWOedY7.png
Someone mod this AC troll insightful. We're already seeing this actually happening.
In unrelated news, I've been driving a lot more, lately. I'm sure it has absolutely nothing to do with hearing about kids walking into traffic while playing Pokemon GO.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Perhaps this is google/android's fault? I think there is a lot of room for confusion due to the ambiguous way the permissions are described, they *seem* pretty broad and over-reaching to me in general (even if that's not the case or reality). Especially since many apps/daemons run quietly in the background and don't really ever go away.
For example, I'll use a few of Uber's permissions as examples (not picking on them, just an example of a common app that has a lot of permissions; I've also included some items from Lyft and Facebook's permissions):
1. "Directly call phone numbers + read phone status + identity". i guess customers need to talk to their driver every now and then to coordinate pick-ups? But (as worded) it does sound like maybe uber could access the names/numbers of all the people you ever talk to, uber-related or not, for marketing/analytics purposes.
2. "Read your text messages, receive or send text messages". again, i guess customers occasionally need to talk to their driver every now and then to coordinate pick-ups? Or maybe send info to your friends if you use the social features and want to tell people when you're arriving? But (as worded) it does sound like maybe uber could just quietly read all your text messages, whether uber-related or not.
3. Take pictures and videos" -- i guess if you want to add a photo of yourself to your profile? but i certainly wouldn't want them to surreptitiously take photos/videos for any other out-of-app purpose and send them back to uber HQ, and it doesn't say they couldn't/won't do that. (or Facebook "record audio" as a permission... same privacy concern)
4. "approximate/precise location" -- presumably so drivers can find you or so the mapping will work properly. but it doesn't really say that they have to stop tracking you when you aren't actively using the app.
5. "Read/modify your contacts" -- I guess some customers want to notify people about arrival times or do "refer a friend"-ish stuff? But as worded it seems like they just want to slurp up all my contacts for marketing/analytics purposes.
6. "Read calendar events plus confidential information" -- Uber doesn't have this permission, but Lyft does. Not sure why Lyft would need this at all, maybe so you can get notifications of friends' arrivals, or maybe so they know how many cars will be needed after a concert is supposed to get out. But as worded, this sounds like they have full access to all my appointments, who/where/when i'm meeting, the subject matter of these meetings if available, etc. This sounds ridiculously invasive and anti-privacy. Or Facebook can "add/modify calendar events and send email without owners' knowledge", which sounds scary.
7. "Modify or delete or read the contents of your USB storage" -- I imagine they need to store/access a few bits of data about me and my settings, or pick a photo/file attachment from my library. But as worded it sounds like they could read the contents of *all* my files (personal data, data from other apps) if they wanted to.
8. "Add/find/remove/use accounts on device, read Google service configuration"
9. "Full network access - internet, wifi, data"
As an example -- I think with these wordings it makes it *seem* that if I had a confidential conversation with my doctor or lawyer, Uber/Lyft/Facebook/etc would be able to know about it (the time/date of the call, who i was talking to, etc), or perhaps even know the details (if it were included in a calendar invite, or if i had sent/received an attachment).
(And the "Updates to app may automatically add additional capabilities within each group" language doesn't inspire confidence.)
If they really don't intend for permissions to sound so intrusive and broad, I think it would behoove google to clarify/narrow the language of the permissions to put people at ease. And rather than giving all these apps permission to view all my contacts/photos/files/etc, only give them access to those few I explicitly opt-in to share with that app.
I'm just waiting for the headline:
Tesla On Autopilot Kills Person Who Walked Into Road While Playing Pokemon Go
Pokemon Go Was Never Able To Read Your Email
It certainly wasn't. I've never installed it.
systemd is Roko's Basilisk.
This is CIA obfuscation technique. Same story, extrapolate and tire people out hoping they don't see the actual comments that matter.
So, perhaps some people should be more careful with their wording?
"Perhaps people should be more careful about the accusations they make."
Perhaps fucking companies should be more careful and less lazy about the boilerplate bullshit they throw in, and actually bother to write a relevant fucking EULA/ToS for their software.
And perhaps you should shut your whore mouth, manishs.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
If an established security researcher can't figure out what permissions an application is requesting, maybe Google needs to work on their UI.
On the other hand, maybe the guy is just an idiot.
I'm not into Pokemon, so I don't know exactly what it displays during installation.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
The first patch went live about a hour ago, and included a fix to the Google Account scope.
http://www.popsci.com/pokemon-...
Common Sense isn't as Common as people think...
There's more substance to the article than there is inaccuracy. It may be true that the app doesn't have access to a person's gmail account, but the privacy policy makes it clear users should have no actual sense of "privacy" for the data that is collected:
“We may disclose any information about you (or your authorized child) that is in our possession or control to government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate”
On top of that all versions of the app request access to a person's contact database, which does contain a tremendous amount of information that is totally not relevant to game play, including e-mail addresses of everybody in a person's contact database. In this manner, even if you don't play the game, if someone does who has your personal info in their contact list, then your privacy has been compromised as well.
"Pokemon GO account creation process on iOS erroneously requests full access permission for the user's Google account." Yes everyone, please believe us that it is "erroneously" requested. and once we have permission from all the IOS users, because of this erroneous request.... PLEASE BELIEVE we will not use those permissions to violate you. "However, Pokemon GO only accesses basic Google profile information (specifically, your User ID and email address)" yes, PLEASE TAKE OUR WORD ON THIS "MISTAKE"