Slashdot Mirror
Pokemon Go Was Never Able To Read Your Email (gizmodo.com)
Last week a security researcher noted that Pokemon Go's iOS app -- for whatever reason -- was gleaning complete hold of one's Google account. But is that really the case? Gizmodo contacted Adam Reeve, the security researcher in question (who also happens to be a former senior engineering manager at Tumblr) to get more details on his claims, upon which Reeve, now Principal Architect at Red Owl Analytics, said he wasn't "100 percent sure" his blog was true. From the report: Cybersecurity expert and CEO of Trail of Bits Dan Guido has also cast serious doubt on Reeve's claim, saying Google tech support told him "full account access" does not mean a third party can read or send or send email, access your files or anything else Reeve claimed. It means Niantic can only read biographical information like email address and phone number.In a statement, Google tech support said:In this case, we checked that the Full account access permission refers to most of the My account settings. Specific actions such as sending emails, modifying folders, etc, require explicit permissions to that service (the permission will say "Has access to Gmail")Niantic, the company behind Pokemon Go app also assures that its app doesn't access anyone's email. Moreover, it is working with Google to ensure that only a user's profile data is accessed by the app. In a statement to Gizmodo, the company said:We recently discovered that the Pokemon GO account creation process on iOS erroneously requests full access permission for the user's Google account. However, Pokemon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokemon GO or Niantic. Google will soon reduce Pokemon GO's permission to only the basic profile data that Pokemon GO needs, and users do not need to take any actions themselves.Perhaps people should be more careful about the accusations they make.
Perhaps people should be more careful about the accusations they make.
Why?
Accusations are often all that is needed in this world to create the effect you desire. Accusations work, because people think that an accusation = "Guilty" or at least "suspicious" and that is all that is needed to trigger the "fear" response. It works, because most people don't actually THINK, don't want to think, they only care about Kardashians or Taylor Swift.
Seriously, WE (us people) should require people making accusations to start putting up or shutting up. Guilty until proven innocent sucks.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
"Perhaps people should be more careful about the accusations they make."
Uh, people should be more careful?
Ironically, while we're busy being paranoid about this app, damn near every other app installed on your phone is sucking your privacy dry.
Right or wrong, let's not pretend this accusation was birthed from sheer stupidity or an addiction to tin-foil hats. There's a damn good reason to be wary of app privacy today, as in there is no such thing.
Although we request you approve "full access" we don't use it, and we promise we won't in the future...
No thank you...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
The accusation was that the app had "full access" to google account data. Hence Slashdot's previous headline, PSA: Pokemon Go Has Full Access To Your Google Account Data
This previous story was accurate and true, because by the developers own admission,
They are fixing it, and kudos for fixing it, and they've confirmed with Google that they didn't access any additional information, but they still fucked up and have admitted they fucked up.
Go to hell
Unfounded speculative claims? FUD and hype?
In "Cyber" Security? Inconceivable!
Slashdot had been forwarding a lot of false rumors over the last few weeks. It appears to be serving its purpose.
“He’s not deformed, he’s just drunk!”
I'd be careful, I mean what if this one could read your email and send it to its parent company! The same parent company who installed an app without your permission on your android phone! I believe it's called "gmail"...
You can install it, then revoke it's access from your account to what it doesn't need.
App still works fine.
There are two types of people in the world: Those who crave closure
I think app developers should write a short sentence justifying their need for the permissions they require. Some apps are just ridiculous. Why does a streaming audio app need to access my call history?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
And what it does not include, as TFS says, is email.
Pokemon Go is a psyops brought to you via the same data-mining shill that developed Ingress as well... Niantic, which was formed by John Hanke. Hanke was the original founder of Keyhole (which was acquired by Google, by the way...) a program that received a large chunk of its funding from In-Q-Tel, a government-controlled venture capital firm that, in turn, is supported largely by National Geospatial-Intelligence Agency (NGA), whose primary mission is “collecting, analyzing, and distributing geospatial intelligence.” Very easy to spot the true intent behind these 'games'.
And bluetooth connections.
I can imagine some connections between a location based game and your contacts's addresses being incorporated into the game somehow, but does someone has any idea what might be the reason behind those two?
Location, camera and phone status are more or less obvious.
bickerdyke
...and everyone looses their minds.
This is probably a Joker meme by now...
Common Sense isn't as Common as people think...
Maybe my iPhone is too old, but what does iOS have to do with a Google account?
And is a Google account needed to play Pokémon Go?
Yes, there is no privacy. And privacy is already hard enough without naming permissions "full account access" when it does not include full access to an account, rather than to a certain subset of the account. It sounds like somebody did that.
The reporting error wasn't the blogger's fault; it was the fault of whoever named the permission "full account access." And it is still good that he reported it, because it highlighted a problem where the app programmer requested broader permission than needed. The blogger's confusion was understandable, and people should feel absolutely free to blog about their security concerns.
The right thing is then to ask Google or the app owner before publishing an article in the real media. Gizmodo did the right thing: vetted it with experts and tried to get a statement from Google.
Real lawyers write in C++
The bluetooth connection is required to use the Pokemon Go Plus notifier hardware/wristband that is currently sold out of all suppliers.
https://www.amazon.com/Nintend...
Common Sense isn't as Common as people think...
"Perhaps people should be more careful about the accusations they make."
Perhaps what really needs to happen is better definition of what 'full access' means and that app should be more 'careful' about which permissions they request.
"Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information,"
Perhaps people should be more careful about what they name account permission settings.
They are conspiring with Boeing, McDonalds, and the Illuminati to further their Chemtrail program!
Common Sense isn't as Common as people think...
Here is the proof
http://i.imgur.com/TWOedY7.png
Someone mod this AC troll insightful. We're already seeing this actually happening.
In unrelated news, I've been driving a lot more, lately. I'm sure it has absolutely nothing to do with hearing about kids walking into traffic while playing Pokemon GO.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
According to TFS "full account access" is synonymous with "full account profile access." They aren't just choosing not to use more, the priv doesn't grant more it's just poorly named.
The change they are making is to create an all new more fine grained permission for just the username and email address because they don't need the entire profile.
Google is bad about fine grained permissions.
Does it matter? Even if something has valid reason for access there is nothing that guarantees it isn't also abusing the access.
Pokemon Go Was Never Able To Read Your Email
It certainly wasn't. I've never installed it.
systemd is Roko's Basilisk.
Well, nice... but..... What was again the purpose of those smartwatch thingies when apps require special wristbands?
bickerdyke
It does matter cause I was hoping that bluetooth would support Android Wear and prevent accidents.
bickerdyke
"Perhaps people should be more careful about the accusations they make."
Perhaps fucking companies should be more careful and less lazy about the boilerplate bullshit they throw in, and actually bother to write a relevant fucking EULA/ToS for their software.
And perhaps you should shut your whore mouth, manishs.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
If an established security researcher can't figure out what permissions an application is requesting, maybe Google needs to work on their UI.
On the other hand, maybe the guy is just an idiot.
I'm not into Pokemon, so I don't know exactly what it displays during installation.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
The first patch went live about a hour ago, and included a fix to the Google Account scope.
http://www.popsci.com/pokemon-...
Common Sense isn't as Common as people think...
Making you pay to be able to run the app in the background without you realizing that's what you're doing.
Otherwise you need to walk with the phone unlocked, and the app active ( unless a mod exists to keep apps in the background believing they're in the foreground).
It's similar to Nintendo's pay for this toy to unlock a game character.
There's more substance to the article than there is inaccuracy. It may be true that the app doesn't have access to a person's gmail account, but the privacy policy makes it clear users should have no actual sense of "privacy" for the data that is collected:
“We may disclose any information about you (or your authorized child) that is in our possession or control to government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate”
On top of that all versions of the app request access to a person's contact database, which does contain a tremendous amount of information that is totally not relevant to game play, including e-mail addresses of everybody in a person's contact database. In this manner, even if you don't play the game, if someone does who has your personal info in their contact list, then your privacy has been compromised as well.
Making you pay to be able to run the app in the background without you realizing that's what you're doing.
Otherwise you need to walk with the phone unlocked, and the app active ( unless a mod exists to keep apps in the background believing they're in the foreground).
It's similar to Nintendo's pay for this toy to unlock a game character.
Seems like you need to do that anyway:
http://www.imore.com/pokemon-g...
"Your device still needs to be running Pokémon Go in the foreground, so you're not saving much battery life, and you'll get those vibrations from your iPhone or Android device, anyway."
bickerdyke
The patch that hit this afternoon appears to have added push notifications to the mix, so that may alleviate the issue somewhat.
The wristwatch Pokemon Go Plus has a button on it so that (supposedly) you can catch them, activate Pokestops, etc without having to interact with your phone at all.
Granted, it does seem like the sort of function that would be right smack in the wheelhouse of a Smartwatch, so hopefully they release a smartwatch app to mimic it. But for those of us that like the function but dont want to drop the cash for an actual smartwatch, a $35 dedicated device isnt entirety useless.
Common Sense isn't as Common as people think...
"Pokemon GO account creation process on iOS erroneously requests full access permission for the user's Google account." Yes everyone, please believe us that it is "erroneously" requested. and once we have permission from all the IOS users, because of this erroneous request.... PLEASE BELIEVE we will not use those permissions to violate you. "However, Pokemon GO only accesses basic Google profile information (specifically, your User ID and email address)" yes, PLEASE TAKE OUR WORD ON THIS "MISTAKE"
I meant from a security perspective.