However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. “We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. (Weak systems allow brute-force attacks.) With good cryptographic system design, even should an attacker obtain an entire database, the passwords can’t be extracted, even with enormous effort. With a locally managed account system, like the Trainer Club, an account database contains a mix of unencrypted entries for elements like a user’s account name and email address, and encrypted entries for passwords.

The risk from attack comes from how the Google account linkage works. And it gives the company a rope by which it could hang itself, if it should choose to exercise this high level of access, such as sending Gmail on behalf of users.

(A request to Google to clarify the extent of full access received no response.) Full access isn’t inherently a security flaw, but it does open Niantic’s users to risk should its systems be compromised either by an internal or external party. Why this could be troublingįull access allows an app or website to act effectively as if it were the account owner, including access to email, contacts, and Google Drive files. The game will continue to function, although it’s possible it may request authentication again at a later point. In the Connected Apps & Sites settings, click the Pokémon Go Release entry, click Remove, and then click OK.

Only local permissions for contacts, camera, and other features are granted, with separate prompts for each.)Īccess can be revoked without disabling the app, however. (In Android, authentication happens without granting access, confirmed in testing and with several Android users. Visiting a Google account’sĬonnected Apps & Sites link reveals the app’s access status. However, neither the app nor Google’s login process discloses that the app gains full access. In confirming Reeve’s report in iOS through testing, when the Google account option is selected, the app presents a standard Google in-app login, including requiring a second factor if that’s enabled. Pokémon Go in iOS silently requests full access to a linked Google account.

Pokemon go google