| Pokemon Go has full access to your Google account |  |
[http://adamreeve.tumblr.com/post/147120922009/pokemon-go-is-a-huge-security-risk]
[http://adamreeve.tumblr.com/post/147262672019/a-quick-update-on-pokemon-go]
Auszüge:
To play the game you need an account. Weirdly, Niantic won’t let you just create one - you need to sign in with an existing account from one of two services - the pokemon.com website or Google. Now the Pokemon site is for some reason not accepting new signups right now so if you’re not already registered there you’ll need to use a Google account - and that’s where the fun begins.
I started the game, hit the Google button, and was redirected to log in. Normally you’d see a little message saying what data the app is going to be able to access - something like “This app will be able to view your email address and name”. For some reason that’s not shown in this case, but I went ahead and logged in anyway. Then on a whim I went to see which permissions it was granted (you can see for your own account right here). To say I was a little stunned is putting it lightly - it said: "Pokemon Go has full access to your Google account."
Let me be clear - Pokemon Go and Niantic can now:
-Read all your email
-Send email as you
-Access all your Google drive documents (including deleting them)
-Look at your search history and your Maps navigation history
-Access any private photos you may store in Google Photos
-And a whole lot more
[http://www.polygon.com/2016/7/11/12151442/pokemon-go-security-risk-data-information-ios-android]
Niantic antwortet: "Nur ein Fehler, so nicht beabsichtigt, wir arbeiten dran (mit geschlossenen Augen)."
We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user's Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO's permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves.