Pokémon Go developer Niantic has moved to change the level of access the app needs from Google account on iOS following criticism from a security blogger.
The massively popular Pokémon Go game had asked for full access to a Google account when it’s chosen as an authentication option while setting up the app in iOS. The Android version was unaffected. While the iOS app also allows using a Pokémon Trainer Club account, the option to create a new club account is unavailable at this writing, apparently due to system overload.
In a statement late Monday Niantic, said that it was an error to request that level of access, and the app only made use of a Google account’s name and associated e-mail address. The firm is updating the app to reduce what permissions are requested, and said Google will automatically reduce its app permissions. Niantic’s complete statement appears at the end of the article.
Adam Reeve, a principal architect at analytics firm Red Owl, posted a warning on his personal blog on Friday about this Google account issue. Most apps request a minimum amount of account access (or ‘basic profile information,’ as Google terms it) to provide a link, partly because of frequent blowback from users, pundits, and sometimes regulators when apps ask for too much.
Full access allows an app or website to act effectively as if it were the account owner, including access to e-mail, contacts, and Google Drive files. Full access isn’t inherently a security flaw, but it does open Niantic’s users to risk should its systems be compromised either by an internal or external party. And it gives the company a rope by which it could hang itself, if it should choose to exercise this high level of access, such as sending Gmail on behalf of users.
The risk from attack comes from how the Google account linkage works. With a locally managed account system, like the Trainer Club, an account database contains a mix of unencrypted entries for elements like a user’s account name and email address, and encrypted entries for passwords. With good cryptographic system design, even should an attacker obtain an entire database, the passwords can’t be extracted, even with enormous effort. (Weak systems allow brute-force attacks.)
However, apps and sites that use accounts for authentication run by other sites – like Google, Twitter, and Facebook – don’t store a password, encrypted or otherwise, for that third-party site. Rather, after a user logs into the third party site and the account is verified, a developer receives a token, just a short piece of unique text, that’s stored and used to handle interaction.
An attacker need only obtain that token to make use of the linked account, whether posting messages on Twitter or reading e-mail on Google.
As Reeve noted, access to e-mail alone can be the thin edge of a wedge to hijack someone’s identity and accounts at multiple sites. Many people use Gmail as their primary or secondary e-mail address, and so other sites would send password recovery e-mails to that Gmail account.
Niantic was once owned by Google, and was spun off as a freestanding company in October 2015 with investment from Google, the Pokémon Company, and Nintendo.
Niantic’s complete statement:
“We recently discovered that the Pokémon Go account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon Go only accesses basic Google profile information (specifically, your User ID and e-mail address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon Go or Niantic. Google will soon reduce Pokémon Go’s permission to only the basic profile data that Pokémon Go needs, and users do not need to take any actions themselves.
IDG News Service
Ltd
