The risk from attack comes from how the Google account linkage works. And it gives the company a rope by which it could hang itself, if it should choose to exercise this high level of access, such as sending Gmail on behalf of users. (A request to Google to clarify the extent of full access received no response.) Full access isn’t inherently a security flaw, but it does open Niantic’s users to risk should its systems be compromised either by an internal or external party. Why this could be troublingįull access allows an app or website to act effectively as if it were the account owner, including access to email, contacts, and Google Drive files. The game will continue to function, although it’s possible it may request authentication again at a later point. In the Connected Apps & Sites settings, click the Pokémon Go Release entry, click Remove, and then click OK. Only local permissions for contacts, camera, and other features are granted, with separate prompts for each.)Īccess can be revoked without disabling the app, however. (In Android, authentication happens without granting access, confirmed in testing and with several Android users. Visiting a Google account’sĬonnected Apps & Sites link reveals the app’s access status. However, neither the app nor Google’s login process discloses that the app gains full access. In confirming Reeve’s report in iOS through testing, when the Google account option is selected, the app presents a standard Google in-app login, including requiring a second factor if that’s enabled. Pokémon Go in iOS silently requests full access to a linked Google account.
0 kommentar(er)
