Niantic Labs, the developer of the massively popular game Pokemon Go, has full access to mobile users’ Google accounts, that is if they used their Google account to log into the game from a mobile device built by Apple. Whoops. To its credit, Niantic has said on record that it did not access anything other than user IDs and email addresses, and has promised from here on that it will significantly reduce the access it requests.
In its released statement, Niantic Labs revealed they recently uncovered an error in the Pokemon process of creating Pokemon Go accounts, which specifically asks to have full access permission for the mobile user’s Google account. After discovering the error, Niantic proceeded to start developing a patch (client side) so that the permission requested will only be for basic Google profile data.
However for now, Niantic Labs’ access still has full account permission to all of the mobile user’s data, plus the ability to post, remove, and send stuff from the user’s account. What does this mean for Pokemon Go players? WEll, when they log in with their Google account, they are practically giving away their email, contacts list, images, files, and other potentially sensitive information.
If mobile users have just downloaded the game and logged in with their Google account, they would have no means of determining if they have given full account access. To ascertain, they would have to head into their Google settings and check for themselves which mobile apps have been granted full account access, and then, if they want to, deny full access and keep catching Pokemon.
Although Google has not addressed the issue yet, Niantic Labs did further explain that Google has confirmed that no other data has been received or accessed by the Pokemon Go game or Niantic. Also, Google is expected to limit augmented reality game’s permission to only the basic profile information, which is what Pokemon Go actually only needs. Going forward, mobile users do not need to perform any additional actions at their end.
Adam Reeve, a noted expert on cybersecurity, shared his experience of how he discovered that he had apparently given Pokemon Go full access permission to his Google account. Reeve pointed out interestingly that among Android mobile users, the game does not get full access to users’ Google accounts.
Needless to say, giving away details of one’s Google account information is risky. Today’s users often make use of their Gmail accounts to reset log in credentials to all other accounts. If a hacker gets hold of that information, he basically has the keys to most if not all of the user’s online accounts.
