‘Pokémon Go’ Security Risk Being Addressed By Google

The latest mobile gaming craze, Pokémon Go , hasn’t been without its issues. Between excessive battery drain, unstable servers and malware attached to unofficial versions, it’s a wonder the augmented reality app has become as popular as it has in less than a week. On top of other mishaps with the game, Pokémon Go developer Niantic has had to address another issue, namely that the app requires users to grant full access permission to their Google accounts in order to play the game. This has the potential to be a major security risk for users.

Niantic made a statement to Polygon Monday, indicating that despite the application asking for full Google account permissions, it only collects information necessary for the application, including a user’s Google ID and email address. In addition, the developer stated Google will update the application to remove the permission requirements. Read the full statement below:

“We recently discovered that the Pokémon Go account creation process on iOS erroneously requests full access permission for the user's Google account. However, Pokémon Go only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon Go or Niantic. Google will soon reduce Pokémon Go 's permission to only the basic profile data that Pokémon Go needs, and users do not need to take any actions themselves.”

News of the possible security risk surfaced Friday when Redowl architect Adam Reeve shared his experience signing up for Pokémon Go and how he realized that the app was asking users for full Google permissions on a Tumblr blog pos t. Reeve noted that with full permissions granted to the app, there was the potential that Niantic could have access to read and send emails under users’ Google accounts, make changes and deletions to users’ Google Drive documents, access users’ search and Maps navigation histories, access private images stored in Google Photos, among other actions. The misstep appears to be confined only to iOS devices.

While Niantic has stated that Google is working on a fix for the issue, there is no word on how long it will take for a fix to be implemented.