Pokemon Go Has Full Access to Your Google Account, Here’s How to Fix It

While Pokemon Go may simply be out there in three international locations for now, that hasn’t stopped followers the world over from acquiring the sport for Android by way of sideloading or iOS by creating and utilizing an iTunes account for Australia, New Zealand, or the US. It appears that these enjoying Pokemon Go have been topic to a obtrusive safety violation. The sport has full entry to your Google account. Well, no less than on iOS.

(Also see: Pokemon Go Tips and Tricks)

This was found by Adam Reeve, Principal Architect at RedOwl Analytics. He took to Tumblr to share his findings:

“Let me be clear – Pokemon Go and Niantic can now:
• Read all your email
• Send email as you
• Access all your Google drive documents (including deleting them)
• Look at your search history and your Maps navigation history
• Access any private photos you may store in Google Photos
• And a whole lot more”

And this is not all. According to Reeve, because the sport makes use of electronic mail as an authentication mechanism, he believes there’s “a pretty good chance of gaining access to your accounts on other sites too.”

(Also see: Pokemon Go Is Responsible for These Real Life Weird and Scary Things)

There isn’t any want for this both. Usually when a developer permits customers to register by way of Google, the extent of entry is specified. More usually than not that is merely contact information.

Reeves later tweeted that “it seems to affect some iOS users, not all. No idea what the criteria are yet.”

(Also see: Playing Pokemon Go in India? Here’s Everything You Need to Know)

We’ve checked this with the Google account used on our iPhone 5S and sure, Pokemon Go did grant itself full entry to our account. This was not the case with our Android construct of the sport, though on the time of posting this, simply one user has reported that it does affect the Android model as nicely. Reeves believes that on “Android it’s using client permissions to get data, whilst on iOS it’s using the Google account.”

Nonetheless, should you’re not eager on letting Niantic have full entry to your account, deleting the sport is not sufficient. Here’s what you want to do to repair this:

1. Log in to your Google account.
2. View the app permissions out there here.
3. Revoke entry to the sport by clicking it.

Right now, Niantic and The Pokemon Company have maintained silence on this. Keep in thoughts that should you ever determine to threat enjoying Pokemon Go once more, you will want to grant it entry to a Google account. The sport does have an possibility to allow you to register utilizing a Pokemon.com account however because the sport’s launch the enroll part of the positioning has been unavailable. Hopefully this corrects itself in days to come what with Niantic and The Pokemon Company planning a world launch for the sport quickly sufficient.

Update, July 12, 2016: Niantic has issued the next assertion:

“We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected.

Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves.”