Privacy scare over Pokémon Go app for iOS

As if there weren’t enough headlines about malicious bogus Pokémon Go apps for Android, and thieves using the game ambush and rob unsuspecting players, privacy concerns have now been raised about the iOS edition of the app.

Adam Reeve found that players of the iOS version of Pokémon Go who signed into the app via Google, were unwittingly giving the Nintendo game – developed by Niantic – “full access to [their] Google account”.

Here’s what Reeves said:

Let me be clear – Pokemon Go and Niantic can now:

• Read all your email
• Send email as you
• Access all your Google drive documents (including deleting them)
• Look at your search history and your Maps navigation history
• Access any private photos you may store in Google Photos
• And a whole lot more

And they have no need to do this – when a developer sets up the “Sign in with Google” functionality they specify what level of access they want – best practices (and simple logic) dictate you ask for the minimum you actually need, which is usually just simple contact information.

Other players of Pokémon Go – including popular security tweeter @SwiftOnSecurity – said they had confirmed that the app had grabbed full access to their Google accounts.

I like to imagine this is a cockup rather than a conspiracy, and that the game’s developers do not have any malicious intent, but this really doesn’t sound good at all.

Hopefully a new fixed version of the Pokémon Go app for iOS will be released sooner rather than later.

In the meantime, players may wish to revoke the game’s access to their Google account.

Update:

Game developer Niantic has responded to the issues raised by Reeve:

“We recently discovered that the Pokémon Go account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon Go only accesses basic Google profile information (specifically, your user ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon Go or Niantic. Google will soon reduce Pokémon Go’s permission to only the basic profile data that Pokémon Go needs, and users do not need to take any actions themselves.”

Slack security engineer Ari Rubinstein has confirmed that the iOS version of Pokémon Go only requests your OpenID and email address from Google.

In short, it sounds like Pokémon Go app for iOS (in its current form at least) cannot access your email messages or Google Drive documents.

From the sound of things we can all stand down from “Brown alert” and concentrate on something more important – catching that elusive Eevee.

Found this article interesting? Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.