'Pokemon Go' is fixing a bug that gave it 'full access' to your Google account
"Pokémon Go," a new augmented reality smartphone game from developers Niantic, has proved wildly popular since its launch just last week - but has subsequently been heavily criticised over the user information that it asks for access to.
Players that have been signing up and logging in using their Google accounts have been inadvertently granting the game "full account access" for their Google accounts.
This sparked immediate privacy concerns, with some reports claiming that this even means "Pokémon Go" is able to access your web browser history and read your emails.
It looks like it isn't as bad as that, however. Trail of Bits CEO Dan Guido told Gizmodo that "full account access" gives the app more limited access to your account than the term might suggest: "[It] does not mean a third party can read or send or send email, access your files ... It means Niantic can only read biographical information like email address and phone number."
Still, Niantic has now made clear that requesting "full account access" was a bug.
"Pokémon Go" only uses "basic Google profile information," the company says, and it is now working with Google on a fix so it only asks for the necessary permissions. Here's the Niantic's statement, emphasis ours:
"We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user's Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO's permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves."