Even if they are a startup within Google, what does that mean for my security as a user?
Do they store this API key with full access to a Google account the same way that an official Google app (e.g. Gmail itself) stores my secret data? If so, I probably trust it. Or do they just throw it in a GCE database without a whole lot of thought around a security policy since they're still a fast-moving startup, and maybe my credentials get logged somewhere, or synced to an analytics system that's not treated as classified and a whole bunch of employees can inadvertantly access, etc
Seems like I have no way of knowing (unless maybe it's in their terms of service?). It could very well be a "Huge security risk"
You're absolutely right - Niantic's history with Google does not preclude them having crummy security practices that we aren't aware of.
However, "Popular thing possibly has crummy security practices (we just don't know)" isn't HN-worthy, it's just FUD. I think both of us would prefer a HN full of well-researched articles over one full of clickbait FUD.
>However, "Popular thing possibly has crummy security practices (we just don't know)" isn't HN-worthy, it's just FUD.
Bullcrap. Best security policy is trust, but verify.
Assuming that well established businesses have good security practices without doing proper review is what allowed all those fraudulent SWIFT transactions to go through a few months ago. It's perfectly valid to ask why the hell Pokemon Go thinks it needs access to your private email.
Actually, that's all there is to "research" about this topic, as there is nothing available to read around what they could possibly use the full access tokens in any terms of service or application literature.
Not FUD to me. I am not going to install Pokemon Go until this is cleared up. I am glad he pointed it out, since I may have clicked through given I would have made quick judgements about them being Google-owned.
One thing the article is wrong about is that you can create a new account a pokemon.com (bypassing the google kerfuffle). You just need to keep reloading until it let's you past the "try again in an hour" message.
Do they store this API key with full access to a Google account the same way that an official Google app (e.g. Gmail itself) stores my secret data? If so, I probably trust it. Or do they just throw it in a GCE database without a whole lot of thought around a security policy since they're still a fast-moving startup, and maybe my credentials get logged somewhere, or synced to an analytics system that's not treated as classified and a whole bunch of employees can inadvertantly access, etc
Seems like I have no way of knowing (unless maybe it's in their terms of service?). It could very well be a "Huge security risk"