HORDES of people are rushing to become part of the Pokemon Go revolution, but joining the game might be putting the personal information of iPhone users at risk.
After downloading the app, players are asked to sign up to the game with their Google account.
This is common practice for many app developers as it uses existing credentials to ensure the sign-up process is fast and simple for users.
Usually, at the point of sign-up these apps will inform the user of the basic information they will have access to, such as the user’s name, gender and location.
However, Pokemon Go developer Niantic Labs did not divulge what it would have access to at the point of sign-up.
This could have something to do with the fact the app had “full access†to Google accounts.
According to the Google help page, this means Niantic Labs now has a great deal of personal information of Pokemon Go players.
“When you grant full account access, the application can see and modify nearly all information in your Google Account (but it can’t change your password, delete your account, or pay with Google Wallet on your behalf),†Google wrote.
The tech giant said full account access should only be granted to trusted applications installed on your personal computer, phone, or tablet.
“If you’ve granted full account access to an app you don’t trust or recognise, we recommend that you revoke this permission by clicking the Revoke access button,†Google wrote.
Niantic Labs released a statement acknowledging the erroneous full access request, and said it was working on a client-side fix.
“Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves,†the statement said.
In other words, signing up to Pokemon Go with your Google account gives the developers the ability to do the following:
• Read your emails and send emails from your account
• View, edit or delete your Google drive documents
• Browse your search history
• Browse Maps navigation history
• Access content stored in Google Photos
As security expert Adam Reeve pointed out, the access to your emails poses an extra security risk that extends beyond Google accounts.
“Given the use of email as an authentication mechanism (think ‘Forgot password’ links) they now have a pretty good chance of gaining access to your accounts on other sites too,†he wrote.
Mr Reeve said there was no need for Niantic Labs to have access to all of this information, although he believes there is nothing sinister at play.
“I obviously don’t think Niantic are planning some global personal information heist. This is probably just the result of epic carelessness,†he wrote.
While admitting the developer has the best of intentions at heart, Mr Reeve said the pool of data would put them at risk from cybercriminals.
“I don’t know how well they will guard this awesome new power they’ve granted themselves, and frankly I don’t trust them at all,†he wrote.
“I’ve revoked their access to my account, and deleted the app. I really wish I could play, it looks like great fun, but there’s no way it’s worth the risk..â€
Will you continue to use Pokemon Go? Continue the conversation on Twittter@mattydunn11