At this moment it would be madness to deny the success of Pokémon GO. With a spectacular launch in the United States, servers down due to demand, and stories of Pokémon in strange places multiplying, the app has opened a new era for the franchise and for augmented reality in general. Unfortunately, not everything that glitters is gold, and according to the latest reports, Pokémon GO has several problems regarding elevated permissions and privileges, both on iOS and Android...
Independence Day and Ghostbusters are in theaters, someone with the last name Clinton is trying to be president, and everyone seems to be playing Pokémon. The calendar says '2016', but the phrase from friend Snake Plissken makes its way again: The more things change, the more they stay the same. The impact of Pokémon GO has been so great that in less than 48 hours it added almost 10 billion dollars to Nintendo's value, something not seen in many years. This not only confirms that Nintendo's power lies in its franchises, but also that Pokémon has the ability to attract children and adults alike, despite its huge number of existing games and an anime series with more than 900 episodes that has no end. The launch of Pokémon GO was not perfect, since several of the features observed in the trailer are not yet available (trading, PvP battles, group battles, etc.), and the folks at Niantic are fighting with their own servers. To this we must add reports of something quite common in mobile applications: Permission and privilege problems.
The Privacy Problem
In simple terms, the Pokémon GO app requests full access to our Google accounts, regardless of the device we use (iOS or Android). If we take a look at the application's privacy policies, the story gets even worse, with records of IP address, email address, the web page we were visiting before entering Pokémon GO, username, and our current location. While this is not the first time we've seen this kind of permission in a mobile app, Pokémon GO's mechanics make the whole situation much more concerning. As if that were not enough, there are already new versions of malware on the Web looking to take advantage of the Pokémon GO frenzy and its current limited launch, with the false promise that it works anywhere in the world (by the way, Europe and Asia have to wait).
Anyone wishing to correct this permission problem can go to the security section of their Google account and revoke the permission granted to Pokémon GO. However, a recent statement from Niantic confirms that it is a mistake, and that the application only requires basic information about an account, more specifically, user ID and email address. Niantic also stressed that "no other kind of data" was received by the company through Pokémon GO, and the solution will come in two parts: an update for the app that will report the correct permission level, and a reduction of them on Google's side. In short: If you want to fix this now, revoke access. Otherwise, wait for the next update.
