Pokémon Go's Update Will Fix the Nasty Security Flaw That Accessed Your Google Account

Update: Niantic Labs, the company behind Pokémon Go, has issued various statements to outlets apologizing for the error in letting the app access your entire Google account. However, the company explained that the app only had access to "basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected," in a statement to TechCrunch.

Essentially, the app could never do a variety of actions on your behalf that Adam Reeve, a risk analyst who originally discovered this flaw, said it could do.

Niantic also further addressed the issue stating that "Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO's permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves."

True to its word, the company has already issued an update that will remedy this problem.

Download it ASAP and go forth collecting Pokémon. Read about the original controversy below.

Original story: If you signed into the recently launched game Pokémon Go with your Google account information, you just granted Niantic Labs, the maker behind the game, an alarming amount of access. By signing into the game with Google, people authorized Pokémon Go full access to their account.

Chances are, you probably did sign up for Pokémon Go with your Google account because the other option, the Pokémon Trainer site, was unavailable due to high server traffic. For perspective on how serious this issue is, I checked the status of my authorized accounts on Google (which you can too, here). I realized not even my MacBook laptop has even remotely the same amount of access that Pokémon Go does.

Full access in Google signifies the third party has read and write privileges to your email and Google Drive and access to Calendar as well as contacts. Essentially, Pokémon Go is able to do everything I can on Google except change my password. As Google describes it, full access "privilege should only be granted to applications you fully trust, and which are installed on your personal computer, phone, or tablet."

If that's not terrifying enough, typically third-party apps that offer login through Google also warn the user of what access they are about to grant to the app. In the case of Pokémon Go, neither the app nor Google alerted the user that they were allowing full access. The breach was first discovered by a risk analyst, Adam Reeve from Red Owl, on Tumblr. Though many people have encountered the issue on both Android and iOS, some didn't see the app gain full access to their Google account. There is no consistent reason so far on why some users did and some did not since no one was required to accept an authorization from Google.

Regardless, if Niantic Labs and Nintendo intended to require full access from users, the company should address it before it loses new players (and revenue) it just acquired.

We don't want to stop catching them all, but we might have to if this isn't fixed soon. For now, one Twitter user seems to have discovered a workaround that allows you to revoke the authorization and still play.