SECURITY INFLUENCERS BLOG

Security influencers provide real-world insight and “in-the-trenches” experiences on topics ranging from application security to DevOps and risk management

START FREE TRIAL

Security Fail in Pokémon Go

 
As you may have heard, some Pokémon Go players may have given the game’s developers access to everything on their Google account – including documents, photos, email messages, search history and items stored their cloud.
 
According to NBC News, this is due to a coding glitch, causing iOS devices to give the app full access to the gamer’s account.
 
Pokemon_Go_Security_fail.jpg
This is pretty minor in the panoply of security glitches. Yes, the app requests more access than it needs, but Niantic has confirmed that they don't actually use their overzealous access rights.
 
We live in a world that doesn't allow granular control over our information.  Access control is one of the most complex security mechanisms and is often difficult to implement correctly.  
 
Actually Niantic deserves some credit for leveraging a strong proven authentication source instead of implementing their own.
 
A scarier thought is what someone like Mint could do with full access to everyone's bank accounts.  The fact is that we share far more access than we technically need to, trusting internet companies with not only information, but the capability to act on our behalf.
Jeff Williams, Co-Founder, Chief Technology Officer

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast. Previously, Jeff was co-founder and CEO of Aspect Security, a successful and innovative application security consulting company acquired by Ernst & Young. Jeff is also a founder and major contributor to OWASP, where he served as the Chair of the OWASP Board for 8 years.

SUBSCRIBE TO THE BLOG