Pokemon Go is a huge security risk

Re:Pokemon Go is a huge security risk by Alex3917 on Monday July 11, 2016 @01:04PM (#12072448)

This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.

[ Parent | on HN ]

Re:Pokemon Go is a huge security risk by maxerickson on Monday July 11, 2016 @01:35PM (#12072742)

Google recommends using the browser workflow for installed apps too.

https://developers.google.com/identity/protocols/OAuth2Insta...

Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not.

Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use an app password:

https://support.google.com/accounts/answer/185833?hl=en

[ Parent | on HN ]

Re:Pokemon Go is a huge security risk by horizone on Monday July 11, 2016 @06:36PM (#12075351)

2 Factor works. I'm forced to log back in when ever there is server troubles, which is annoying, but what ever.

[ Parent | on HN ]

Re:Pokemon Go is a huge security risk by jasalo on Monday July 11, 2016 @04:33PM (#12074283)

Did you try using an App password? Doesn't seem to work for me

[ Parent | on HN ]

Re:Pokemon Go is a huge security risk by maxerickson on Monday July 11, 2016 @05:57PM (#12075056)

No I haven't tried it.

[ Parent | on HN ]