Google to change app permissions for 'Pokémon Go' after security concerns

Pokémon Go players won't have to worry about sketchy app permissions for much longer.

The developer of the game has acknowledged that it "erroneously" requested full access permission to users' Google accounts on iOS and says Google is working with them on a fix for the issue.

In a statement provided to Mashable, Niantic, the developer of Pokémon Go, said that the app "erroneously requests full access permission for the user’s Google account," but that no user information was compromised.

"Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected," the company says, adding that Google also confirmed no other information was collected. (Mashable has reached out to Google for further confirmation.)

Niantic, once owned by Google, also said Google was working with them so users won't need to adjust their account settings to address the issue. Instead, "Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs," Niantic says.

You can read the company's full statement on the matter below.

We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access.  Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves.

Security experts raised concerns about the iOS version of Nintendo's mega-viral app after they discovered that it required users to hand over full access to their Google accounts -- a permission level that granted the app unrestricted access to a staggering amount of information, including users' email, calendars, maps, location history and just about everything else associated with the Google account.

Original image has been replaced. Credit: Mashable

In addition to privacy concerns, this also represented a serious potential security threat, as the ability to read and send email could put much more personal information at risk. Even Google itself warns that this kind of access is not to be handed out lightly. "'Full account access' privilege should only be granted to applications you fully trust, and which are installed on your personal computer, phone, or tablet," the company writes on its support page.

The concern, explains Adam Reeve, an employee of security firm Red Owl who first wrote about the app's permissions, is that email is used as the gatekeeper for access to so many other personal accounts. Granting an app complete access to your email could then put much more at risk.

"Given the use of email as an authentication mechanism (think 'Forgot password' links) they now have a pretty good chance of gaining access to your accounts on other sites too," he writes.

Niantic hasn't said how long the fix will take. You can check your Google account permissions here to check what kind of access the app has to your account.