Why I didn’t catch any Pokemon today

Summary: Trail of Bits researchers found that the iOS Pokemon Go app requested a Google OAuth scope called OAuthLogin, which Chrome changelogs refer to as the "Uber" token and which could not be reproduced in Google's own OAuth Playground. Niantic said the iOS account creation process "erroneously requests full access permission" and that the app only accesses User ID and email address, and by 7/13/2016 the app was updated to request only basic permissions.
What's compelling: A July 12 update found the UberAuth token could be exchanged through undocumented methods for tokens granting access to all data in a Google account, including Gmail - and the login flow silently re-enabled permissions after users revoked them.

Read the original at Trail of Bits Blog ↗