WEBVTT
Kind: captions
Language: en

1
00:00:00.070 --> 00:00:03.759
I don’t have the rights to use any actual
images of Pokémon in this video.

2
00:00:03.759 --> 00:00:07.920
But just me talking to the camera for a few
minutes isn’t particularly interesting,

3
00:00:07.920 --> 00:00:12.419
so I asked my illustrator friend Simon to
create some plausible,

4
00:00:12.419 --> 00:00:15.309
but utterly fake, Pokémon for me to catch.

5
00:00:15.309 --> 00:00:17.060
Yeah, that'll do.

6
00:00:17.060 --> 00:00:20.060
This week, there was a bit of a privacy scare
about Pokémon Go.

7
00:00:20.060 --> 00:00:24.039
Someone said that the company behind it could
read all your email;

8
00:00:24.039 --> 00:00:26.419
someone else said no, they couldn’t,

9
00:00:26.419 --> 00:00:29.419
and that was after doing a lot of research
into how the app worked;

10
00:00:29.419 --> 00:00:31.119
and then the consensus became that,

11
00:00:31.119 --> 00:00:33.480
while it was technically possible,

12
00:00:33.480 --> 00:00:37.460
it would require a lot of hassle on their
part and it was the result of a mistake,

13
00:00:37.460 --> 00:00:40.350
not some devious attempt to steal your data.

14
00:00:40.350 --> 00:00:43.460
The problem was permissions.

15
00:00:43.460 --> 00:00:46.890
When you see one of those buttons that says
sign in with Google,

16
00:00:46.890 --> 00:00:51.210
or sign in with Facebook, or --
excuse me --

17
00:00:51.210 --> 00:00:56.370
Mm. Or sign in with Twitter, you are using
something called OAuth.

18
00:00:56.370 --> 00:00:57.379
It works like this:

19
00:00:57.379 --> 00:00:59.329
you tell the app “I’d like to sign in
with Google”.

20
00:00:59.329 --> 00:01:01.070
The app then sends you to Google.

21
00:01:01.070 --> 00:01:03.510
Google checks who you are with your username
and password,

22
00:01:03.510 --> 00:01:06.840
or by doing some magic with your Android phone,
and if they’re happy,

23
00:01:06.840 --> 00:01:09.189
they send you back to the app with a new thing
called a token.

24
00:01:09.189 --> 00:01:12.150
The app takes the token, and until you say
otherwise,

25
00:01:12.150 --> 00:01:14.450
it can use that token as a way to
access your account

26
00:01:14.450 --> 00:01:18.880
without ever knowing your password and without
you needing to be there.

27
00:01:18.880 --> 00:01:21.250
It is, of course, a little bit
more complicated than that,

28
00:01:21.250 --> 00:01:24.790
as anyone who’s ever tried to
write code for it knows,

29
00:01:24.790 --> 00:01:27.750
but that’s a reasonable summary
of what's going on.

30
00:01:27.750 --> 00:01:30.710
Here’s the clever part: that token, yes,

31
00:01:30.710 --> 00:01:32.030
it could have access to your full account,

32
00:01:32.030 --> 00:01:34.710
but it can also be set up
so it only allows access

33
00:01:34.710 --> 00:01:38.460
to a very limited and specific set of permissions.

34
00:01:38.460 --> 00:01:40.399
Maybe it can only read your calendar appointments.

35
00:01:40.399 --> 00:01:46.390
Or maybe it can only add comments to YouTube
videos that you watch.

36
00:01:46.390 --> 00:01:51.360
For Pokémon Go, that token was meant to only
grant access to see your email address,

37
00:01:51.360 --> 00:01:54.180
not to read anything,
just to prove who you were.

38
00:01:54.180 --> 00:01:56.430
The problem was, it didn’t.

39
00:01:56.430 --> 00:01:59.979
Pokémon Go is made by
a company called Niantic (Nyan-tic?)

40
00:01:59.979 --> 00:02:02.590
They were originally a spin-off of Google,

41
00:02:02.590 --> 00:02:04.710
and it looks like they’ve got some contacts
on the inside.

42
00:02:04.710 --> 00:02:07.979
They weren’t using the permissions system
that everyone else had to use:

43
00:02:07.979 --> 00:02:09.410
they were using an old one.

44
00:02:09.410 --> 00:02:11.450
Through some fancy, manual trickery,

45
00:02:11.450 --> 00:02:14.280
it was possible to convert
the token they’d been given

46
00:02:14.280 --> 00:02:17.890
into an "uber-token" that would give an attacker
full access

47
00:02:17.890 --> 00:02:20.970
to everything in your Google account,

48
00:02:22.820 --> 00:02:24.080
including your email.

49
00:02:24.080 --> 00:02:27.800
They weren’t doing this, but they could
have. And for that reason,

50
00:02:27.800 --> 00:02:30.030
when you checked
what permissions Pokémon Go had,

51
00:02:30.030 --> 00:02:33.740
Google correctly reported that it had full
access to your account.

52
00:02:33.740 --> 00:02:37.080
I want to credit Ari Rubinstien at this point:

53
00:02:37.080 --> 00:02:39.070
he was the developer who did all the digging

54
00:02:39.070 --> 00:02:42.140
and put a really good post together about
what’s going on.

55
00:02:42.140 --> 00:02:43.980
If you want the in-depth, technical details,

56
00:02:43.980 --> 00:02:46.520
I’ve put a link in the description.

57
00:02:46.520 --> 00:02:48.200
The latest update to Pokémon Go,

58
00:02:48.200 --> 00:02:50.860
which has none of these weird things,

59
00:02:50.860 --> 00:02:54.990
fixes the problem, of course, and all is well.
Or is it?

60
00:02:54.990 --> 00:02:57.940
Because there’s a deeper problem here that
can’t be fixed by patching some code.

61
00:02:57.940 --> 00:03:02.980
Don’t get me wrong, the current OAuth solution
with its tokens is much better than the old days.

62
00:03:02.980 --> 00:03:07.370
I remember when you had to give your actual
Twitter password to third-party apps,

63
00:03:07.370 --> 00:03:11.650
who would then send it in plain text over
the internet.

64
00:03:11.650 --> 00:03:14.670
The current solution is better, but it’s
not perfect.

65
00:03:14.670 --> 00:03:16.900
And there are two big things wrong with it.

66
00:03:16.900 --> 00:03:19.050
First of all, you have to trust the app.

67
00:03:19.050 --> 00:03:23.520
You have to trust that the “sign in with
Google” button is actually doing what it claims

68
00:03:23.520 --> 00:03:27.510
and when the box pops up
asking for your Google password,

69
00:03:27.510 --> 00:03:30.600
it actually is a box from Google
and not the app just faking it.

70
00:03:30.600 --> 00:03:32.070
That’s less of a problem for big apps,

71
00:03:32.070 --> 00:03:35.460
or if you’re downloading from the well moderated
Apple App Store,

72
00:03:35.460 --> 00:03:40.970
but because Pokémon Go was incredibly popular
and not available everywhere in the world,

73
00:03:40.970 --> 00:03:43.650
lots of people on Android
were sideloading it:

74
00:03:43.650 --> 00:03:45.680
downloading it from somewhere unofficial,

75
00:03:45.680 --> 00:03:47.870
and copying it over manually to their phone.

76
00:03:47.870 --> 00:03:50.940
There were plenty of alternate versions filled
with malware

77
00:03:50.940 --> 00:03:53.940
that would happily have stolen your password,
or, well,

78
00:03:53.940 --> 00:03:56.450
anything else that was on your phone.

79
00:03:56.450 --> 00:04:00.430
Second, people’s priorities for security
often don’t reflect reality.

80
00:04:00.430 --> 00:04:05.500
We all emphasise easy to understand scare
stories over complicated, subtle, boring attacks.

81
00:04:05.500 --> 00:04:08.800
That’s the reason I’m doing a video about
Pokémon Go, for crying out loud.

82
00:04:08.800 --> 00:04:11.260
A scare story about an innocent game,

83
00:04:11.260 --> 00:04:15.460
one that millions of people are playing and
have an emotional attachment to?

84
00:04:15.460 --> 00:04:19.690
Oh, if that's actually being evil and reading
your email? That’ll get the clicks.

85
00:04:19.690 --> 00:04:24.980
But that same game having live tracking on
millions of people’s locations and social networks,

86
00:04:24.980 --> 00:04:29.220
being run by a small company that is now an
enormous target for private hackers, and blackmailers,

87
00:04:29.220 --> 00:04:33.930
and governments that would really like to
know that information? That’s boring.

88
00:04:33.930 --> 00:04:35.720
That’s abstract. We know that,

89
00:04:35.720 --> 00:04:38.280
but it’ll never happen to you, right?

90
00:04:38.280 --> 00:04:41.980
I’m a great believer in the old saying cock-up
before conspiracy:

91
00:04:41.980 --> 00:04:46.040
never attribute to malice what can be explained
by incompetence. No,

92
00:04:46.040 --> 00:04:48.720
of course this wasn’t a dastardly scheme
to read all your email,

93
00:04:48.720 --> 00:04:52.310
it was just a couple of developers making
a mistake while rushed.

94
00:04:52.310 --> 00:04:56.980
Let’s just hope there aren’t any more
headlines caused by any other mistakes

95
00:04:56.980 --> 00:05:01.470
while you’re catching your… whatever the
heck that is.

96
00:05:01.470 --> 00:05:04.570
I’m going to be away for three weeks on
an expedition to the Arctic.

97
00:05:04.570 --> 00:05:06.700
But rather than abandon my channel for a while,
I thought:

98
00:05:06.700 --> 00:05:08.870
why not get some guests involved? So,

99
00:05:08.870 --> 00:05:10.880
if you have a YouTube channel,

100
00:05:10.880 --> 00:05:14.320
and you’ve got an idea for an Amazing Places or a Things You Might Not Know video

101
00:05:14.320 --> 00:05:18.350
that you could make and get to me
before 6th August,

102
00:05:18.350 --> 00:05:20.400
follow the link on screen or in the description.

103
00:05:20.400 --> 00:05:22.720
I am particularly looking for people, styles,

104
00:05:22.720 --> 00:05:26.030
and videos a little different from what normally
appears here.

105
00:05:26.030 --> 00:05:27.910
So if you just heard that and thought

106
00:05:27.910 --> 00:05:29.770
"oh, I'd like to do that, but I'm not sure I'd fit”:

107
00:05:29.770 --> 00:05:31.570
I definitely want you to get in touch.

108
00:05:31.570 --> 00:05:33.150
[Translating these subtitles? Add your name here!]