Pokémon Go seems on its way to become a massive success for Nintendo and Niantic Labs, as million of players are enjoying the free-to-play game. But what else does the game ask from users? Quite a lot it seems. When users are logging in, they can choose to do it with a Pokemon Trainer Club or their own Google Account, but what most people may not be aware, is that by choosing the second option, you are indeed granting full access to your account in the iOS version of the game.
This was first reported by researcher Adam Reeve, and followed up by IGN, who got word from a spokesperson for Niantic Labs:
"We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user's Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO's permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves."
Fortunately it seems no harm as come from this security breach with Google accounts, and it looks like both Niantic Lab and Google are working to resolve this situation soon. In the meantime you may want to take precautions and use another e-mail account just to be sure.