Pokemon Go is a huge security risk - <AUTHOR> http://adamreeve.tumblr.com/post/147120922009/pokemon-go-is-a-huge-security-risk <comment><USER2> It's worth noting that Niantic Labs (the folks who licensed Pokemon from Nintendo and made Pokemon Go) are actually _owned_ by Google [0]. This is Google giving itself permission to do Google things. Dollars to doughnuts they tried to use some internal-only API because things kept falling over at pokemon.com. Is this a massive UX failure? Certainly. Is giving Google permission to access Google stuff a "Huge security risk"? No more than putting your stuff in Google's hands in the first place.

Niantic are also the folks behind Ingress, if you've heard of that.

[0] Specifically, Alphabet owns a significant portion of Niantic, along with Nintendo: [https://nianticlabs.com/blog/niantic-tpc- nintendo/](https://nianticlabs.com/blog/niantic-tpc-nintendo/) (they were previously wholly-owned by Google).

<comment><USER3> They _were_ an Alphabet company, but were spun off last year: [https://www.theguardian.com/technology/2015/aug/14/niantic-l...](https://www.theguardian.com/technology/2015/aug/14/niantic- labs-departs-google-alphabet-ingress)

<comment><USER2> Right, so not only did they spend a significant amount of time steeping in Google itself, the big G then invested a significant amount of cash into the now-spun-out company. I'd say that qualifies as 'owned'.

<comment><USER4> How does that make the permission creep OK? If they were part of Google, and _already had access_ to the data, that's one thing. But they aren't, and they don't.

</comment></comment></comment></comment><comment><USER5> Update from Niantic in this Game Informer article [http://www.gameinformer.com/b/news/archive/2016/07/11/pokemo...](http://www.gameinformer.com/b/news/archive/2016/07/11/pokemon- go-has-access-to-your-entire-google-account.aspx)

 _" We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user's Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO's permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves."_

<comment><USER6> I actually just finished wrangling social log in for a system that is waaaay less popular than Pokemon GO. Rather amusing to see an organization operating at a vastly bigger scale still hitting the same sorts of speed bumps.

</comment></comment><comment><USER7> If google auth as a platform grants _full access_ to your google account without any sort of confirmation, isn't _that_ the security risk? Whether or not it's intentional or malicious on the part of Niantic, that seems like the real problem here.

<comment><USER8> Yeah, I agree. I strongly suspect that the scope of permissions requests was an oversight (e.g. Just ask for everything now, we'll pair it down once we know what data we need). Additionally, while I don't like the idea of having Niantic having access to my entire Google account, let's remember that Niantic started as a Google company, and is now under the Alphabet umbrella, so have a vested interest in keeping things on the up-and-up. Lastly, Nintendo is up 35% thanks to this game (about $7B), and I strongly doubt that there is anything they could gain from scraping/abusing these Google accounts that would come even close to that type of impact. My money is on "bad development process and oversight", and this is just one of many rough edges that I've already noticed in the software.

<comment><USER9> > I strongly doubt that there is anything they could gain from > scraping/abusing these Google accounts that would come even close to that > type of impact.

I'd have said the same about VW's emissions cheating scandal before it broke.

</comment></comment></comment><comment><USER10> And just like that I will never sign in with Google anywhere ever again. I just assumed that an app couldn't grant itself full permissions without notifying me, but now I can see why that might not be the case since they are free to present whatever UI they want in app.

In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that they didn't hoover up all the information they had access to they can be unbanned after a year.

Unlikely though considering they used to be a part of Google.

<comment><USER11> This is a fundamental security issue due to a combination of the OAuth protocol and UIWebView (and whatever the Android equivalent is), which I've posted about before [0]. Basically, the problem is that OAuth depends on web- based access granting, but an app has full permissions over the DOM of the WebView where the OAuth screen is. So you're entering your password into a WebView of a third party URL, but unlike a traditional safari page, the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website.

There is no technical limitation to an app engaging in _very_ nefarious activity. For example an app could modify the DOM on the sign-in screen to grab your password after you enter it. Of course the accountability of MITM and security reviews might mitigate this risk, but passwords are generally only a few bytes and could easily be obfuscated and passed surreptitiously over the wire.

I've seen a (quite popular) app implement this for facebook invitations, which should only have a limit of 50 friends, to secretly (in the background, without any action on your behalf other than logging in, or perhaps pressing a "continue" button) invite every one of your friends to download the app. Since facebook does not notify you when you send an inviation, you would not even know the app did this unless one of your friends who you invited asked you about it.

[0] [https://news.ycombinator.com/item?id=11637209](https://news.ycombinator.com/item?id=11637209) (thanks molecule)

<comment><USER12> > the WebView is fully "owned" by the app, so the developers can inject > arbitrary code into the DOM of the third party website

Uh, seriously? I just suggested to our mobile team to integrate this way on Android (I implemented the OAuth 2 server).

I would've made the same suggestion to a 3rd party app vendor when the day comes.

<comment><USER13> A Chrome Custom Tab is probably the better way to go.

</comment></comment></comment></comment><comment><USER14> "Pokemon Go Release" has "full access" and yet "Ingress" (a game very similar to Pokemon Go from the same company) only has "basic account info". I removed the access and when I started the app, it crashed right away. (I'm on iOS, by the way.) Subsequent launch I'm stuck on the "LOADING..." screen, and then it says "Failed to get player information from the server." I hope the servers are just down and I didn't lock myself out. (Or maybe I should be glad until this fix this breach.) Edit: Deleting the app and reinstalling allowed me to log in again.

It appears to be the iOS version only that's doing this, according to this article:

[http://9to5google.com/2016/07/11/psa-pokemon-go-full- access-...](http://9to5google.com/2016/07/11/psa-pokemon-go-full-access- google-accounts-iphone/)

<comment><USER15> When I checked this morning Ingress also had full perms. I revoked and reconnected and Ingress only had basic account info. I was also queried appropriately.

Possibly this was fixed on Ingress sometime in the last X months but not on Pokemon Go.

<comment><USER16> Same here. I granted Ingress access in Nov 2015

</comment></comment></comment><comment><USER17> I don't see any access granted to Pokemon Go (it's not even listed) in the "Apps Connected to your Account" page: [https://security.google.com/settings/security/permissions](https://security.google.com/settings/security/permissions)

I am running on a Nexus 6 and signed in with my Google Account when I first launched the app.

Try revoking access and see what happens. Worst case, it might ask you to sign in again.

<comment><USER18> on iPhone 6s, checked and saw it had full access. I revoked access and opened the app up. It was stuck loading so I logged out and back in. Went back to check app permissions on google and it had full access again.

<comment><USER19> Wait, you revoked access from within google, and then the pokemon app was able to give itself access again without asking for permission?

<comment><USER18> Yes. I'm not sure if I need to re-log in the app or not though. Maybe if it didn't freeze and I didn't have to re-log then it might have left the access revoked. But it seems that once I re-log the full access goes back into effect.

<comment><USER20> re-logging in is re-authorization

</comment></comment></comment></comment></comment><comment><USER21> "[T]his section of the privacy page on the Google account settings website is only showing up for those that have played on iOS and signed in using the Google button. Android users who used the same login method are not seeing the "Pokemon Go Release" at all on the permissions site (nor do they see Ingress), so we're not sure yet if those users have trusted Niantic with their entire Google account as well." source: [http://9to5google.com/2016/07/11/psa- pokemon-go-full-access-...](http://9to5google.com/2016/07/11/psa-pokemon-go- full-access-google-accounts-iphone/)

<comment><USER22> > Android users who used the same login method are not seeing the "Pokemon Go > Release" at all on the permissions site (nor do they see Ingress)

This is interesting, I can't test this myself as I have previously played Ingress on both iPhone and Android.

My Android device is mostly for development/testing, so I'm not nearly as regular a user of the platform as I am for iOS.

Could any Android users comment on if this is normal to not see Android apps like Ingress on this authorization list?

<comment><USER23> I've never played Ingress, but I've played PGO for android. Google account settings ([https://security.google.com/settings/security/permissions](https://security.google.com/settings/security/permissions)) shows an empty list for me.

</comment></comment></comment><comment><USER24> Caveat: I've seen a number of players state or imply that playing this game has been the first decent exercise they've had in years. Lack of exercise is a far greater threat to your well-being than having your Google account hacked, so if that's what it takes, go ahead and play the game anyway.

<comment><USER25> Pokemon Go, like most apps, is likely just a fad. In a few months, only a few thousand die hards will still be playing it. But the full access permissions will still be there.

<comment><USER26> That's what my parents said 20 years ago... hasn't died yet

<comment><USER27> You should try the Go game. It may have some lasting power I haven't seen yet, but its not the normal Pokemon game by any stretch. The core gameplay is actually pretty boring once you've done it for a little while (i.e. once the initial euphoria of catching things wears off).

<comment><USER26> Oh I have been playing and while it is far inferior to the core Pokemon gameplay, I have met over 30 new people because of this game in less than a week. People who I've never talked to at work, I am now talking to.

I have honestly never used an app that has brought me closer together to the people around me. I don't see this being a fad.

</comment></comment></comment></comment></comment><comment><USER28> Full access is bad enough, but the really dodgy thing going on is that you never get asked to approve or deny that access for Pokemon Go when doing the OAuth flow. You just log in, proceed through 2fa, and you're magically logged into the app. Pokemon Go Release then shows up as an authorised app... except I never authorised it.

My theory is that they're injecting JavaScript into the web view to automatically press the 'Approve' button and hiding that from the user. If true, that's very worrying. They'd be effectively circumventing the whole OAuth framework by forging the user's approval of the app. Every user should have been asked up-front whether or not they wanted to approve or deny Pokemon Go's full access.

</comment><comment> nappy-doo I spoke with a friend of mine at Niantic. They are in communication with the oauth group at Google, and are fixing the issue.

<comment><USER29> Can you also tell them to read a few Reddit threads, or Twitter? There are many, many issues which will limit the lifetime of this game.

</comment></comment><comment><USER30> I know Google lets you see which apps are connected to your account via [https://security.google.com/settings/security/permissions](https://security.google.com/settings/security/permissions) but is there any page where I can see what activity was done on my account by particular apps?

</comment><comment><USER31> A lot of aspects of Pokemon Go are less than polished from an app dev perspective. The way they ask for device permissions doesn't follow best practices at all (no explanation of why they need them). The interface has too much explanatory text in some places (how much useless backstory did I need to click through to start playing?) and not enough in others (it took me forever to figure out what I was supposed to do once I found a pokemon). My sister-in- law was complaining about how all the pokemon graphics are very 2D, when they could easily have sprung for some shading or shadows.

I suspect they built an MVP and launched it and it happened to take off, and we'll see some more polish in the future.

For this particular issue though - I'd bet that Niantic has some sort of data- sharing agreement with Google, anyway, making this point moot. They started as an internal startup at Google, and they make really heavy use of the Maps & Places APIs that would probably cost a fortune if they didn't have some sort of bulk data sharing agreement.

</comment><comment><USER32> There are enough kids playing this maybe the FTC will get involved. Maybe some sort of basic privacy requirement.

How is it possible that signing in didn't inform me what permissions I was granting? I didn't think I was giving _anything_ except my email address.

<comment><USER33> Kids (under 13 in USA, under 16 in Netherlands) aren't allowed to have gmail accounts AFAIK

[https://support.google.com/accounts/answer/1350409?hl=en](https://support.google.com/accounts/answer/1350409?hl=en)

<comment> nommm-nommm That's due to a Clinton era law Children's Online Privacy Protection Act of 1998 (COPPA). It forbids companies form collecting personal info from children under 13 without their parents permission.

<comment><USER34> What's funny is that nobody seems to provide a workflow to actually create accounts for kids. I want to set up a supervised google account for my son for hangouts et al... and I have no idea how. I guess that's not a thing.

<comment> nommm-nommm It is for some services/websites that have policies in place. Google probably doesn't care enough to have a process, not worth it for them.

<comment> nommm-nommm Since I can't edit here is an example:

[http://www.neopets.com/coppa/consentform.phtml](http://www.neopets.com/coppa/consentform.phtml)

Google doesn't care because it takes more effort for them to obey by the law than its worth for them at this time.

<comment><USER35> Haha, I remember getting this signed and then faxed by my dad when I was like 11. Funny seeing it here because I first learned HTML from Neopets (anyone else?). HTML brought me to javascript and computer programming in general. 15 years later, that form is still up and I guess kids are still playing Neopets. And now I am here, weird.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> > I really wish I could play, it looks like great fun, but there's no way it's > worth the risk.

Why not just create a separate google account if one's so eager to play?

<comment><USER37> Seriously; I created one just to avoid entering 2fa every time servers go down.

<comment><USER38> The pokemon trainer site does work, just requires a lot of refreshing...

<comment><USER37> I tend to trust easy to revoke, well tried auth mechanisms over someone's home-grown version—especially judging by e.g. playstation network's terrible history. I simply don't trust Nintendo to not require me to reset my password with a breach, and I'm lazy as hell.

</comment></comment></comment></comment><comment><USER39> Isn't Niantic actually affiliated with (part of?) Google in some way? So it would seem natural, if odd, that it doesn't ask for full permissions for the account is actually already has full permissions to. In the same way google docs doesn't ask, but gets, full permissions to your google account, or google+ doesn't ask, but gets, full permissions to your google account.

<comment><USER40> Google no longer owns Niantic

<comment><USER39> Well then that is a strange security lapse on Google's part. A spin-off company that had internal high-level access privileges, is spun off, and can still retains those high-level access privileges? That seems like a mistake somewhere.

<comment><USER41> You can make an app that does the same thing right now.

What are you talking about?

It's developer laziness.

<comment><USER39> I don't know the android ecosystem well. Can any random app ask for and be granted full access without informing the user of that elevated access request?

<comment><USER41> That is a feature of the Google sign-in system.

The security policies for that sign-in system are not as granular as Android's security policies.

Normally an app would request permissions at run-time or install-time.

</comment></comment></comment></comment></comment></comment><comment><USER42> Here I thought the article was going to be on how Pokemon Go encourages people to wonder into dangerous or restricted areas while paying attention to their phone. The odds of someone getting attacked in a rough area would seem to go up with such an app given how critical situational awareness is. I don't know enough about how the app works to assess that, though.

One app that got me thinking about these things was Google Maps. I noticed it directed me through The Hood of a murder capital to save 3 minutes on a route. An area where people are known to surround cars or level guns on their owners. I had to wonder how much more risk like this is in any GPS-enabled app that sends you from point A to B.

<comment><USER43> What city is this? Just curious. I don't know any such city in the United States

<comment><USER42> Just look up top 10 cities or metro areas for violent crime. Memphis Metro Area, in and around Memphis TN, is one of them on most years. We have lots of good areas and things going on with the worst stuff mainly in impoverished, minority areas. Lots of street gangs that maintain efficiency and image with armed robbery, murder to solve disputes, and/or initiation by murder of innocent, harmless people. Impoverished, white areas are fairly safe with their crooks mainly doing property crime or con jobs. Rarely violent. Most impoverished areas I've been have a mix, though. Middle-class and upper-class areas are also fairly safe outside property crime regardless of mix. Last I checked, city was going mostly Black with lots of Latinos coming in and Whites moving out due to crime. Actually, exits from all races for that. Often outside of Memphis but having jobs inside it. Economy & education keep going downhill predictably. Many companies refuse to deliver to certain areas or leave the city since theft overtakes profits quickly. Many make it, though, with beefed up security. Local grocer has 8 security guards for one store. Police themselves guard best, Chinese, food place. Haha.

That's backdrop. Relevant here, North and South Memphis are largely the worst in terms of violence. You do _not_ want to be in certain neighborhoods regardless of color. Even cops avoid them. Others are a risk more if you're white or look like you have property to take. Local media & cops suppress the worst of it to maintain tourism revenue (eg Elvis, BBQ) although the murders naturally get reported. Examples of censorship were kicking out The First 48 show and rape kit scandal. That Google Maps takes you right near those areas is probably why lots of people think the whole city is hood and trashed rather than just those parts. They never see the good parts unless specifically visiting them family, friends, jobs, or tourism.

So, yeah, it's a real issue. I double-check Google Maps if I'm going anywhere Downtown, Midtown, North, or South as it doesn't differentiate risky vs non- risky areas. I regularly have to force it to make safer routes. Straight-up avoid certain areas of the city unless I'm packing heat & with backup. Otherwise, still all kinds of good things to get involved in over there with most folks being alright. We just in a rough area and economy. :)

Note: As another example, BLM protestors sieged our Interstate (I-40) last night for hours then dispersed into Downtown. Local news cautioned everyone to stay away from that area for safety as it's normally dangerous but now unpredictable. Bad route at the least. Google routes still offering me a speedy trip through there, though. Unreal.

</comment></comment></comment><comment><USER44> It should be noted that it sounds like only iOS users are seeing this.

I signed in with my Android, and I didn't see anything from Niantic or Pokemon Go in my security settings.

<comment><USER45> Same here (Android user), and I just double checked what apps have access to my google account, and nothing from Niantic or Pokemon Go listed at all.

</comment></comment><comment><USER46> Doesn't Google OWN Niantic? So now Google has access to our Google data? Don't see the issue.

<comment><USER47> They no longer own them. They were spun during the housecleaning before the Alphabet announcement.

<comment><USER48> Yep, though they also soon after made a further investment in Niantic. It may sound bizarre at first, but there might be good reasons why they did that. For instance, Nintendo might've been less likely to team up with a wholly Google- owned Niantic. (purely speculation on my part)

[https://nianticlabs.com/blog/niantic-tpc- nintendo/](https://nianticlabs.com/blog/niantic-tpc-nintendo/)

<comment><USER49> I strongly suspect a direct Google/Nintendo tie was considered less favorable than some little ex-Google company that still uses Google servers working on a Nintendo game. The announcement timing was pretty close.

</comment></comment></comment></comment><comment><USER9> This seems like a massive security fail on Google's part. There's no reason the OAuth flow should be able to request admin privileges _silently_. As a user, I really must get a prompt asking me (and warning me!).

</comment><comment><USER50> On a sidenote: does anyone know why the fuck are the servers so overcrowded? In a world with a whole bunch of automated cloud management solutions and auto-scaling, where is the problem?

</comment><comment><USER51> I'm running iOS 9.3.2, and signing in to Pokemon Go caused it to have full access to my Google account. Just revoked it and looks like I can still play the game just fine.

Perhaps they misconfigured the Google auth sign-in? It's rather worrisome that it's this easy for an application to gain full access to your account, though.

<comment><USER52> Did you check the permissions again? I did the same, running the same iOS version, and it just restored the same full-access when I opened the app again.

<comment><USER51> Yep, just checked. It's not here at all. Were you asked to sign in again after you revoked?

</comment></comment></comment><comment><USER53> Here's a weird question. [https://www.facebook.com/NationalMallNPS/photos/a.3795806520...](https://www.facebook.com/NationalMallNPS/photos/a.379580652053692.97287.151776458167447/1186299898048426/?type=3&theater) Pokemon Go is designed to not only augment places where people already are but also to direct them to other places. My friend just ran down the Ninatic/Google connection. Can the app be used to direct people away from polling places and/or to congest areas around polling places?

To wit, would anyone be interested in tracking (I can do it for at least some locations) the locations of gyms in comparison to polling places? (I haven't used the app; can one get a location of gyms?)

[lol. let me clarify my interest would be in thwarting rather than harnessing this possibility.]

<comment><USER54> screw pooling places, what about locations of businesses (restaurants etc) that spend serious $$ for Google advertising?

<comment><USER53> I mean... that'd be an issue. I don't think it'd be as big an issue as widespread electoral fraud or electioneering. But it'd probably be an issue...

</comment></comment></comment><comment><USER55> Any idea how long the signup page is down? I made my account yesterday and, when forced between using my google auth and making some pokemon.com account, it was a no brainer to not use my google account. It took me a few tries but since this is a game and not something in the realm of life-and-death, I found it wasn't horrible to actually wait. And try again.

The entire issue is predicated on using your google account credentials which isn't really mandatory. Maybe I'm overly cautious but I don't use my google account to auth anywhere. If that's the only option, and it's not a google product.. then it looks like I'm not using that service.

<comment><USER10> It's been down since at least last Thursday. The way I hear it it's been much longer.

<comment><USER55> But, again, I made an account yesterday. <24h ago. So, is it _actually_ offline, or are people hitting the friendly little google button instead of just waiting? If it's the latter, then while I don't disagree about the gravity of requiring "All Perms" for a stupid game, I kind of feel like people deserve whatever happens for their impatience.

Don't just throw around account access, no matter how pervasive, in the name of impatience. Ever.

<comment><USER32> The game never asks for access, it's not clear in any way how much information you're giving them.

In the past I've tried to use Google to sign in to some games and been given a screen that I noped out of because of what it was asking for. That didn't happen here. I assumed they only got my email address (if that), not full email/contact/calendar history.

I checked my Google permissions. iOS has a fair amount, Mac OS X has a fair amount, Pokémon GO has more than both put together. Without asking. That's crazy.

</comment></comment></comment></comment><comment><USER56> Thing like this is why i dont use google, facebook etc and only have 4 apps. I love technology but it looks like hardly anyone is looking out for the consumer,let alone a non tech savvy consumer.

</comment><comment><USER57> I'm more worried about my daughter getting hit by a car (because she walks in front of it, or because the driver is playing) than I am about my google account being hijacked!

<comment><USER54> How about your daughters naked selfies leaking because someone breached Niantic and leveraged access to gdrive?

</comment></comment><comment><USER58> So the solution is to create a throw away gmail account, I guess? Or not bother playing at all.

</comment><comment><USER59> Just revoked access because the app never disclosed this information on signing up with my Google account. This is sick.

</comment><comment><USER60> I detected that immediately when I signed up with google at first. No double- checking what I was ok with sharing with the company. Had to remove their permission from my account settings right away. Signed up with their email/password system, much better.

</comment><comment><USER61> Report it here: [https://support.pokemongo.nianticlabs.com/hc/en- us/requests/...](https://support.pokemongo.nianticlabs.com/hc/en- us/requests/new?ticket_form_id=319988)

</comment><comment><USER62> On Android 6.0 I got the correct permissions dialog and I was able to select what the app sees and what it can do. Is this just me?

<comment><USER63> But isn't that what the app needs from your phone? I always thought that was difference then what you are giving an app permission to do when using OAuth

<comment><USER64> On Android they're able to use the OS APIs to access that information because the google account is closely tied to the OS so the permissions there are basically permissions to the phone data because with Android they're pretty much one and the same.

</comment></comment></comment><comment><USER65> Seem like a issue with Google Auth on iOS. I've logged into Pokemon Go from my Android and iPhone. I revoked the access of "Pokemon Go release" from Connected Apps page then logged in again from my Android phone. "Pokemon Go release" doesn't show up in my Connected Apps page anymore even after a login from Android.

</comment><comment><USER66> Where there's a security hole, there's an exploit.[1]

[1] [https://thestack.com/security/2016/07/11/infected-pokemon- go...](https://thestack.com/security/2016/07/11/infected-pokemon-go-apk- carries-dangerous-android-backdoor/)

<comment><USER67> This is completely unrelated because it isn't exploiting anything (other than humanware)

Any modified APK for any App could be loaded in with a RAT asking for full permissions. It just happens PKMNGO is popular and people are trying to get their hands on it before it is officially released in their region.

</comment></comment><comment><USER68> Wow. This game must be the fastest thing to skyrocket into worldwide popularity. Yesterday I noticed someone on social media talking about it. "Some random game pokemon fans like" \- I figured. Today it seems like everyone around the world is playing it. And it was released just a week ago? Never seen anything quite like it.

</comment><comment><USER69> This article, though rife with paranoia, brings up some interesting points.

[http://blackbag.gawker.com/pokemon-go-is-a-government- survei...](http://blackbag.gawker.com/pokemon-go-is-a-government-surveillance- psyop-conspirac-1783461240)

</comment><comment><USER70> Could you simply create a new google account for the sole purpose of playing pokemon go?

</comment><comment><USER70> Could you not simply create a new google account strictly for use with pokemon go?

<comment><USER40> One _could_ , but _will everyone_ do that?

</comment></comment><comment><USER71> Title isn't exactly accurate - can we edit this to indicate iOS only?

</comment><comment><USER72> People die doing this: [https://www.youtube.com/watch?v=B2KXVfnw4rg](https://www.youtube.com/watch?v=B2KXVfnw4rg)

</comment><comment><USER73> I got a number of permission requests at runtime the first time launching the app. If anything, it appears to be running into more of the Android 6 runtime permissions.

</comment><comment><USER74> Funny enough when I downloaded the app I didn't use my official account and I logged in with a secondary account wondering exactly about this.

</comment><comment><USER74> Funny enough, when I installed the game I didn't use my official Google account and I used my test one thinking about this. Glad I did it.

</comment><comment><USER75> kind of a scam, just a bad wording from google "full access" and old oauth workflow - but no real security threat

TLDR: Pokemon Go can't read your gmail - he checked

[https://gist.github.com/arirubinstein/fd5453537436a8757266f9...](https://gist.github.com/arirubinstein/fd5453537436a8757266f908c3e41538)

</comment><comment><USER76> I'm usingn the android version. they aren't even a connected application. so no risk in Android.

</comment><comment><USER77> So, Pokemon Go is not listed under my account... Could it be the mallware version?

<comment><USER78> Should be listed as "Pokemon Go Release" here: [https://security.google.com/settings/security/permissions](https://security.google.com/settings/security/permissions)

</comment></comment><comment><USER79> I see google Chrome gets full account access... I guess this is required? Or not?

</comment><comment><USER80> Better/more neutral title: Pokemon Go asks for full Google permissions

<comment><USER81> It doesn't ask though:

"Normally you'd see a little message saying what data the app is going to be able to access - something like "This app will be able to view your email address and name". For some reason that's not shown in this case"

<comment><USER80> You're right, "asks" isn't the correct word and I apologize.

The title could still be more neutral/explanatory, though.

</comment></comment></comment><comment><USER82> Why in the world would they do this? Or was this just merely an accident?

<comment><USER83> Niantic used to be owned by Google, so they should know what they're doing.

<comment><USER64> It does work properly on Android. It only asks for access to Location, Contacts, Camera, and Storage.

<comment><USER83> Those are just things it has access to on your phone. That's not the permissions you give it on your Google account, which might include sending email as you. Those you can find here [https://security.google.com/settings/security/permissions?pl...](https://security.google.com/settings/security/permissions?pli=1)

<comment><USER64> I checked that page already. I can only speak for myself but for me it has no listing on the Google Permissions page so it looks like it does permissions correctly to me.

<comment><USER64> I'm running Android 6.0.1 on a Nexus 6 btw.

</comment></comment></comment></comment></comment></comment><comment><USER84> I can't tell whether this game is the most heavily marketed social-media blitz of all time or truly viral. A virtual treasure hunt game finally gets people outside? Come on.

</comment><comment><USER85> Jesus Christ, They wants to catch 'em all

</comment><comment><USER86> It's a free game everyone.

When something is free to play, and involves you walking around with geo services and a camera on, you and your data are the product.

This is just massive data collection disguised as a video game.

<comment><USER32> No, they make their money through IAPs.

No one signed up to let Niantic read their email in exchange for free items.

<comment><USER86> Maybe no one on HN or in your circle of friends, but I think you massively overestimate the average user's sense of data protection.

<comment><USER32> I'm willing to bet if you put a warning that said "This app will read your email" a _ton_ of people would react. Not 100%, but a ton.

Especially parents.

</comment></comment></comment></comment><comment><USER87> I fond of e-sport. So it's interesting for me to test new game. Pokemon go stole the scene at a grate pace. But this game is a really risky for cybersecurity. Maybe we don't need such program.</comment>


State of Delaware launches blockchain using Symbiont smart contracts - <AUTHOR> http://www.ibtimes.co.uk/state-delaware-launches-blockchain-using-symbiont-smart-contracts-1553130 <comment><USER2> Will the data added to this blockchain be publicly available and auditable?</comment>


I'm 14 and looking for computer-related online jobs - <AUTHOR>

First of all, I'm not doing this for the money. It's been almost 7 years since I first started using computers and soon it turned into a passion.
And now that I am knowledgeable enough (at least more than an average user), I'm looking for "work from home" online jobs where I can practice my passion on a professional basis, while maintaining the 14 year old minimum age eligibility.
Here's a little background on me:
* I'm 14 year old, currently studying in 9th grade.
* I'm NOT from US or any other English speaking countries.
* I've been using computers since I was 7 years old.
* I can easily use Linux via the terminal, but I'm still learning shell script.
Some examples so as to give an idea of my experience:
* I can do basic virus removals and I don't use anti-viruses, just a full scan on an interval of 2 months, so far I haven't been affected.
* I tweaked my 6 year old PC to boot within 30 seconds (with XP, Linux boots much faster)
* I'm aware of the BASIC workings of the most of the technological softwares/programs/services on a wide base.
* I'm currently learning programming (python and shell scripting) I'm currently not into hardware as much as I'm aware of softwares. * Whenever any of my family members encounter any kind of computer problem, I'm the first person called for help. <comment><USER2> From what you've written a lot of the services you think you would be good at are best suited for a face-to-face interaction rather than online. There are certain trust issues about accessing computers remotely; especially for average users that are going to want your services.

As far as 14 year old age eligibility, I have no idea on the laws in your country and what that might mean.

However, if I were to offer some advice, I'd say focus on the programming aspect, as that is the easiest skill to sell online of the ones you've listed I think. There are plenty of places to sell that skill (if elance et al are an age problem - try forums/communities).

</comment><comment><USER3> I'll preface this by saying I'm a 15 year old programmer. Unless you desperately need the money, I wouldn't recommend doing menial freelance jobs like that. Instead, you should focus on learning to program. Sure, doing freelance work would get you a little money now, but you could make exponentially more in the future if you know how to program. Also, once you learn how to program, you could do freelance programming if you wanted. At least you would be learning by doing freelance programming. You won't be learning much by removing viruses.

</comment><comment><USER4> Like Ohashi said, the type of job you are looking for is usually better suiyed for face-to-face interactions. Have you considered writing a blog, or a set of youtube tutorials? You sound like a knowledgable young person, and you might be able to make some ad money teaching people how to take care pf their computers.

<comment><AUTHOR> Well, I did consider writing a blog, but there are tonnes of other sites concerning this area, well-funded and with better quality articles. So, I guess even if I give it a kick-start, I would eventually fail.

</comment></comment><comment><USER5> My recommendations:

* create a github account and start to contribute open source projects

* finally switch from windows to linux and forget about virus

* find a college in one of the English speaking counties and start collect a money for CS education

* stop thinking about job and spend all your time on education

You'll get really good job after college If you will do all this, no need to hurry to become an adult

</comment><comment><USER6> Are there any open source tools that you really like? Perhaps you can start by contributing some bug fixes (ask on the forums or IRC for some easy suggestions) to these projects? That will get your feet wet and build some confidence.

</comment><comment><USER7> Have you checked out odesk.com? I prefer that over elance.com, but either one should work. Find something you think you might be able to do, bid a flat fee and then figure out how to do it. Wash - Rinse - Repeat.

</comment><comment><USER8> I highly recommend learning SEO (<http://www.seomoz.org/beginners-guide-to- seo>). I used SEOMOZ and David Mihm's blog (<http://www.davidmihm.com/local- search-ranking-factors.shtml>) to rank a local pizza website to the top of Google for my town. I did this for free to learn how to do it. I charged money for my next client and from there everything rolled smoothly.</comment>


The weird, get-rich-quick world of dropshipping - <AUTHOR> https://www.wired.co.uk/article/dropshipping-instagram-ads <comment><USER2> Many "successful" dropshippers simply sell success. That is, they make claims about how much money they're making, and sell courses or coaching to unwitting marks. And if their marks' stores don't pan out, they an always offer the "advanced" course, the "super secret" formulas, just give me another $3000 please.

There might be a few bros out there doing well at this, that is, actually selling things to consumers, but mostly it's selling inessential products to indifferent consumers at tight margins. There's nothing wrong with dropshipping as a business model, per se, but there's a lot of hype and shadiness going on in these circles.

<comment><USER3> I am a dropshipper and average margin on products I sell is 60-100%.

I don't sell course because i really doubt I could make much money by doing that when I can just keep dropshipping.

I never bought any course but I had a startup so I am familiar with sales and how you make conversion happens.

<comment><USER4> > margin on products I sell is 60-100%

what kind of products do you dropship?

<comment><USER5> This is the one question no dropshipper will ever answer.

<comment><USER6> I remember reading an article a long time ago...

wait here it is:

[https://www.cringely.com/2009/03/14/parrot- secrets/](https://www.cringely.com/2009/03/14/parrot-secrets/)

This guy had found a niche for an online business.

I can't help but wonder how many competing cookie-cutter copies of the businesses were started the day that article was published.

<comment><USER7> Cringely is amazing. He runs his whole persona under a name that directly confessed how bad his thinking his, yet has somehow made a long career as a pundit.

<comment><USER6> Not saying he's a big fish in a small pond, but how many people consistently write about tech topics like he does?

I don't mean how many people write about tech, I mean how many people write about tech - and the _who_ , and the _why_... and the _why not_.

</comment></comment></comment></comment></comment></comment></comment><comment> j-c-hewitt This is not actually mainstream dropshipping. Not all dropshipping is from China or international in general because of the unpredictability and latency. It makes more sense to dropship from stable and predictable suppliers for products that you don't have to spend a lot to create demand for. This article could have been written in 2005 and I think a lot of the reason why many of the people mentioned are expats selling to international markets is because ad rates in the US are generally too high to support this kind of business model in the US currently in 2020.

In the US the dropshippers I work with and am very familiar with use mainstream sources with predictable shipping times as do I when I dropship a selection of items very occasionally. The course sellers would generally not be selling courses if they could be scaling their business instead. Dropshipping is not generally a high margin business whereas course selling is. A scaled dropshipping business can make a lot of money but it is not a laid back type of operation really -- it's labor intensive and generally requires some in house automation to make sure that your offers for products match the offers you have from your suppliers.

GRQ dropshipping seems exciting and sexy because you never have to take possession of the inventory and you don't need to put a lot of cash up front if you get paid fast enough. Normal dropshipping is as boring as a wrench or a hammer. Also this article sort of conflates private label dropshipping with dropshipping more generally. They are really quite different things. The typical private labeler takes possession of products here in the US and probably does not dropship the bulk of their stuff just because customer expectations are pretty high for delivery speed and predictability. If you are sourcing from AliExpress or what have you, it's just a lot easier to suck up the unpredictability as the seller and then to sell it to the final buyer with more predictable fulfillment without dropshipping.

<comment><USER8> Also, dropshipping is something that many brands offer to retailers.

Like if you buy a Patagonia jacket from Nordstrom, it might be sent directly from a Patagonia warehouse instead of a Nordstrom warehouse.

<comment><USER9> Amazon did this for years. Brand products were listed on Amazon and pushed directly into the brands operations system when sales came through.

</comment></comment></comment><comment><USER10> I have had two relatives get roped into this world - one ended with them forgetting they had to pay sales tax and owing massive amounts of money, to the tune of millions in back taxes, the other fizzled out pretty quickly.

The craziest part of it was they totally bought into the "super secret" nature of the whole thing. There was a huge amount of family drama when someone in the family mentioned that her brother had a business on Amazon. He said it was top secret and he had access to trade secrets that no one else had.

Having unfortunately been involved on the tech side of MLM early on in my career, it was painfully hard not to point out the predatory nature of the whole thing.

<comment><USER11> I remember reading about dropshipping in the 4hww, and eventually coming to the conclusion that it just sounded too good to be true, and usually if it sounds too good to be true then you should avoid it.

<comment><USER12> Dropshipping might have worked as a decent side-hustle when the 4HWW was originally published many years ago. I think the space became flooded to the point where I concluded that it was impossible for an ordinary person to make decent money. It's probably also become much, much more predatory since then. It's more lucrative to sell dropshipping advice than it is to do actual dropshipping.

</comment></comment></comment><comment><USER13> I spent a while in Thailand and the dropship-bro "digital nomad" culture is just everywhere. During burning season the Chiang Mai dudes would come down to the islands and the rest of us expat/nomad types would bail to avoid them. Lots of Tim Ferris cultists and so forth, though there were also a lot of sincere people just trying to get out of the rat race. All chasing the four hour workweek thing. It's a weird subculture.

<comment><USER14> I know this sounds dramatic but these types have practically ruined staying in hostels for me. I used to love hostels because of the types of people you would meet, all of them vastly different in most ways but all united by a common desire to travel and see the sights of the place you're visiting. If someone _were_ to talk about work, it would be to say that they are taking an extended vacation from it or working as a part-time bartender or travel guide, but they certainly wouldn't brag about it.

But the last couple of times I've gone backpacking in Southeast Asia, you can't go to any hostel common area without at least a handful of nomad-bros on their MacBook and a Chang bragging to anyone nearby about "yea I'm a digital nomad, I'm making so much money even while just chilling at this bar". A lot of them have somehow turned the travel aspect of the culture into "just part of the job", as if the only reason they are traveling is because " _working and_ traveling is cool", rather than simply "travel is cool".

<comment><USER15> Are you sure you're not just rebelling against the new? Like in the past most people had to separate work from travel but now there's this new thing "digital nomad" that lets lots of people work from anywhere and they're enjoying this new freedom that used to be available to a lot less people?

<comment><USER14> My point that I'm having a hard time expressing is that these dropshippers do not seem to be "enjoying this new freedom" in the way you imply. As in, they aren't people who wished to travel, were previously unable to do so because of work commitments, and now are able to enjoy travel because of extra work freedoms.

The majority of "nomads" I've encountered seem like they are mostly uninterested in travel, but they do it anyway because that's "what you're supposed to do" if you're a nomad. This leads to a bizarre culture where talking about the places they've been becomes more of a "digital nomad resume" than it does a recounting of enjoyable travel experiences. Instead of "I went to the Batu Caves and it was gorgeous, they have such interesting architecture there!", it becomes "yea I've been to the Batu Caves, there's a really nice cafe with good wifi just outside that I used to work from".

Have you ever had a conversation with a professional consultant and they have this weird habit of bragging about waking up at 4am to catch flights to NYC, and the only thing they ever tell you about NYC is how nice the Midtown Marriott's beds are? It's kind of like that.

<comment><USER16> Totally. I see it as just an extension of the 80's Yuppie. Instead of Patrick Bateman's friends bragging about the restaurants they go to (without even really caring about the food), their stereo equipment (while having absolutely zero taste or authentic interest in music), whatever, now it's bragging about where they travelled to and whatnot.

It's inane peacocking. Virtue signaling without any virtue. Etc. Yuppies never die.

<comment><USER17> Someone should turn that into a new book/movie. This persona needs it.

<comment><USER18> I have a short story about a guy like this. In the story, he's an independently wealthy Instagram rooftopper type. He gives the impression that he lives off money from streetwear/etc comp deals, but actually makes hardly anything from that, and he has been kicked out of Hong Kong for climbing on buildings. I should dig it out and finish it properly.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> I somehow knew this was going to be about "rich kids of Instagram" before even opening it. The part about renting and posing with the Lambo is tragic.

<comment><USER20> Apparently there's a whole side industry around renting out sports cars and other bling to people making hip hop videos.

Now _there 's_ a growth market

<comment><USER21> Speaking of which I used to watch MTV Cribz back when I was a kid. The cars were rented, and the homes apparently never even belonged to the celeb. Was all manufactured, which I understand given the amount of crazies, celebs would not want to show off their homes. And the cars being rented to maintain their status.

<comment><USER22> I was watching an episode a while ago (forgot which one) where it was obvious the two rappers had never even been in the house before, like having to look around what sort of room it was before saying 'this is the lounge' or whatever. There was a picture of a sail boat that they looked at for a bit, slightly perplexed, and then said 'yeah this is a picture of a boat because we like boats' or something like that. It was hilarious.

<comment><USER23> The Cash Money Millionaires episode was totally like this. Big empty mansion with generic decor and the requisite shiny cars parked outside.

</comment></comment></comment></comment></comment><comment><USER24> Worth noting that dropshipping is not particularly new nor particularly the province of undercapitalized mom-and-pop operations. Some of the largest retail/wholesale companies in the world also dropship; it's an obvious thing to do if you own a channel, don't want inventory risk, and can put up with the substantial challenges involved.

(I learned the word in 2000 when working for an office supply store, which was happy to take inventory risk on paper or printer ink but did not want it on $X,000 pieces of furniture, so if you ordered them they'd arrive at your door straight from the factory.)

<comment><USER25> It was also a way for small timers to get into mail order business without an inventory.

Of course it meant thin margins, especially if you were getting print ads as well, but some people got it to work.

</comment></comment><comment><USER26> This kind of "journalism" that drips with judgement in every sentence makes Wired look like a cheap tabloid.

<comment><USER27> Dropshippers are literally rent-seeking [0] middlemen, though, and their actions are contemptuous on the surface, for the harm done to consumers. In addition, it seems like their relative wealth is creating wealth inequality in some Southeast Asian locales, which is the calling card of neocolonialism [1].

I don't see why we shouldn't judge marketers harshly, in general, and these folks in particular seem particularly unctuous.

[0] [https://en.wikipedia.org/wiki/Rent- seeking](https://en.wikipedia.org/wiki/Rent-seeking)

[1] [https://en.wikipedia.org/wiki/Neocolonialism](https://en.wikipedia.org/wiki/Neocolonialism)

<comment><USER28> Drop-shipping is not rent-seeking, any more than any retailer or wholesaler is rent-seeking. Is anyone you buy from other than the direct manufacturer a rent-seeker?

From WP:

 _Rent-seeking is an attempt to obtain economic rent (i.e., the portion of income paid to a factor of production in excess of what is needed to keep it employed in its current use) by manipulating the social or political environment in which economic activities occur, rather than by creating new wealth. Rent-seeking implies extraction of uncompensated value from others without making any contribution to productivity._

Drop-shippers don't manipulate the social or political environment, and the value they provide is the same as any retailer. They just don't take on as much risk or physically handle the goods. It's a sales and marketing business only, and margins are both more volatile and slimmer on average as a result.

<comment><USER27> I think that you're overestimating what dropshippers actually provide to the economy. Like Instagram-style influencers, dropshippers are ultimately advertisers; they create consumerist desires where none previously existed.

To quote from "Office Space":

> Bob: So, what would you say you _do_ here?

> Tom: Well look, I already told you! I deal with the goddamn customers so the > engineers don't have to! I have people skills! I am good at dealing with > people! Can't you understand that? What the hell is wrong with you people?

Just like Tom, dropshippers are redundant at best and harmfully interfering at worst.

<comment><USER29> There's value in advertisement. No more behaviorist mumbo-jumbo for you, the mind creates desires, external circumstances do not.

</comment></comment></comment></comment></comment><comment><USER30> Has anyone on HN done any dropshipping? What was your experience?

<comment><USER31> I dropshipped from 2001 to 2004 in the jewelry market.

I never really set out to do it, just stumbled into it. I had a friend in the jewelry business that tipped me off on the potential so I started exploring the opportunity. I was in college and thought it an interesting real-world challenge compared to what I was working on in my classes. It ended up paying for my graduate degree and then some.

This was years and years before turnkey solutions. So I built my own. Everything was held together with ColdFusion MX 6, which I was a big advocate at the time and into that dev meetup scene.

After 6 months of development putting in tons of late night hours, things were fairly automated. I would scan daily email reports and any process exceptions, too, were emailed to me. I never achieved astronomical volume, but it made a decent chunk of change. Just ran on cruise control sustaining me and my family through graduate school.

I was an early integrator with the jewelry dropshipper. Orders and order status was communicated over FTP. Cue batch processing jobs. They are still around btw. At the time, they supplied most brick and mortar jewelry shops. Probably still do.

This, of course, was before social media of any kind, so my channel was eBay. I was an early integrator with eBay's new API built on something called SOAP. :) I hated it, but after complaining in their dev forums, eBay paid for travel and hotel to their conference in 2002(?) to give feedback in a private session with their developers. I have to give them credit, they were really trying hard to keep things simple and were sincere.

There wasn't anything like Stripe at the time, so I was one of Netsuite's first (very) small business customers just as they were beta testing online payments (iirc backed by Authorize.net). NS had a comprehensive CRM, order fulfillment, etc. solution. It is funny to think that NS was actually cheap relative to other offerings. Open sourced a ColdFusion implementation of the integration and a ColdFusion framework ( bothhosted on tigris.org... anyone remember that?). Both had users for a few years.

I built an e-commerce website (I sometimes go browse it still on WayBackMachine to reminisce) to try to steer purchases away from eBay to avoid fees. Was navigating the gray area of auction, buy it now, and linking back to my site. Sometimes would get reported for policy violation.

In the end, I didn't have budget to market outside of eBay, nor the entrepreneurial spirit to grow it, nor the inclination to bring in investors. My heart wasn't in it once the technical challenge wasn't there. A pattern I've unfortunately repeated over my career.

After my graduate degree, I sold it all to a local jeweler and transitioned it to them. They ran it for a few years to supplement revenue that their brick and mortar store was starting to lose because of online jewelers. I got paid for periodic work to fix a bug here and there. They shut it down in 2009 when their store went under. :(

Overall, it was a fun run. I learned a heck of a lot early in my career.

<comment><USER32> Thanks! These posts are why I'm on HN

</comment></comment></comment><comment><USER33> ...claims to have made "around 400k, I guess" in his dropshipping career. (When asked to provide evidence, he told me that he didn't keep records. ... I don't understand how a this youtuber person can get successful?! Is it his speech, his appearance or some other magic?

<comment><USER34> Another typical online scammer scamming people. Nothing new to see.

</comment></comment><comment><USER34> I am tired of seeing sleazy scammy dudes making money or pretending to make money with weird Instagram and youtube channels.

And people are dumb buying into their scam. It takes 5 seconds for us to see it, why can't average person see their bs from a mile?

</comment><comment><USER35> There used to be a time when products and innovation made in America were deemed high-quality and highly desired for. I am talking non-software.

Here we are talking about people who make a living out of cheap potentially slave labor and to top it off, selling courses to others to be a marketing/ecommerce snakeoil salesperson.

Truly disgusting to think about what we are turning into as a society.

Is there a future in which manufacturing would ever return to the US? Legit question....

</comment><comment><USER36> _"...explains one digital nomad over the fart of hot tub jets in Amo, a luxury spa."_

This is a unique way of describing the sounds of a hot tub.

</comment><comment><USER37> [http://archive.is/fJ195](http://archive.is/fJ195) No stupid cookie popups

</comment><comment><USER38> > 2015, the year Facebook Ads Manager was launched but before dropshipping got > big.

Is this right? I was definitely using Power Editor prior to 2015, and am almost sure that Ads Manager predated it.

<comment><USER39> What is Power Editor?

</comment></comment><comment><USER40> I used to have a ecommerce website with 50k USD of monthly revenue.

I am very bearish on the future of this industry, with de-globalization, trade wars and the ever expanding reach of Amazon.

</comment><comment><USER41> I suggest maybe there's a huge difference between true 'drop-shipping' and literally creating a product for export.

You don't need to 'touch the product' to become a business.

Selling a commodity product is like having a little store on the web.

Running ads and the shipping right from some regular retailer, the most 'pure' form of drop-shipping is really just price arbitrage, this will always exist but I can't imagine for too long.

Working with a factory to develop a product, marketing it, and selling it, well that's a regular business.

</comment><comment><USER42> How come the people doing this don't get hammered on chargebacks and refunds ? What payment platform is willing to put up with them ?

<comment><USER43> They are providing real products, as advertised, and usually process refunds etc honestly. While quality and service aren't likely to be amazing, I doubt they get scam-levels of chargebacks.

Besides, payment platforms don't mind if there are chargebacks and refunds. _They_ still get paid.

</comment></comment><comment><USER5> I did drop shipping and retail reselling as a hobby to earn a few million airline miles, AMA.

<comment><USER44> You got paid in airline miles?

<comment><USER5> No, still made money on the products but the goal was buying high dollar items with rewards cards from retailers that offered points bonuses.

</comment></comment></comment><comment><USER45> I ordered some boxed EPYC processors from an East Coast online shop who dropshipped OEM/tray processors from Ingram-Micro (a large US wholesaler of computer parts used by many small stores) thinking I wouldn't notice the difference. Either the store or the dropshipper substituted cheaper parts that don't have a warranty, so I turned around and sent them back. They can both finger-point to each other if anything goes wrong. Complete waste of time and credit card space.

In my view, a successful company should own as much of production, supply, distribution, sales, and support as close to the customer's last-mile as is pragmatic. For example, Moen (US market) plumbing fixture products seem to have excellent customer/tech support, documentation and parts dispatch. McMaster-Carr, a commercial parts and tools supplier, carries zillions of hard-to-find SKUs and dispatches them quickly. I can't see how outsourcing the most vital departments to the lowest bidder does anything but introduce potential risks for organizational self-immolation.

</comment><comment><USER11> I feel like we should talk about how immigrants get to re-title themselves as expats if they're rich enough. That doesn't sit right with me.

<comment><USER46> They do? An expat by definition is a citizen of another country living abroad. An immigrant is someone who changes citizenship.

<comment><USER11> Ah, I was not aware of that difference.

Edit: hold on. I have several colleagues who are foreign citizens in America on visas; and I've never heard of them being called expats. I feel like I only ever see that word when applied to Americans or British citizens moving to cheaper areas of the world.

<comment><USER47> A hidden comment makes a good distinction:

> Think the difference is that an expat makes his wealth from outside that > country he migrated to and Immigrant makes money from the country they > migrated to.

None of this stuff is an official definition, but this seems to be how most people essentially mean the term, or rather what happens to be true when they use it.

I'm basically a permanent traveler. I might spend years at one location working remotely. Calling myself an immigrant really seems to lack some important distinctions that explain my situation compared to a visa worker.

Even when I'm technically an immigrant and an expat is just an expatriate, there's more nuance to how we use the terms. And to me it comes down to power: when my fun is over, I just buy a ticket home.

<comment><USER48> > Think the difference is that an expat makes his wealth from outside that > country he migrated to and Immigrant makes money from the country they > migrated to.

I don't agree that this is at all universal, I moved to a (marginally) more expensive country for a local job, and am still definitely considered an expat. And while it's not an official term, there are plenty of companies targetting people like me, "expat mortgages" and so on. For them they can target their market, for us it means that we know they'll be good enough speaking professional English.

> And to me it comes down to power: when my fun is over, I just buy a ticket > home.

This rings more true however. I think if you still have some feeling of "I'm likely to go back some day", rather than putting effort in to learning the language, making local friends, and possibly putting down serious roots, that's more expat-like.

<comment><USER49> The distinction is not so much about source of income as it is about the reason for their relocation, in my experience. Expats come to a country more so for adventure than opportunity. Not to say they can't thrive there and integrate closely with the culture, just that it wasn't really a relocation driven by necessity.

</comment></comment></comment></comment></comment></comment><comment><USER50> > western immigrants – expats, as they prefer to be known

Made me chuckle.

<comment> Anthony-G I've noticed that British and American migrants usually refer to themselves as expats while most other nationalites that I've spoken to refer to themselves and/or their fellow citizens as migrants when living and working in another country. It kind of bugs me; it's as if there's an unspoken assumption that an expat is better than a regular migrant who may have uprooted themselves from their native land due to economic necessity.

Disclaimer: I'm Irish and spent a couple of years as a migrant worker in other European countries during the mid-90s – mostly to get a better cultural understanding of what life is like for our fellow European citizens.

<comment><USER41> Expat and immigrants are usually completely different categories. Technically both are 'migrants' but it wouldn't be the best term.

If you work for a bank in Ireland and they ship you off to Germany (or wherever) for a 2-year stint, you're an ex-pat.

If you marry a woman from Germany, move there, and start your citizenship process and plan to live there, 'immigrant' is a good term.

In between, it's gray.

<comment> Anthony-G Thanks for the clarification on the usage of those terms. I grew up in the 80s where emigration and the plight of Irish emigrants were hot topics. Thankfully, the economic situation had improved by the time I reached adulthood so migration was a choice but it was still many years later before I came across the term, "expat".

</comment></comment></comment></comment><comment><USER51> 1990 called, they want their business model back.</comment>