Researches have identified vulnerabilities that allow authentication token replays from Android devices. Anything using Google auth tokens that plays them in the clear (non-https) is vulnerable to this attack.
The fix is for the apps to use https (and, my suggestion, actually verify the host certificate rather than assuming it's valid, but hey).
Have fun, kids!
Monday, May 16, 2011
Subscribe to:
Posts (Atom)
