Out of curiosity doesn't this just mean the user access token and user access secret are in plaintext? Aren't those useless without the app token/secret -- so i

Out of curiosity doesn't this just mean the user access token and user access secret are in plaintext? Aren't those useless without the app token/secret -- so if the app is encrypted and you can't run strings to get those your only vector of attack is still through the app itself right? I'm not a security expert.