So let's summarize: 1. The AuthToken's are easy to sniff 2. Hard for the end user to fix and require code changes to fix completely which may not be available

So let's summarize: 1. The AuthToken's are easy to sniff 2. Hard for the end user to fix and require code changes to fix completely which may not be available for your model of phone from your carrier 3. Valid for 14 days 4. "the adversary can subsequently use the captured authToken to access any personal data which is made available through the service API. For instance, the adversary can gain full access to the calendar, contacts information, or private web albums of the respective Google user. This means that the adversary can view, modify or delete any contacts, calendar events, or private pictures. This is not limited to items currently being synced but affects all items of that user." And in conclusion not a big deal and we should ban the register for spreading such vicious truths. And we know all of this because of our love of god.