>That doesn't sound like they were using SSL for authorization. Not for authorization. As explained in the article, the man-in-the-middle attack was successful

>That doesn't sound like they were using SSL for authorization. Not for authorization. As explained in the article, the man-in-the-middle attack was successful because the app didn't use SSL pinning. This allowed for them to decrypt the traffic between the app and the server; they could then view the API calls and get an understanding of how it worked. The traffic would have otherwise been encrypted.