I still cannot follow your line of thought. If a user had FourSquare (or Parse) installed during the time of the vulnerability, that exploit would've worked. M

I still cannot follow your line of thought. If a user had FourSquare (or Parse) installed during the time of the vulnerability, that exploit would've worked. Maybe hidden in an obscure (partly useful? Wallpapers of a hot movie at that time?) and simple app. Although the user 'just' logged in to known apps and services on his very own device. So your argument about not entering credentials on random devices seems off to me. The one about not installing each and any application out there is correct and spot on, of course.