So wait, is the only security on the pass information based on the device id being not commonly known?! Wouldn't a simple MITM attack ruin all the fun? Or is t

So wait, is the only security on the pass information based on the device id being not commonly known?! Wouldn't a simple MITM attack ruin all the fun? Or is this meant to be used over https with device-specific certificates?