> Do native apps really use third-party authentication services? That would scare the shit out of me too. I would not underestimate the callousness of someone

> Do native apps really use third-party authentication services? That would scare the shit out of me too. I would not underestimate the callousness of someone chasing revenue one or two dollars at a time. I see this all the time in Android applications, digging around with AndBug [1] -- just set a hook on various apache.http.client.HttpClient methods, and watch the interactions. [1]: https://github.com/swdunlop/andbug https://github.com/swdunlop/andbug