You can perform your attack in a number of different ways to achieve this, but setting up a free wifi hotspot near a Tesla super charger allows you to target and harvest several such usernames and passwords with very little effort.
Disclaimer: I work for Promon. Feel free to ask me about the attack.
>Promon engineers recommend that the Tesla app provide two-factor authentication, should avoid storing the OAuth token in cleartext, prevent easy access to its source code, and use a custom keyboard layout when entering passwords to fight against mobile keyloggers.
Security by obscurity?
Disclaimer: I work for Promon. See our blog post: https://promon.co/blog/
http://www.bleepingcomputer.com/news/security/android-malwar...
If the Author of the bleepingcomputer.com article has misunderstood your findings and conclusions and is reporting as yours something you didn't recommend, you should let him know and ask for a correction.
Why? What additional security would encrypting it with a key that's on the same device give you?
Are you performing an MITM attack from the WIFI hotspot?
And, you're right. Once we have access to the phone we can probably do a lot worse than just stealing a car.
When it comes to banking apps, they often have mitigations which would require a lot more targeted effort.