>Promon engineers recommend that the Tesla app provide two-factor authentication, should avoid storing the OAuth token in cleartext, prevent easy access to its source code, and use a custom keyboard layout when entering passwords to fight against mobile keyloggers.
Security by obscurity?
Disclaimer: I work for Promon. See our blog post: https://promon.co/blog/
http://www.bleepingcomputer.com/news/security/android-malwar...
If the Author of the bleepingcomputer.com article has misunderstood your findings and conclusions and is reporting as yours something you didn't recommend, you should let him know and ask for a correction.
Why? What additional security would encrypting it with a key that's on the same device give you?