I don't get this:
> Nothing I did would technically be considered an ‘exploit’
Erm, yes it can? It's exploiting a glaring vulnerability in Google's auth flow, or at the very least a dodgy way to expose master tokens.
> Nothing I did would technically be considered an ‘exploit’
Erm, yes it can? It's exploiting a glaring vulnerability in Google's auth flow, or at the very least a dodgy way to expose master tokens.
It led to outcry from people who have custom compiled browser builds that were also caught up in the restrictions.
I'm surprised a limited time + per app + per user code isn't used, where limited time is enough to be useful for app purposes but not worth storing for long enough to be swept up in some data grab.
Scope limited is far better, and something android is bad at. I suspect they are highly constrained by the need to maintain compatibility all the way back to Android 1.0.
In my opinion, they should drop support for old android versions by default, and if you want the ability to sign into an old non-updated device, force you to go to a real browser and enable some option like "allow insecure devices".