what worries me, and is related to the issues described in that article, is that the various examples i've seen don't seem to be secure. the path loading was via https/tls but seemed to be (from the description given at the time) vulnerable to a simple mitm attack. that means that the server certificate was not being validated correctly. another example (can't remember the company) was using http.

in both cases, a clued-up governmental agency could read the data. as the article says, this can be a big fucking deal.

tldr: if you're going to abuse people's privacy, at least do it right.

[it's possible that the tls case involved loading a new trusted certificate onto the phone before the attack; i did check for that when i read the description and couldn't find any mention, but if that's the case then the loading would be secure - although even then, it might have been possible for path to hard code details of which ca they trust.]