That's a great plan - we now just need to convince every website and web service (and whatever else your phone authenticates with) to update their authentication method to use these access tokens.

So are you going to phone Apple and ask them to change their website/ITMS/iCloud/DeveloperCenter password/authentication system? No? Neither am I.

Samsung storing the passwords in cleartext is lazy, but if the assumption is "you can only read that cleartext file if you've got root", since a consequence of having root means you can intercept anything the user does anyway, it's _maybe_ an excusable decision. I'm quite surprised they didn't choose to use a passwordsafe/keypass/lastpass/1Password style encrypted storage format though. It's not exactly rocket surgery…

(I wonder how that file appears on backups though? Does Android by-default encrypt backups? I know iPhone _can_ encrypt them, but doesn't by default. This file could be quite dangerous if it's sitting on a lot of people's laptops/desktops unencrypted...)