That implies that the play store isn't connecting over a secure connection and is actually spoofable right? Which would be a security blog post in itself.