Mobile apps: An Achilles' heel for web security?

The report demonstrates that JotNot Scanner Pro stores authentication credentials (Evernote, Google Docs, iDisk/WebDAV) in cleartext within its com.mobitech3000.JotNotIPhone.plist inside iTunes backups, meaning an attacker with access to a user's backup can obtain usernames and passwords and potentially access linked services; the author uses this as an example of wider mobile app security failures and urges better developer practices and token-based APIs.