Right? I'm also curious about the fix. The vulnerability he describes is most obviously that they fail to associate the token you get after login with an actual account, so you can re-use that token to bind an arbitrary account, but binding to a device ID is also problematic, because that information isn't inherently private. Another app could harvest it and be compromised which then leaks the info, or it could be exposed in some other way because it's not unique to their application.