Yes I don't know of any good solution for client side only applications. And it's a real issue I think. For instance if I have your key, it may be possible for me to access data, post on behalf, etc... of people who signed in with the service on your application
Some APIs should be accessed from your backend, not the app (eg the user can authorize you on Facebook without you sharing your API app secret).
The paper also says they found amazon tokens, with which you can spawn instances. I think you can use other kind of authentication that don't give access to the whole account.
Actually if you push the reasoning in the article a bit it can make sense.
When they buy the company, they buy:
- the users and the revenue (which may be losing money for growth as explained)
- and also a product that should be easier/cheaper for them to sell to their existing customers. So they can have a very cheap batch of customers that grows their revenue a lot without increasing their upfront cost too much
-> it's like the up-sells/upgrade in the article: it's much cheaper to acquire but makes the same money
(
eg:
- you have 1M clients
- you lose money because it costs you 1.5R to acquire a customer and you're growing
- the company buys you with 10M clients, and it's only 0.1R for them to sell it to these clients because it's an up-sells/upgrade
-> they'll make money with your product even if you can't!
)