Quote from: BoXXoB on December 01, 2016, 11:26:05 AM

Quote from: RHavar on December 01, 2016, 05:38:16 AM

Quote from: alexbilodeau on December 01, 2016, 04:19:56 AM

I just read this post, I still don't understand how the app owner can get the user token without malicious code!

The app owner is always given the token. And besides, the app doesn't even need the users token in order to access the money. (It can directly access it itself). Only put what you are willing to trust in an app (as it's clear by the warnings) Grin

Although the important thing to note, is if you put X in an app, the app can steal up to X. But it can never undetectably do so. i.e. It can never rig the bets. But it can bet without you authorizing it to. And it can transfer without you authorizing it to. However, if it does nasty stuff like that, at least you'll know it. (But you'll still lose your money).

Guess the fact that it's always detectable is a deterrent for most sites. However it's of course still possible for new sites to do so as its sole purpose. Luckily most sites are popular enough so that it's not worth it at all for them to do anything shady.

As part of the app approval process we do our best to weed out those that pose a risk. We also constantly monitor apps to make sure our users remain safe from any scams.