The obvious joke, how long has Facebook been using this exploit?
The 90% of non technically-savvy Android users are 100% exposed to the OP exploit.
Motorola are assholes and now prevent you from using pm to disable any of their malware loader apps on most of their phones.
The article mentions that "the attacker renders something transparent in front of the target app". I would have thought that sort of thing would require the "appear on top" permission.
They were caught exfiltrating data fron phones, with no visible Facebook app installed, only the background one.
Edit: IIRC the original argument was more reasonable, but it has since been abused in all kinds of situations to make low effort putdowns, like this one.
I think it speaks about the security of Android that this makes the news. Coming from Windows, Android always felt as a MUCH more secure Operating System, not just a similar quality Operating System with touch controls and support for smaller hardware.
This doesn't apply in this case, as (usermode apps') screen capturing does require permission, and applications can specifically opt-out from being captured by apps even with that permission, which Google Authenticator does have set. So a trust boundary is being violated, therefore this is a legitimate security issue by his logic.
PD: I just checked and it also doesn't change the color of the pressed keys or any other visual feedback that an attacker might use.
First it requires the user take buckets of ammonia and bleach and mix them together.
As Raymond Chen/Old New Thing likes to say this rather requires being on the other side of this airtight hatchway. You can allow apps to do things on your device.