third party backend services should not get access to wasteof user passwords/tokens. not sure if thats whats going on with wasteofplus, but it kinda looks like it.. wasteof.mobile is client side only, which is why it asking for username and password is acceptable, but no third party serverside component should ever have access to a user’s wasteof token or password.