content: You don't need the user's password. If you can get their token (via a phishing or drive-by exploit) then you can preform the man-in-the-cloud attack (the "new" exploit) against the user. There is still work required on the hacker's end (getting the token), but it's easier to get a file than a password. It's big news in the sense that, the convenience of having the token (so you don't need to log in every time) provides a major loophole in the security of cloud storage, most cloud storage services allow for this, and it seem that the only difficult part is getting the token itself.