Actually, the notification tokens are a bigger threat, because they allow imposters to send notifications to apps. We know this from our own experience: http://www.ikangai.com/news/udids-leaks-and-push-notificatio... However, there is also a good thing: sending notifications with the tokens from the data can be used to identify the apps which collected the UDIDs.