There isn't a lot of information. I believe there are some white papers in progress. But the other poster is right: it is based on XSRF attacks and screen scraping.