OAuth is broken by design. Among many other serious issues, it's ridiculous that Twitter and other major OAuth adopters still implement it in a manner that reli

OAuth is broken by design. Among many other serious issues, it's ridiculous that Twitter and other major OAuth adopters still implement it in a manner that relies on native/mobile client applications uniquely identifying themselves with "secret" keys that are trivially easy to extract. It's deeply unfortunate that so many of the people involved with the spec chose to shout down critics and hand-wave away serious concerns until it was too late to fix the problems. OAuth 2 should have provided an opportunity to address the issues, and instead it just rubber-stamped many of the worst practices used by implementors.