> This author doesn't seem to understand basic security. This seems like an overly broad (not to mention hurtful) way to disagree with a technical assessment.

> This author doesn't seem to understand basic security. This seems like an overly broad (not to mention hurtful) way to disagree with a technical assessment. And really, I'd say that part of "understanding basic security" is understanding that there's value in multiple layers of security. OAuth1a+TLS provides two separate defenses against impersonation attacks, while OAuth2+TLS only provides one. There are many ways that TLS can fail in practice, and only OAuth1a stops impersonation attacks if that happens.