> what is the difference between a token in a piece of code on the desktop and code on a server to third-party attackers, other than the server is a much more a

> what is the difference between a token in a piece of code on the desktop and code on a server to third-party attackers, other than the server is a much more attractive central location to attack so that you compromise everyone at once? Unlike servers, end-user machines are supposed to execute third-party code not vetted by the developer, which makes for a pretty stark difference as to attack surface. > A lot of effort is spent on trying to identify a client as trustworthy and in preventing exfiltration of tokens Read linked documents. The relevant RFC explicitly states that no token bundled together with a native app can be considered “secret” and preventing its extraction is not a viable security measure.