"revocable, fine-grained access to whatever subset of operations is required for the service in question" This is exactly what is needed, and what the current

"revocable, fine-grained access to whatever subset of operations is required for the service in question" This is exactly what is needed, and what the current "OAuth doesn't solve Phishing!" response misses.