Also interesting is that Google will soon not require a client_secret parameter for installed applications[1], as it is impossible to keep secret. This is techn

Also interesting is that Google will soon not require a client_secret parameter for installed applications[1], as it is impossible to keep secret. This is technically legal according to the spec, which states that "the client MAY omit the parameter if the client secret is an empty string"[2]. [1] https://groups.google.com/d/msg/oauth2-dev/HnFJJOvMfmA/JzZ8JA717BYJ https://groups.google.com/d/msg/oauth2-dev/HnFJJOvMfmA/JzZ8J... [2] http://tools.ietf.org/html/rfc6749 http://tools.ietf.org/html/rfc6749