Essentially no client side app can be considered able to keep secrets. I would be interested in the implications of this from the authorising servers perspecti

Essentially no client side app can be considered able to keep secrets. I would be interested in the implications of this from the authorising servers perspective. Here is the main mention of it in the OAuth spec: http://tools.ietf.org/html/rfc6749#page-52 http://tools.ietf.org/html/rfc6749#page-52 and google's interpretation: https://developers.google.com/accounts/docs/OAuth2InstalledApp https://developers.google.com/accounts/docs/OAuth2InstalledA.... Even though google say "t is assumed that these applications cannot keep secrets" I can't quite infer the actual implications of this?