Some good points all around -- I've made edits trying to better frame the scenario. >Generalist audience point That actually was a rephrasing of my original d

Some good points all around -- I've made edits trying to better frame the scenario. >Generalist audience point That actually was a rephrasing of my original description. The point about malicious sites -- phishing sites -- is that those are the sites (or compromised sites) that will serve links with the bad redirects. Co-existing with an XSS flaw not-withstanding (which has happened before and is realistically the best vector to get to alter the links), I don't think it's unfair to frame this as something that happens as a result of clicking on a bad link from a site that is either malicious or has been hacked. Obviously, there are exceptions -- and I'll make that more clear -- but I'm seeing it framed as if "every Facebook login you click could be hijacked" -- and that's just not true. >To the ESPN point Right -- if ESPN gets hacked or an XSS flaw takes place to append their links and redirects happens -- that's definitely a real problem. That's why some of the onus is on ESPN, to make sure they define their URI redirects in OAuth 2.0. It's also why Facebook should make it an absolute requirement for using Facebook login. Not to mitigate the fact that this is a real flaw at all - but I think we can all agree this isn't some new discovery. It's a well-known problem. Calling this the new Heartbleed won't make it any better.