[stavros]

If evil.com requests access to manage my Twitter account, and it fools me into accepting, why does it matter how the token is transported? Evil.com now has access to my Twitter account.

[mjg59]

Twitter would need to approve the evil.com app.