[mdaniel]

Seeing that reminded me of this recent onoz, which one should fold into their threat model: https://trufflesecurity.com/blog/google-oauth-is-broken-sort... <https://news.ycombinator.com/item?id=38670644>