Thread:Talk:OAuth/Desktop apps and the lack of client secrets to verify who's asking for permission