OAuth Demystified for Mobile Application Developers [pdf]
research.microsoft.com