From c3fb1165df74aa3e3a8ce18983f4c05721632780 Mon Sep 17 00:00:00 2001
From: Lars Wirzenius <liw@liw.fi>
Date: Sun, 31 Mar 2019 18:50:47 +0300
Subject: Add: note the browser is insecure

---
 yuck.mdwn | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/yuck.mdwn b/yuck.mdwn
index 3c81250..472504b 100644
--- a/yuck.mdwn
+++ b/yuck.mdwn
@@ -230,7 +230,9 @@ authentication.
   to authenticate themselves).
 
 * The facade holds the access token on behalf of an authenticated end
-  user.
+  user. The access token can't be given to the browser, since the
+  browser can't be assumed to be highly secure, from the point of view
+  of the relying party.
 
 * The facade talks to a backend, giving it the user's access token as
   proof of authentication and authorization.
-- 
cgit v1.2.1