2017-12-05 UTC
# 
sknebel aaronpk: https://indieauth.net/spec/#preventing-phishing-and-redirect-attacks looks good btw. Something I've considered in the past was keeping track of known client_ids and their redirect URLs and show them differently, not sure if that's worth suggesting in the spec tho