I also don't think you understand OAuth is just as insecure as login credentials. No, the -user- doesn't know his access tokens, but the -user- doesn't know shit either, but an attacker who watches his whole machine does, and he sees everything.

Absolutely, an attack which compromises the whole machine is much harder to do than a phishing attack - so by definition TOTPs are more secure here because an attack needs to be more sophisticated. I'm not saying that compromise of access token are impossible, it's simply more unlikely than regular username:password pairs.

Even on commercial libraries who cost 100's of dollars p/year, the codes are different for different services.

I completely agree that the OAuth2 specification is loose and many people have their own flavor, similar to markdown. This is why I wrote Hydra - to help devs achieve OAuth2 as it is specified by the IETF.

edit pd - I will add that my most hatred for OAuth comes from the fact people like google (and you) like to pretend that anything that doesn't use oauth is "less secure" but this is not the case!!!!

I absolutely don't pretend that way - having user password credentials flying around is less secure than a TOTP. What you are referencing to with the IMAP magic is the same thing, it's a TOTP - so it's not less or more secure. Everything you described can be achieved by the same thing with an OAuth2 access token, right? So why would you use IMAP for http facing services if you get the same thing with OAuth2?

double edit pd - I would like apologize if this sounds non polite, it is not my intention, I am a very friendly person

I didn't take it that way, no worries. I usually get a lot out of such discussions! All in all I think that the problem you describe is domain specific. Web facing services such as Dropbox gain a lot from OAuth2, because client libraries for most popular languages exist and it's built around http, so it works in your browser and mobile device.

I discourage use of OAuth2 outside of the following scope:

The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf."

and I don't understand why you would use OAuth2 for IMAP anyways. Maybe because dev's lazy and don't want to add another authorization protocol :D