[cap-talk] Webkeys vs. the web

[Raoul Duke]

> It's worse than that. To the extent that they understand the model, they
> have come to expect that they can share *their* Account Summary URL with me,
> and that I will see *my* account information displayed (assuming, say, we
> share the same bank).

historically it seems like the question of security was sorta ignored
/ hand-waved away / glossed over when it came to the whole REST thing.
so then we get various approaches to dealing with that. and it quickly
becomes hard / subjective to know how users really think and behave
and what they expect? it is to sigh.