Complexity is an attack vector

https://www.darkreading.com/endpoint-security/oauth-xss-attack-millions-web-users-account-takeover