I wrote something: "Does OAuth2 have a usability problem? (yes!)"

https://evertpot.com/oauth2-usability/

Hackernews post: https://news.ycombinator.com/item?id=35722567