The OAuth2 specification says:

> 
> The interaction between the authorization server and resource server
>  is beyond the scope of this specification. The authorization server
>  may be the same server as the resource server or a separate entity.
> 
> 
> 

I feel that this means that the authorization server is like a trusted big brother here, which can easily, but yet maliciously, gain access to data that should normally be restricted to legitimate users. If that is the case, why are Facebook, etc. considered as typical authorization servers? Why should they be so much trusted? I might have missed something basic here. So, I display my ignorance in the hope of becoming less ignorant.