Can gpgc's GitHub token be spoofed?

[wireddown]

Perhaps stronger protection should be added to the browser's local storage.

See http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it/

[NonaSuomy]

Did you figure this out?

[wireddown]

I haven't even started looking into it. I'm not sure I have enough web or security expertise to reverse GitHub's OAuth implementation as the author did for LastPass.