I've read some blogs and did some labs regarding OAuth's implicit flow, but it seems to me everyone just turn a blind eye to a very critical point in the flow.
Assuming that site A uses the implicit flow for authentication, it will redirect the user to Facebook for login, wait for an authentication token to return, and use that token to query for the user's information (e.g Email) and then log the user in.
What stops a malicious user to use a proxy and modify the last part of the interaction? When site A queries for the user's information, the user can simply change the response from [email protected] to [email protected] . Simply by modifying the response, we've got an account takeover.