I have run into this situation before but I will speak specifically about a current project, since it is a good example.
I am building a desktop application that uses the Stack Exchange API, and authenticates using the implicit OAuth flow currently recommended for desktop applications.
The exclusively web-based nature of this authentication flow means that rather than, say, opening a login dialog in the user's favorite trusted browser with a clear URL in the address bar, desktop applications must open the SE authentication page in an embedded browser control. This would be similar to, say, an application displaying its own, probably-shoddier-looking-than-your-favorite-browser, window with a Google authentication page on it, for example. It does not scream "trust me!"
My question is: What things can I do to increase user trust? The ideal situation would be nobody raising an eyebrow, or heading to the internet to find out if the application is safe or not, etc.
The only thing I can think of is making the source code available, although this still requires the user to take a leap of faith and assume the source I have distributed is truly the source for the application they are running. It also only primarily helps users who are programmers and who are also willing to take a look to verify, although I suppose it helps non-programmers too in that it potentially projects an image of honesty even if they don't understand the source.
What else can I do to gain a user's trust in a situation like this?
