Re: SOP wiki was: A Somewhat Critical View of SOP (Same Origin Policy)

On Tue, Sep 29, 2015 at 11:40 AM, Brad Hill <hillbrad@gmail.com> wrote:

> Within the context of Web Origins, FIDO uses approximately the same
> scoping rules as cookies. That is to say, key scope must stay within a
> delegated label or its children and not cross delegation points identified
> by the public suffix list.  "www.example.com" and "register.example.com"
> can each set a cookie for "example.com" which the other can see, but
> subdomains of "hosting.example.com" cannot set cookies at or beyond that
> label if it is designated as a public suffix.  This provides some limited
> usability affordances within the existing information flow boundaries of
> the web security model while mostly that keys are scoped to a single
> logical organization as defined by domain registrars.
>

Huh, interesting, I wasn't aware of that.

-- 
Tony Arcieri