<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 6/8/10 10:47 AM, Adam Barth wrote:
<blockquote
cite="mid:AANLkTile0R1PGsFni57pP_Cfn5nQ567hWk21gwQuPTX2@mail.gmail.com"
type="cite">
<pre wrap="">On Tue, Jun 8, 2010 at 4:17 AM, Henri Sivonen <a class="moz-txt-link-rfc2396E" href="mailto:hsivonen@iki.fi"><hsivonen@iki.fi></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">"Aaron Boodman (劉)" <a class="moz-txt-link-rfc2396E" href="mailto:aa@google.com"><aa@google.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">If we add paths to the mix, we can do this. Applications on the same
origin can circumvent it if they want, but why would they? SOP
already
guarantees that apps on the same origin are friendly and cooperate
with each other. That doesn't mean it isn't useful for the UA to know
which one is which.
</pre>
</blockquote>
<pre wrap="">
I have to wonder why Google needs the browser team to solve this instead of having the Reader team relocate their stuff to reader.google.com (like maps.google.com is located already).
</pre>
</blockquote>
<pre wrap="">
Last time I asked about this, the answer I got was that there were
performance and branding considerations around whether to host an app
on www or on a dedicated subdomain. For security, putting each app on
a separate subdomain is a win.
Adam
</pre>
</blockquote>
<font face="Helvetica Neue">For w</font>hat it's worth, I think that
giving developers tools to easily define more granular security
mechanisms without resorting to subdomains is a win in terms of
usability, as it's quite difficult to figure out how to create
subdomains and do virtual hosting--to say nothing of doing it over
SSL.<br>
<br>
That said, introducing a brand new mechanism for security on top of
SOP does seem like it might make the security landscape more complex
as a whole, and thereby potentially more vulnerable.<br>
<br>
- Atul<br>
<br>
</body>
</html>