W3C slaps down Google's proposal to treat multiple domains as same origin
(googler here, but this is my opinion)<p>I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself.<p>For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for several unrelated parties, think hosting a store on Shopify (1 domain for N parties). This is so ambiguous that even inside the browser you have two different implementations on the way you handle this attribution, one for cookies and one for Single-Origin Policy.<p>There's a good write up about this problem at <a href="https://github.com/sleevi/psl-problems" rel="nofollow">https://github.com/sleevi/psl-problems</a>. Sometimes I wonder how the web got here with the amount of kludge that we have to carry.