Hacker News Reader

Whether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.

So scope cookies to the SSL certificate instead of the domain name, or simply offer to clear them for a domain whenever you bypass the HSTS on one.

> So scope cookies to the SSL certificate

And invalidate every user's session whenever the server's certificate is renewed??