Hacker News Reader

> Browsers can talk to those local servers too. Again, this seems useful to me, as long as native apps have capabilities that web apps lack, they should be able to offer them as extensions to the web API.

Not sure if I agree on that one... at a minimum I think that should be behind a user consent prompt.

View on HN

Maybe, but it's worth pointing out that even that wouldn't prevent the exploit in question. Facebook didn't have to transfer this cookie locally, the app and web site could just as easily have exchanged it via some RESTful API server somewhere (well, on the same origin as the Facebook JS in question).

The reason they didn't do that is pure obscurity: if they blasted a tracking cookie over the internet they would have been caught faster. Trying to design "security" features by pushing the "obscurity" boundary around is usually wasted effort.

Reply on news.ycombinator.com