Why TLS 1.3 isn't in browsers yet

Re:Why TLS 1.3 isn't in browsers yet by Buge on Thursday December 28, 2017 @12:55AM (#16020586)

The downside of hosting things all in the same domain is that cookies are shared between them, so a vulnerability in one site (e.g. XSS) leads to compromise of all sites. Choosing different domains means they are sandboxed and safe from each other.

Any domain name could be used to host porn. But not any domain name can get linked from a cloudflare blog. I think the fact that it's linked from cloudflare's blog should indicate that it's fine.

[ Parent | on HN ]

Re:Why TLS 1.3 isn't in browsers yet by tombrossman on Thursday December 28, 2017 @04:12AM (#16021086)

> The downside of hosting things all in the same domain is that cookies are shared between them, so a vulnerability in one site (e.g. XSS) leads to compromise of all sites. Choosing different domains means they are sandboxed and safe from each other.

I believe this is incorrect. Cookies should only be shared (by default) if the domain matches exactly, which is why it's best practice to use a www subdomain instead of the domain alone. For example, www.example.com cookies will not be shared with test.example.com by default, though this can be enabled. See here for a fuller explanation: https://stackoverflow.com/a/23086139

[ Parent | on HN ]

Re:Why TLS 1.3 isn't in browsers yet by mkonecny on Thursday December 28, 2017 @11:05AM (#16022777)

It is incorrect. Read why personal github pages (username.github.com) moved to github.io (username.github.io)

https://github.com/blog/1452-new-github-pages-domain-github-...

[ Parent | on HN ]

Re:Why TLS 1.3 isn't in browsers yet by pas on Sunday December 31, 2017 @07:18AM (#16040322)

That only allows writing cookies, but still the separation via a completely different domain is best practice.

[ Parent | on HN ]