26305 2014-07-10 15:36:51 +0000 The introduction mentions that domains cannot affect each other for privacy reasons. Web messaging i [...] 2014-09-03 23:43:24 +0000 1 1 1 Unclassified WHATWG HTML unspecified Other other RESOLVED FIXED http://www.whatwg.org/specs/web-apps/current-work/#crossDocumentMessages P3 normal Unsorted 1 contributor ian ian mike contributor oldest_to_newest 108847 0 contributor 2014-07-10 15:36:51 +0000 Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/web-messaging.html Multipage: http://www.whatwg.org/C#crossDocumentMessages Complete: http://www.whatwg.org/c#crossDocumentMessages Referrer: http://www.google.nl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCIQFjAA&url=http%3A%2F%2Fwww.whatwg.org%2Fspecs%2Fweb-apps%2Fcurrent-work%2Fmultipage%2Fweb-messaging.html&ei=FrC-U5vnJIajPcPKgeAJ&usg=AFQjCNF-jJmQPDFNHrAmasks2Z0KiB4o0w&bvm=bv.70138588,d.ZWU&cad=rja Comment: The introduction mentions that domains cannot affect each other for privacy reasons. Web messaging is then introduced as solution. But to many users, it is not a solution: they want their privacy protected. They do not want to allow a page that they are visiting to pass around data to 3rd parties, such as advertising agencies. Posted from: 83.86.56.157 User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0 108964 1 ian 2014-07-15 18:45:05 +0000 Fundamentally, there's no way to stop that. The data transfer could happen on the server side trivially. If you don't trust the first-party site to not treat your data with respect, then don't visit it in the first place. 110955 2 ian 2014-09-03 23:42:58 +0000 (This isn't "FIXED" per se, since there is no fix. But I tried to explain why it's not a new problem.) 110956 3 contributor 2014-09-03 23:43:24 +0000 Checked in as WHATWG revision r8741. Check-in comment: Try to explain why postMessage()'s privacy implications aren't actually anything new http://html5.org/tools/web-apps-tracker?from=8740&to=8741