diff --git a/TAG-S&P-questionnaire.md b/TAG-S&P-questionnaire.md index 9c165b0..26a309d 100644 --- a/TAG-S&P-questionnaire.md +++ b/TAG-S&P-questionnaire.md @@ -98,8 +98,12 @@ See 3.1. ### 3.3. Same-Origin Policy Violations -By requiring the __Host- prefix, this proposal makes partitioned cookies scheme- and hostname-bound. -However, even cookies with the __Host- prefix can still be sent to different ports (though this may change if [Origin-Bound Cookies](https://github.com/sbingler/Origin-Bound-Cookies) is enabled). +Like all other cookies, partitioned cookies can be shared across different subdomains using the Domain attribute. +Partitioned cookies require Secure, so they are not accessible in insecure origins. + +In an effort to bring cookies closer to using origin as the security boundary, we previously proposed that partitioned cookies be required to be scheme- and hostname-bound, unlike other cookies. +However, we received feedback from site authors that this would make it too cumbersome to migrate legacy systems to the more privacy-forward partitioned cookies. +In order to alleviate this concern, we have since removed that requirement. ### 3.4. Third-Party Tracking