Origin Isolation and Tor Privacy Archive

Executive Summary

Cross-origin browser state isolation eliminates covert user linkability by keying cookies, HTTP caches, IndexedDB, and DOM navigation channels such as window.name to the top-level site boundary. Originally formulated through capability-based Web Introducers at web-send.org in 2010 and hardened in Tor Browser's First-Party Isolation, these invariants now anchor Chrome CHIPS, Safari ITP, and the HTML Living Standard.

Sources: W3C Web & TV Archive (2011), Tor Browser Spec (2014), HTML Living Standard, IETF CHIPS Draft.

1. Cross-Origin State Isolation Sandbox

Modern browser security models diverge sharply on how they constrain cross-origin navigation residue, credentialed Fetch preflights, and embedded frame storage. Select a browser isolation profile, a communication channel, and an attack vector below to inspect the exact partition key, window.name lifetime rule, and normative mitigation header.

Interactive State & Channel Isolation Matrix

Client-Side Deterministic Model · 0 Telemetry

1. Browser Isolation Profile

2. Cross-Origin Channel

3. Threat Scenario

ISOLATED Tor Browser Design & Implementation

Active Partition Key (firstPartyDomain: publisher.example)

window.name Invariant Cleared on cross-origin navigation

Perforated archival paper tape, brass mechanical calipers, and brushed aluminum specification binder on technical grid backdrop — **Plate 01:** Physical archival metaphor for linear capability streams and discrete state boundaries documented across the 2010-2026 web-send.org specification corpus.

2. Protocol Matrix: Tor FPI vs. Chrome CHIPS vs. Capability URLs

Browser privacy architectures solve cross-origin tracking through three distinct mechanisms: strict first-party keying (Tor Browser), explicit partitioned cookie/storage tuples (Chrome CHIPS), and ambient-free capability delegation (Web-Send Introducers). While Tor FPI and CHIPS modify user-agent storage keying, Capability URLs remove ambient credentials from the transport layer altogether so even unpartitioned origins cannot correlate third-party actions.

Table 1. Comparative Security & State Partitioning Properties Across Browser Isolation Models
Security / Privacy Property	Tor First-Party Isolation (FPI)	Chrome CHIPS & Storage Partitioning	Web-Send / Capability URLs
Primary Partition Key	`firstPartyDomain` (top-level eTLD+1)	`(top-level site, frame site)` tuple	Stateless unguessable URI `#fragment` secret
`window.name` Navigation Reset	CLEARED Reset on every cross-origin navigation	GROUP-BOUND Reset when BrowsingContextGroup swaps	NOT USED State passes via `postMessage` or fragment
Third-Party Cookie Scope	Blocked / strictly isolated per first-party tab	Allowed only with `SameSite=None; Secure; Partitioned`	Zero third-party cookies required (ambient-free)
Clickstream Privacy	PRESERVED No cross-site script linkability	PARTIAL Per-site jar blocks join; IP remains visible	PRESERVED Provider contacted only on user click
UI Redress / Clickjacking	Standard CSP `frame-ancestors` & NoScript	CSP `frame-ancestors` + `COOP: same-origin`	Full-size top-level Trusted Path window mandated
Ambient Authority / CSRF	Reduced via third-party cookie suppression	Mitigated for partitioned third-party frames	ELIMINATED Authority bound solely to explicit key
Cross-Origin Discovery	Disabled for external local-network probing	Local Network Access / Web Share API	User-registered local or remote Introducer registry

3. Cross-Origin State Partitioning Architecture

Before storage partitioning and window.name isolation, an embedded third-party origin (tracker.invalid) loaded under two unrelated publishers shared a single global cookie jar, HTTP cache, and tab-scoped window.name string. Under modern origin isolation, every storage API and navigation boundary resolves against the top-level site tuple, while Web-Send's capability model isolates the user's chosen service inside a clean top-level or user-mediated channel.

4. Methodology, Primary Sources & Citation Corpus

Between 2010 and 2014, web-send.org published the original Web Introducer specification authored by engineers from Google, Sony Ericsson, and Mozilla Labs. Those documents established a formal bridge between object-capability security and browser privacy engineering, earning direct citations across four enduring technical records:

W3C Web & TV Interest Group (April 2011): Dave Raggett referenced web-send.org/introducer/ on public-web-and-tv as a mechanism for exposing local consumer-electronics discovery protocols to web scripts without cross-origin ambient leakage.
Tor Browser Design & Specification (2014): In the Tor Browser Spec (tor-commits and tor-dev), Tor developers cited Web-Send Introducers under Promising Standards right beside their analysis of window.name cross-origin identifier tracking.
UC Berkeley Law BCLT Privacy Symposium: Frederick Hirsch's presentation on Technology Standardization and Privacy documented Web-Send alongside W3C privacy standardization efforts, archived in our Berkeley BCLT Trace.
QCon San Francisco 2010: Tyler Close's lecture Adding Features to the Web Securely connected Waterken Capability URLs directly to the Bookmark Introducer protocol preserved at /bookmark-protocol/.

5. Specification FAQ

Why did Tor Browser cite web-send.org alongside window.name isolation?

Tor Browser's design specification highlighted Web-Send Introducers as a promising standard because they enabled cross-origin sharing and discovery without third-party tracking cookies, ambient authority, or window.name click-navigation side channels.

Reference: Tor Browser Spec April 2014 commit msg01829 & features.html scorecard.

How does Tor First-Party Isolation differ from Chrome CHIPS storage partitioning?

Tor First-Party Isolation keys all browser state strictly by the top-level URL bar domain and blocks third-party cookies by default, whereas Chrome CHIPS allows explicit cross-site cookies tagged with Partitioned and scoped to a (top-level site, frame site) tuple.

Reference: IETF CHIPS specification & Tor Browser First-Party Isolation design doc.

6. Restored 2010 Root Entry Context

Historical Root Snapshot (2010-12-28): Web Introducer Overview

The original 2010 front page of web-send.org introduced the Web Introducer specification with direct links to /introducer/, /bookmark, and /features.html, defining how web content discovers user-owned personal resources across origins via one-click user mediation. All legacy technical paths resolve with zero redirect chains to their restored specifications on this archive.