> - Completely unrealistic thought experiment: block ALL cross-domain requests in a browser. Only allow <a> tags. Everything else has to be hosted on the same domain and proxied over. The incentives re-align; all the responsibility and blame will fall squarely on website operators to get their sites right.
You can use µMatrix[0] to browse like that and whitelist things as needed.
It's surprising how many sites break under same-origin-only rules. And by break I mean they don't even display any text despite the text being present in the markup.
In case someone is concerned about how disruptive it will be to their browsing, uMatrix couldn't have a more efficient UI. It still requires page reloads and is only for advanced users, but there is also a pleasure in driving a machine so well-designed.
(Also, I believe it's now called uMatrix; the greek letter is gone.)
You can use µMatrix[0] to browse like that and whitelist things as needed.
It's surprising how many sites break under same-origin-only rules. And by break I mean they don't even display any text despite the text being present in the markup.
[0] https://github.com/gorhill/uMatrix