That's an unrelated thing. By having CDN assets on a separate domain, you not only easily avoid accidentally sending any cookies along to the other domains (so

That's an unrelated thing. By having CDN assets on a separate domain, you not only easily avoid accidentally sending any cookies along to the other domains (so if your CDN gets owned at least they aren't getting user credentials or session cookies), but it's also a small performance optimization as there are less things sent in the headers. The important distinction is that the user should never ENTER any information onto those domains directly. They should be for displaying static resources only, so there is no need to "build trust" for them.