Every modern browser maintains a single user session that accesses multiple sites simultaneously. This allows a lot of information with security and privacy im

Every modern browser maintains a single user session that accesses multiple sites simultaneously. This allows a lot of information with security and privacy implications to flow between sites: * Cookies set in one browser window are delivered with requests made in another browser window * On site A, click a link to site C, and the same link on site B will change color. * Files cached for one browser window are available instantaneously in another window * Site A can use timing to determine if the browser currently has an open HTTP connection to site B * The browser has a per-browser limitation on the number of concurrent connections to a particular web server. A malicious website could use this to find out when you're browsing another website. Browsers also provide detailed version info to web servers, including plugin versions, allowing malicious sites to deliver the right exploits. ECMA Script implementations do not implement proper resource controls. For example, bad JavaScript on one page can cause other pages to have slow responses. Third-party cookies allow wholesale tracking Browsers don't complain when the user enters a password into a form that submits to an HTTP url. Browsers keep many cookies literally forever. Even if the user turns off cookies, the cache provides equivalent functionality for tracking. ECMA Script and Flash can pop up modal dialogs that allow one webpage to prevent the user from using others. Browsers don't provide any good UI tools for checking signatures of non-signed certificates. Many users are conditioned to just click 'Accept Permanently.' Browsers will recall passwords for pages that are shown in i-frames. Browsers should provide stronger anti-phishing mechanisms. For example, a way to designate a bookmark as the only allowed way to enter that domain.