I briefly made an MVP of 'basically Fast', and had to deal with mobile Safari, so I can tell you (hell, I can give you the code if you want it). We had to load

I briefly made an MVP of 'basically Fast', and had to deal with mobile Safari, so I can tell you (hell, I can give you the code if you want it). We had to load our own site in a zero-sized iframe, at a specific endpoint which ran a script that read the cookies and sent them over the Window.postMessage API to the merchant page, where our JS was running and intercepted the cookie contents. But that was an MVP, and I was uncomfortable about the security implications even so - not sure how Fast's engineers hacked it together, if they even did. The two of us ditched it when we realised how inhospitable the economics were, but even then we knew Fast's shitty play was bound to fail, and I heard the news from my prospective cofounder sending me a text ("we called it!") when it happened...