I'd presume that a MITM could set, release and read locks, by which it might determine that you have certain sites open. In general¹, I presume that any API th

I'd presume that a MITM could set, release and read locks, by which it might determine that you have certain sites open. In general¹, I presume that any API that uses "same origin" as bounding criteria, must be secure. Since there's no way to enforce this "same origin" in insecure contexts. -- ¹ Aside from the idea that maybe just make all new APIs "secure only", just to discourage insecure contexts.