Maybe, but it's worth pointing out that even that wouldn't prevent the exploit in question. Facebook didn't have to transfer this cookie locally, the app and w

Maybe, but it's worth pointing out that even that wouldn't prevent the exploit in question. Facebook didn't have to transfer this cookie locally, the app and web site could just as easily have exchanged it via some RESTful API server somewhere (well, on the same origin as the Facebook JS in question). The reason they didn't do that is pure obscurity: if they blasted a tracking cookie over the internet they would have been caught faster. Trying to design "security" features by pushing the "obscurity" boundary around is usually wasted effort.