I know, that's why I'm saying there should be a way. One solution would be for Facebook to host the app, and to run its content in a sandbox (using something l

I know, that's why I'm saying there should be a way. One solution would be for Facebook to host the app, and to run its content in a sandbox (using something like Google's Caja?). Another approach would be a system permission at the browser level, where a page could explicitly request to restrict what it is allowed to do. Then you could have an approach where the app asks Facebook for this and that permissions, but accepts to be sandboxed to only have access to Facebook's domains. The request goes to FB as it does now. FB calls the return URL, but it opens it in tab with specially sandboxed permissions. Everyone wins: the app makes it clear there's no information leak possible and the user is feeling safer. I'm not saying any of this is trivial to implement. But it would make sense from a user perspective.