I don't think you should be so quick to dismiss custom protocol handlers. To me that's the correct way to do this. Browsers are responsible for not letting hand

I don't think you should be so quick to dismiss custom protocol handlers. To me that's the correct way to do this. Browsers are responsible for not letting handlers be hijacked. It's already used widely for mailto links. Firefox: https://developer.mozilla.org/en-US/docs/Web-based_protocol_handlers https://developer.mozilla.org/en-US/docs/Web-based_protocol_... ; Chrome (needs web+ prefix): https://developers.google.com/web/updates/2011/06/Registering-a-custom-protocol-handler?hl=en https://developers.google.com/web/updates/2011/06/Registerin... There is cross-domain local storage but it involves a central server and iframes, https://github.com/zendesk/cross-storage https://github.com/zendesk/cross-storage