Comment by quesera

(Vouched so I could reply.)

Why would that be a bad thing? What happens under badguy.com is badguy.com's business, is it not?

Is it any different than setting cookie scoping rules?