I think the argument for origin is that a compromise of example.com would not allow for HTTP-cache attacks on mail.example.com. I strongly suspect we deal with cookies and the HTTP cache separately, so we could have different strategies (also note that most cookies ignore the scheme). (I do realize that leaving other side-channels open will likely mean attacks remain possible, but I think there's value in driving attackers to more complex solutions while addressing rather trivial-to-execute attacks.)
Bug 1536058 Comment 12 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I think the argument for origin is that a compromise of example.com would not allow for HTTP-cache attacks on mail.example.com. I strongly suspect we deal with cookies and the HTTP cache separately, so we could have different strategies (also note that most cookies ignore the scheme). (I do realize that leaving other side-channels open will likely mean attacks remain possible, but I think there's value in driving attackers to more complex solutions while addressing rather trivial-to-execute attacks. [I also agree that checking with WebKit would be good here.])