Fundamental mistake was to build web like we did.

If you can run arbitrary code that can connect to other sites and make requests there someone will do that. And those calls can do exactly what they would on site. Only place to control this is the browser. Thus moving this decision to browser. One piece we probably trust way too much.

Live is simple when you directly communicate with one "server"(address) for one thing. Communicate with more. Well you never know if those others intended you to be able to do this.

And then when also all the authentication information lives in the browser too the mess is ready... So whole thing should have been build differently from start.