Restored from web-send.org/bookmark/ (Dec 2010) and web-send.org/features.html (Mar 2011).
1. Bookmark Introducer Specification (/bookmark)
The Bookmark Introducer specification defines a concrete Web Introducer API for sharing a permalink and associated metadata from a content Publisher (acting as Customer) to a user-selected Service (acting as Provider), such as social bookmarking, email composition, or link archiving.
Publishers annotate shareable links with standard HTML5 semantics (<a rel="bookmark" href="...">) and declare compatibility via the protocol identifier bookmark-type = "http://web-send.org/bookmark/". Optional MIME filtering allows a Publisher to restrict candidate Providers to those accepting specific media types without ever enumerating the user's installed services.
<!-- Normative Bookmark Markup (2010 Spec) -->
<a rel="bookmark" type="text/html" href="https://publisher.example/spec#sec-4">
Share Specification Permalink
</a>Trusted Path and Provider Frame Allowance
When a user initiates sharing, the Service may render a compact inline interface inside the Publisher page or open a full-size top-level browsing context to establish a Trusted Path. Because a malicious Publisher can pixel-perfectly mimic a small popup using positioned <div> overlays, Bookmark Introducer explicitly requires any trusted-path confirmation window to be a full-size top-level window rather than a small popup dialog.
Bookmark Event Counter and MIME Type Extension
A common objection to removing embedded third-party social scripts in 2010 was the loss of on-page share counters. The Bookmark Introducer specification resolved this without cross-origin telemetry by defining a custom DOM event of type 'bookmark' dispatched directly on the originating <a rel="bookmark"> element once a sharing interaction completes. By attaching a first-party event listener on that anchor, the Publisher can increment its own local share counter without loading external JavaScript, leaking visitor IP addresses, or exposing browsing histories to unchosen providers.
In addition, Section 4.1 (MIME Extension) allows a Customer to scope candidate Providers by the MIME type of the target resource (such as image/png, application/pdf, or text/html) specified in the type attribute of the bookmark anchor. The browser passes that content type into the Introducer filter alongside http://web-send.org/bookmark/, ensuring that image lockers, feed readers, or citation managers appear only when relevant to the linked media without granting the Publisher read access to the user's installed tool list.
Under Sections 5 and 6 (Provider Frame Allowance and Message Data), the transmitted bookmark payload stays strictly bounded to canonical permalink URL, human-readable title, optional MIME hint, and publisher-supplied metadata. Unlike legacy social widgets that read the surrounding DOM or inject tracking pixels into the host page, the selected Service operates inside a sandboxed origin context and may queue the shared link locally inside browser storage when the user-agent is offline, flushing the transaction once connectivity returns without keeping any call stack open.
2. 19-Point Link Sharing Protocol Scorecard (/features.html)
Tor Project engineers singled out web-send.org/features.html in their 2014 browser specification because it formally decomposed why conventional embedded "Like" and share widgets destroy cross-origin privacy. Filter the full 19-criterion scorecard by protocol phase below:
| Phase | Protocol Feature | Bookmark Introducer | OExchange | Status Quo (<script>) | Architectural Requirement |
|---|---|---|---|---|---|
| Intro | Open | PASS | PASS | FAIL | No central vendor approval required |
| Intro | Service Discovery | PASS | PASS | FAIL | Connects Publisher & Service without prior pairing |
| Intro | Not XSS | PASS | PASS | FAIL | Service script never runs in Publisher origin |
| Intro | Resists Service Spam | PASS | FAIL | PASS | Requires user or Publisher consent to appear |
| Intro | Resists Service Phishing | PASS | FAIL | FAIL | Services cannot impersonate competing providers |
| Intro | Resists Misattribution | PASS | FAIL | FAIL | Origin of initiating Publisher is unforgeable |
| Intro | No Settings | PASS | PASS | PASS | Leaves no persistent Publisher delegation |
| Intro | In Context Initiation | PASS | PASS | PASS | Triggered directly inside Publisher content |
| Interact | Free Confirmation | PASS | FAIL | FAIL | Clickjacking-resistant without extra confirm modal |
| Interact | In Context Interaction | PASS | FAIL | FAIL | Bounded inline Service frame for user comment |
| Interact | Trusted Path | PASS | PASS | UNSPEC | Full-size top-level window isolated from Publisher |
| Interact | Offline | PASS | FAIL | FAIL | User-agent queues shared link while offline |
| Interact | Full-Duplex | PASS | FAIL | FAIL | Arbitrary bidirectional messaging after share |
| Interact | No Sleep Power | PASS | N/A | N/A | Zero-power wait state for idle endpoints |
| Interact | Asynchronous | PASS | PASS | PASS | Event-driven callback without blocking stack |
| Residue | Share Counter | PASS | PASS | PASS | Publisher listens for custom bookmark event |
| Residue | Clickstream Privacy | PASS | FAIL | FAIL | Zero browsing history leaked to Service |
| Residue | Sharing Privacy | PASS | FAIL | FAIL | Service receives data only upon explicit selection |
| Residue | Preference Privacy | PASS | FAIL | FAIL | Publisher cannot probe user's chosen Service |
3. Why Three Privacy Properties Matter Today
In 2010, nearly every social share button operated under the Status Quo model: embedding a third-party <script> directly into the Publisher DOM. That single script violated all three residue guarantees simultaneously: it leaked the user's clickstream on every page load even without a click, exposed which services the user held accounts with, and executed with full XSS privilege inside the Publisher's origin.
Competing open protocols such as OExchange improved script safety by moving away from arbitrary publisher-origin JavaScript execution, yet OExchange still failed on Service Phishing, Misattribution, Free Confirmation, Offline queueing, and all three privacy dimensions. Because OExchange relied on HTTP discovery URLs and unisolated popups without user-agent mediation, a Publisher could still probe user preferences or expose sharing actions to cross-site linkability. Today, modern browser storage partitioning, the W3C Web Share API, and FedCM implement the exact architectural boundaries first scored in web-send.org/features.html: zero passive third-party network beacons prior to user gesture, strict origin separation between publisher and provider, and clickjacking-resistant top-level or OS-native selection chrome.