Hacker News Reader

It is regulated in the browser - that's why Google has to explicitly redirect you to YouTube and pass the secret value in the URL since YT can't access your Google session cookie.

YouTube is owned by Google so they can make both websites cooperate to share data between each other, working around the browser's same-origin policy.

What I mean by regulation:

- There is a limit on how many sites the login information can be shared with without notifying the user.

- If the login information is attempted to be shared with a website that is a known tracker, the process is stopped, and the user is explicitly prompted to allow this.

As long the server supports it, nearly infinite, but most protocols require an redirect, since they can't access the cookies of the loginsite.