Consider making permission defaults * instead of self

[arichiv]

Not asking for review of this yet, but posting here for consideration as part of #106

---

Preview | Diff

[anderagakura]

Trying to understand the blink discussion, the Issue 990 design revue in w3ctag and the privacy side :

• In case of the user denies giving consent to X vendors / tech via the CMP (Consent Management Platform), will the token be shared cross site if a wildcard is set anyway? The question also works with the Global privacy control
• Is there a way to prevent any adtech to redeem the token to display an ads anywhere outside? (But I think this question is already in the blink discussion)
• Not related but somehow related, if the token is considered First party tracking (Potential risk noted in the spec) then combined with the wildcard, you have a cross site tracking : How to prevent that?

[arichiv]

I replied in the blink-dev thread: https://groups.google.com/a/chromium.org/g/blink-dev/c/5jI8kLLdIFw/