[discreditable]

> Should we not decide that cross-origin window.opener is now deprecated, show big fat warnings on the developer console when it's used, and remove it in a year or two?

That does nothing for deployed sites that aren't actively developed? Browser devs have decided those sites are worth not breaking.

[metafunctor]

Browsers should show a warning that a "possibly insecure legacy mode" is in use.

If browsers enforce HTTPS in a similar way, I don't see why they shouldn't enforce better security elsewhere as well.