[Aissen]

I think it's only true as long as every *.micro.blog subdomain is properly isolated, and you can't access cookies/sessions from micro.blog (e.g post/comment as someone else, if there's no CSRF token). I haven't checked, but hopefully it's the case here. See: https://security.stackexchange.com/questions/95369/persisten...

[quickthrower2]

Different subdomains are different origins. So it's safe.

[teleclimber]

Not quite. There are gotchas:

https://blog.github.com/2013-04-09-yummy-cookies-across-doma...

[albinowax_]

It's not quite that simple once cookies (and Internet Explorer/Edge) get involved. But it definitely could be secure.