Does it sync cookies and localstorage or does it just exchange url's?

It just exchanges url's. You can attach a note with the tab too, and that is currently the only additional information that is sent with the tab.

I'm looking into other parts of the page we can send, but due to tricky security issues around that, progress on that has been slow.

What are the security implications of this?

This is a good question. Tabd does a few things for security:

* You must be friends on Tabd to send a tab. Standard friend request style. Thus you can block people who send tabs you don't want.

* If you spam a tab, (ie send the same tab over and over), Tabd will only deliver that tab once until the receiver actually opens it.

* Everything sent over https

* Url flagging functionality - You can set Tabd to temporarily not open NSFW tabs.

If there are more security concerns, please voice them! I'm definitely trying to make this app as secure as possible. While I've done a lot, I'm sure there's more that can be done!

so what is preventing me from sending a phishing URL?

Nothing, think of it as the same as if you just emailed your friend a phishing URL. Except this way is much more convenient to do so :)

Pretty soon there will be a "block whoever sent me this" feature, but I haven't got around to building that yet.

Until then, just don't add people on Tabd that you don't know and trust!