IME, that works as long as the user does nothing but browse the web and nothing in the environment or the computer changes. Things get tricky the moment any of those assumptions are invalidated. And that's because the user is not really operating the computer, but just using it to access the web. That it's a "desktop" is only an implementation detail.