“Until Google added the option, it never actually set the GX cookie as secure, so you could do an active-hijack of any OTHER connection they make so that it does a redirect to http://mail.google.com/ [google.com] and spits out the cookie in the clear for the attacker to capture.” source...
Loading...