The replies are correct--I mentioned Paint.NET mainly becaues that was/is a highly effective site to get people to click the misleading "Download" button ads.

The replies are correct--I mentioned Paint.NET mainly becaues that was/is a highly effective site to get people to click the misleading "Download" button ads. As for browser cookie storage, there's not much the browsers can do. Even if they were encrypted or obfuscated somehow, the browsers themselves would still need access so people would always be able to reverse-engineer the process. The only way I could see them preventing the web-based install exploit would be to always require a password first (and not just rely on session cookies to identify the user). I'm not sure if Google is doing that now or not.