3 ms·

The most likely explanation is that one of his devices visited YouTube over HTTP (not HTTPS) and his ISP "helpfully" installed some kind of caching proxy that r

by puzzle 10y ago

The most likely explanation is that one of his devices visited YouTube over HTTP (not HTTPS) and his ISP "helpfully" installed some kind of caching proxy that returned the wrong cookies to the wrong user. ISP have been known to cause mixups like that when cranking up caching aggressiveness to 11.

justizin 10y ago
That doesn't really explain an iOS device being attached to the account.
- puzzle 10y ago
  The ISP might have return his cookie to someone else running iOS. The fact that it only happened for a few hours might be explained by cache expiration.
  - ben_jones 10y ago
    If ISP's are returning cookies from the wrong users, wouldn't it also be possible for login credentials (stored within cookies) to be returned as well?
    - puzzle 10y ago
      Login cookies are usually sent over HTTPS. Check your browser's cookie store, you'll see that Google services use so many of them, also because of the many hostnames and domains they are on. I suspect YouTube cookies because you can't use google.com ones directly on its domain. And the console mentions devices that have been used with the account, not that have been logged in or have attempted to do so (an important distinction), which points again to cookies. If he used Chrome or another browser supporting ChannelID, such a mixup would have no consequence, because Google's GFE would detect the situation and mint new cookies or redirect the user to a login page.
cortesoft 10y ago
Youtube redirects all http requests to https
- puzzle 10y ago
  Not for all clients, everywhere. It could be an old version of the Android app, given his mention of Cyanogen.
  - anfedorov 10y ago
    If you know of any such endpoints you should report them. Sending auth cookies over HTTP is a security vulnerability.
deleted 10y ago
[deleted]
Buge 10y ago
At no point should the ISP know his or any other user's cookies. If youtube is at all set up correctly, login cookies would be marked secure and only sent over https.

by puzzle 10y ago

justizin 10y ago

That doesn't really explain an iOS device being attached to the account.

puzzle 10y ago
The ISP might have return his cookie to someone else running iOS. The fact that it only happened for a few hours might be explained by cache expiration.
- ben_jones 10y ago
  If ISP's are returning cookies from the wrong users, wouldn't it also be possible for login credentials (stored within cookies) to be returned as well?
  - puzzle 10y ago
    Login cookies are usually sent over HTTPS. Check your browser's cookie store, you'll see that Google services use so many of them, also because of the many hostnames and domains they are on. I suspect YouTube cookies because you can't use google.com ones directly on its domain. And the console mentions devices that have been used with the account, not that have been logged in or have attempted to do so (an important distinction), which points again to cookies. If he used Chrome or another browser supporting ChannelID, such a mixup would have no consequence, because Google's GFE would detect the situation and mint new cookies or redirect the user to a login page.

cortesoft 10y ago

Youtube redirects all http requests to https

puzzle 10y ago
Not for all clients, everywhere. It could be an old version of the Android app, given his mention of Cyanogen.
- anfedorov 10y ago
  If you know of any such endpoints you should report them. Sending auth cookies over HTTP is a security vulnerability.

deleted 10y ago

[deleted]

Buge 10y ago

At no point should the ISP know his or any other user's cookies. If youtube is at all set up correctly, login cookies would be marked secure and only sent over https.