Login cookies are usually sent over HTTPS. Check your browser's cookie store, you'll see that Google services use so many of them, also because of the many host

Login cookies are usually sent over HTTPS. Check your browser's cookie store, you'll see that Google services use so many of them, also because of the many hostnames and domains they are on. I suspect YouTube cookies because you can't use google.com ones directly on its domain. And the console mentions devices that have been used with the account, not that have been logged in or have attempted to do so (an important distinction), which points again to cookies. If he used Chrome or another browser supporting ChannelID, such a mixup would have no consequence, because Google's GFE would detect the situation and mint new cookies or redirect the user to a login page.