i suppose the missing piece would be to tie it to a specific chromebook to avoid issues with pwnage of the endpoint. they say they require chrome, i wonder if

i suppose the missing piece would be to tie it to a specific chromebook to avoid issues with pwnage of the endpoint. they say they require chrome, i wonder if it would be possible to steal the session cookies and run a second session on the same host? (maybe they fingerprint the browser or use some other scheme to ensure that they only talk to the authenticated browser process?) i suppose even if that was the case, if the endpoint was pwned the browser could be modified to make requests in the background on behalf of the pwners. almost kinda surprising they didn't tie it to special chromebooks that they could sell. not only would it actually mitigate a big problem, i could totally see it also being some kind of a "i'm an important person" status symbol that people would brandish in public. if they gave it a distinct look it would be like a newfangled blackberry or zero halliburton for whatever you call this weird decade.