3 ms·
In the online world a session cookie or Bearer token is pretty much equivalent to an account compromise, in fact often it is exactly the same. Hard to argue if
by kerng 8y ago
In the online world a session cookie or Bearer token is pretty much equivalent to an account compromise, in fact often it is exactly the same. Hard to argue if one gets email access to claim that their account wasn't compromised.
- puzzle 8y agoNot so fast. For years, Google has supported channel binding between GFEs and Chrome. The cookie alone is not enough: you need to steal the private key as well. I can't remember if that's the case, but it would make sense for @google.com accounts to have more aggressive settings. http://www.browserauth.net/channel-bound-cookies http://www.browserauth.net/channel-bound-cookies Even before that, Google has had a system to detect cloned or tampered cookies on the server side for more than a decade, as described in its patented glory (don't open if you think your company's lawyercats are going to be unhappy): https://patents.google.com/patent/US8302169B1 https://patents.google.com/patent/US8302169B1