Not so fast. For years, Google has supported channel binding between GFEs and Chrome. The cookie alone is not enough: you need to steal the private key as well.

Not so fast. For years, Google has supported channel binding between GFEs and Chrome. The cookie alone is not enough: you need to steal the private key as well. I can't remember if that's the case, but it would make sense for @google.com accounts to have more aggressive settings. http://www.browserauth.net/channel-bound-cookies http://www.browserauth.net/channel-bound-cookies Even before that, Google has had a system to detect cloned or tampered cookies on the server side for more than a decade, as described in its patented glory (don't open if you think your company's lawyercats are going to be unhappy): https://patents.google.com/patent/US8302169B1 https://patents.google.com/patent/US8302169B1