Here's a threat model. My university used to give students /~s123456 folders. On the same domain as the main student platform, and as the main university site.

Here's a threat model. My university used to give students /~s123456 folders. On the same domain as the main student platform, and as the main university site. I'm not sure if they still do this but it was less than 3 years ago. Considering the age of the infrastructure, there's even a good chance that session cookies were not marked HttpOnly. Even if they weren't, I can put a login form on my page, and even if the user doesn't get tricked into using it through phishing, if their browser autocompletes it I now have their username and password. Now yes, our uni probably shouldn't be giving out userdirs to all students, much like wifi, you should only let in the people you trust. But that's exactly the point of the article.