I think you're missing that github.io is a public suffix but microsoft.github.io or yourcorp.github.io isn't. He finds a publicproj.microsoft.github.io and abus

I think you're missing that github.io is a public suffix but microsoft.github.io or yourcorp.github.io isn't. He finds a publicproj.microsoft.github.io and abuses the fact it shares cookies with privateproj.microsoft.github.io. I think him mentioning {anything}.github.io not being on the public suffix list is a slightly misunderstanding. While true, it's expected. The same is true for {anything}.com.