Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Can the session information sent to non-secure Google sites be used on Gmail?


Yes. When one is logged in as a gmail user, any google search is done as that user. Therefore the requests will carry session information just as if one were using gmail with http.


No, this is wrong.

The authentication cookies for GMail are named "S" and "GX". They're both set only on "mail.google.com", and they both have the secure flag so they're only transmitted over SSL.

There are certainly other Google cookies that let them track your identity that will get sent when you search. But those cookies are not sufficient to get access to GMail.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: