Re:XSS in Google Finance
by toast0 on Tuesday July 30, 2013 @11:56PM
(#6131811)
cookie greed doesn't explain it, because they don't issue any cookies for www.google.com, or at least, I don't have any; they do issue cookies for .google.com, which www and finance can access equally. It's either a branding thing, or a they paid for the fancy load balancer so they're going to use it thing.
[ Parent
| on HN ]
Re:XSS in Google Finance
by PavlovsCat on Wednesday July 31, 2013 @12:32AM
(#6131911)
That's a good point, I stand corrected. Of course, if you wanted to be "minimal" about cookies, you'd have to use a subdomain, but using one doesn't mean anything by itself.