Recall that the browsers same-origin policy (SOP) for DOM access is based on the (protocol, host, port) triple, while the SOP for sending cookies to websites involves domain and path. Cookies marked secure are sent over HTTPS only. In modern browsers, reading document.cookie in an HTTP context does not reveal secure cookies. In Safari before version 3.0, the SOP for DOM access is de ned using host and port only (i.e., it does not include the protocol).
Explain how a network attacker (an active attacker that can intercept or forge network packets, etc.) could steal secure google.com cookies. (Hint: consider a user who logs into Gmail using HTTPS, but then receives a google.com page served over HTTP.)
Under the same assumptions, is it possible for a Web attacker to steal secure google.com cookies? Describe an attack or explain why you believe none exists. Recall that a Web attacker can set up a malicious website (at some domain other than google.com) and trick
the user into visiting this site, but cannot intercept or forge network packets.