Hey! I'm the person who made this — I don't believe there's an actual problem here, since login cookies are set on the top-level domain (and thus are inaccessible to content on subdomains), and are HTTPOnly as well.
I do notice that Stripe sets a tracking cookie (which only happens for people who pay for the service, since I don't load the Stripe JS elsewhere), so you could track pageviews with that or something. That's unfortunate — I'll probably try to move the stripe stuff to a subdomain to avoid it — but I don't see it as a big problem.
The HTTP security model is pretty awful, so there may be something I'm missing, but I did think quite carefully about this, and allowing people to use arbitrary HTML and JS was an intentional choice.
Just FYI - in many interviews, you can just say "Sorry, I'm having a panic attack. Could we do this tomorrow?". One of my friends had a panic attack during her Google interview, left came back the next day, and got the job.
So, YMMV, but people are often able to be accommodating for things like this :)
The original pens are, AFAICT, somewhat hard to come by, but we modded the pen carousel and have a 3d printed holder to put more modern pens in. With this mod, the TCO doesn't seem to high, although I didn't initially purchase/set it up, and I haven't had to do serious maintenance yet.
Whenever people talk about new tlds, I always think mostly about names like google.con or googl.ecom. Yeah, yeah, it's cool that you can get some awesome tld, but I don't see the point. What's wrong with .com/org/net?
Currently, the "loophole" in 2FA is that almost no one enables it. Although it's great that Google offers it, it doesn't help when >95% (Just a guess off the top of my head, but seems reasonable) of people don't enable it.
I only know one person who uses 2FA, besides myself, yet almost everyone that I know uses GMail.
> Oh, you're hosting it from your home DSL line? Bandwidth is the problem. Maybe you should save everything into a Dropbox public folder and link it here.
It's not that I am concerned about my security, as I use text message verification to recover my password.
My issue with this it that people who don't give their phone number to google can be effected by this.
EDIT: Just set up 2 factor auth. Looks cool, until my phone dies and I don't have the backup codes with me.
I do notice that Stripe sets a tracking cookie (which only happens for people who pay for the service, since I don't load the Stripe JS elsewhere), so you could track pageviews with that or something. That's unfortunate — I'll probably try to move the stripe stuff to a subdomain to avoid it — but I don't see it as a big problem.
The HTTP security model is pretty awful, so there may be something I'm missing, but I did think quite carefully about this, and allowing people to use arbitrary HTML and JS was an intentional choice.
Is there a particular threat model you see here?