The Security Nerd

For a while it was possible to put your own content on a *.google.com domain. This would allow stealing Google cookies, and as Tony Ruscoe points out, it would be hard for even a savvy user to avoid the problem.

Excerpts won't do the article justice. Read the whole thing.