Yes, but Google Finance is on google.com/finance (for some reason; I'm sure it used to be finance.google.com at some point...).
The importance of httpOnly had somehow escaped me until today :-)
The importance of httpOnly had somehow escaped me until today :-)
Cookies set for just subdomain.hostname.com can only be "seen by" that particular subdomain, while cookies set for hostname.com can be seen from hostname.com and any and all subdomains. I think that's why they do it constantly, at least stuff like www.google.com/glass certainly makes no sense otherwise. Why not make a fancy new domain for that? I think it's cookie greed.