By injecting javascript into a page from a man-in-the-middle position they were able to retrieve cookies? Sounds underwhelming to me. SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique