Re: Don't understand
Of course it's an arms race.
The question is:
login.company.com is probably the same domain as company.com
But what about fb.company.com, which when you look it up is actually a reference to faecebook. Faecebook can then set a cookie that *looks* like a cookie from company.com, but is actually a third party cookie.